Changeset 32861 in webkit

Timestamp:

May 4, 2008 9:44:54 PM (16 years ago)

Author:

Antti Koivisto

Message:

2008-05-02 Antti Koivisto <Antti Koivisto>

Reviewed by Mitz.

Fix <rdar://problem/5840475>
CrashTracer: [USER] 2 crashes in Safari at com.apple.WebCore: WebCore::RenderBlock::insertPositionedObject

Non-block objects can have transforms so containingBlock() could end up returning null.
RenderObject::container() needs to match.

Test: fast/transforms/container-transform-crash.html

• rendering/RenderObject.cpp: (WebCore::RenderObject::containingBlock): (WebCore::RenderObject::container):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderObject.cpp (modified) (3 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2008-05-02  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mitz.
+
+        Fix <rdar://problem/5840475>
+        CrashTracer: [USER] 2 crashes in Safari at com.apple.WebCore: WebCore::RenderBlock::insertPositionedObject
+        
+        Non-block objects can have transforms so containingBlock() could end up returning null. 
+        RenderObject::container() needs to match.
+
+        Test: fast/transforms/container-transform-crash.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        (WebCore::RenderObject::container):
+
 2008-05-04  Sam Weinig  <sam@webkit.org>
 

trunk/WebCore/rendering/RenderObject.cpp

@@ -797 +797 @@
     RenderObject* o = parent();
     if (!isText() && m_style->position() == FixedPosition) {
-        while (o && !o->isRenderView() && !o->hasTransform())
+        while (o && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
             o = o->parent();
     } else if (!isText() && m_style->position() == AbsolutePosition) {
-        while (o && (o->style()->position() == StaticPosition || (o->isInline() && !o->isReplaced())) && !o->isRenderView() && !o->hasTransform()) {
+        while (o && (o->style()->position() == StaticPosition || (o->isInline() && !o->isReplaced())) && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock())) {
             // For relpositioned inlines, we return the nearest enclosing block.  We don't try
             // to return the inline itself.  This allows us to avoid having a positioned objects
@@ -2457 +2457 @@
         // aren't we'll get the root of our little subtree (most likely
         // we'll just return 0).
-        while (o && o->parent() && !o->hasTransform())
+        while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock()))
             o = o->parent();
     } else if (pos == AbsolutePosition) {
@@ -2463 +2463 @@
         // we may not have one if we're part of an uninstalled subtree.  We'll
         // climb as high as we can though.
-        while (o && o->style()->position() == StaticPosition && !o->isRenderView() && !o->hasTransform())
+        while (o && o->style()->position() == StaticPosition && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
             o = o->parent();
     }