Changeset 66052 in webkit


Ignore:
Timestamp:
Aug 25, 2010 4:10:28 PM (14 years ago)
Author:
inferno@chromium.org
Message:

2010-08-25 Cris Neckar <​cdn@chromium.org>

Reviewed by Darin Adler.

Added abort condition for RenderCounters when traversing a detached render tree.
​https://bugs.webkit.org/show_bug.cgi?id=43812

Test: fast/css/counters/counter-traverse-object-crash.html

  • rendering/RenderCounter.cpp: (WebCore::findPlaceForCounter):

2010-08-25 Cris Neckar <​cdn@chromium.org>

Reviewed by Darin Adler.

Assertion failure in RenderCounter when traversing a detached render trees.
​https://bugs.webkit.org/show_bug.cgi?id=43812

  • fast/css/counters/counter-traverse-object-crash-expected.txt: Added.
  • fast/css/counters/counter-traverse-object-crash.html: Added.
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r66050 r66052  
     12010-08-25  Cris Neckar  <cdn@chromium.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        Assertion failure in RenderCounter when traversing a detached render trees.
     6        https://bugs.webkit.org/show_bug.cgi?id=43812
     7
     8        * fast/css/counters/counter-traverse-object-crash-expected.txt: Added.
     9        * fast/css/counters/counter-traverse-object-crash.html: Added.
     10
    1112010-08-25  Chris Marrin  <cmarrin@apple.com>
    212

  • trunk/WebCore/ChangeLog

    r66050 r66052  
     12010-08-25  Cris Neckar  <cdn@chromium.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        Added abort condition for RenderCounters when traversing a detached render tree.
     6        https://bugs.webkit.org/show_bug.cgi?id=43812
     7
     8        Test: fast/css/counters/counter-traverse-object-crash.html
     9
     10        * rendering/RenderCounter.cpp:
     11        (WebCore::findPlaceForCounter):
     12
    1132010-08-25  Chris Marrin  <cmarrin@apple.com>
    214

  • trunk/WebCore/rendering/RenderCounter.cpp

    r54317 r66052  
    137137    previousSibling = 0;
    138138    while (currentRenderer) {
     139        // A sibling without a parent means that the counter node tree was not constructed correctly so we stop
     140        // traversing. In the future RenderCounter should handle RenderObjects that are not connected to the
     141        // render tree at counter node creation. See bug 43812.
     142        if (previousSibling && !previousSibling->parent())
     143            return false;
    139144        CounterNode* currentCounter = makeCounterNode(currentRenderer, identifier, false);
    140145        if (searchEndRenderer == currentRenderer) {
Note: See TracChangeset for help on using the changeset viewer.