Changeset 74145 in webkit


Ignore:
Timestamp:
Dec 15, 2010 3:06:43 PM (13 years ago)
Author:
commit-queue@webkit.org
Message:

2010-12-15 Yong Li <yoli@rim.com>

Reviewed by Darin Adler.

Reproduce stack overflow when there are too many sibling inline boxes.
https://bugs.webkit.org/show_bug.cgi?id=48255

  • fast/overflow/lots-of-sibling-inline-boxes.html: Added.

2010-12-15 Yong Li <yoli@rim.com>

Reviewed by Darin Adler.

Fix stack overflow when there are too many sibling inline boxes by using
a loop to traverse children instead of calling each sibling from the first child.
https://bugs.webkit.org/show_bug.cgi?id=48255

Test: fast/overflow/lots-of-sibling-inline-boxes.html

  • rendering/InlineBox.h: (WebCore::InlineBox::setConstructed): (WebCore::InlineBox::next):
  • rendering/InlineFlowBox.h: (WebCore::InlineFlowBox::setConstructed):
Location:
trunk
Files:
2 added
4 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r74140 r74145  
     12010-12-15  Yong Li  <yoli@rim.com>
     2
     3        Reviewed by Darin Adler.
     4
     5        Reproduce stack overflow when there are too many sibling inline boxes.
     6        https://bugs.webkit.org/show_bug.cgi?id=48255
     7
     8        * fast/overflow/lots-of-sibling-inline-boxes.html: Added.
     9
    1102010-12-15  Jian Li  <jianli@chromium.org>
    211
  • trunk/WebCore/ChangeLog

    r74139 r74145  
     12010-12-15  Yong Li  <yoli@rim.com>
     2
     3        Reviewed by Darin Adler.
     4
     5        Fix stack overflow when there are too many sibling inline boxes by using
     6        a loop to traverse children instead of calling each sibling from the first child.
     7        https://bugs.webkit.org/show_bug.cgi?id=48255
     8
     9        Test: fast/overflow/lots-of-sibling-inline-boxes.html
     10
     11        * rendering/InlineBox.h:
     12        (WebCore::InlineBox::setConstructed):
     13        (WebCore::InlineBox::next):
     14        * rendering/InlineFlowBox.h:
     15        (WebCore::InlineFlowBox::setConstructed):
     16
    1172010-12-15  Sam Weinig  <sam@webkit.org>
    218
  • trunk/WebCore/rendering/InlineBox.h

    r73385 r74145  
    132132    virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
    133133
     134    InlineBox* next() const { return m_next; }
     135
    134136    // Overloaded new operator.
    135137    void* operator new(size_t, RenderArena*) throw();
     
    177179
    178180    bool isConstructed() { return m_constructed; }
    179     virtual void setConstructed()
    180     {
    181         m_constructed = true;
    182         if (m_next)
    183             m_next->setConstructed();
    184     }
     181    virtual void setConstructed() { m_constructed = true; }
    185182
    186183    void setExtracted(bool b = true) { m_extracted = b; }
  • trunk/WebCore/rendering/InlineFlowBox.h

    r73385 r74145  
    7777    {
    7878        InlineBox::setConstructed();
    79         if (firstChild())
    80             firstChild()->setConstructed();
     79        for (InlineBox* child = firstChild(); child; child = child->next())
     80            child->setConstructed();
    8181    }
    8282
Note: See TracChangeset for help on using the changeset viewer.