Changeset 75810 in webkit


Ignore:
Timestamp:
Jan 14, 2011 12:35:01 PM (13 years ago)
Author:
inferno@chromium.org
Message:

2011-01-14 Abhishek Arya <​inferno@chromium.org>

Reviewed by David Hyatt.

Prevent merging of anonymous blocks if one of them is already getting
destroyed.
​https://bugs.webkit.org/show_bug.cgi?id=52402

Test: fast/block/merge-anonymous-block-remove-child-crash2.html

  • rendering/RenderBlock.cpp: (WebCore::RenderBlock::RenderBlock): initialize m_beingDestroyed to false. (WebCore::RenderBlock::destroy): set m_beingDestroyed to true. (WebCore::canMergeContiguousAnonymousBlocks): do not merge if any or prev or next is being destroyed. (WebCore::RenderBlock::removeChild): remove the hack previously done for preventing oldChild merging with nextBlock's next sibling.
  • rendering/RenderBlock.h: (WebCore::RenderBlock::beingDestroyed): public function for m_beingDestroyed.

2011-01-14 Abhishek Arya <​inferno@chromium.org>

Reviewed by David Hyatt.

Tests that we do not crash when trying to merge anonymous blocks, one of which
is already getting destroyed.
​https://bugs.webkit.org/show_bug.cgi?id=52402

  • fast/block/merge-anonymous-block-remove-child-crash2-expected.txt: Added.
  • fast/block/merge-anonymous-block-remove-child-crash2.html: Added.
Location:
trunk
Files:
2 added
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r75802 r75810  
     12011-01-14  Abhishek Arya  <inferno@chromium.org>
     2
     3        Reviewed by David Hyatt.
     4
     5        Tests that we do not crash when trying to merge anonymous blocks, one of which
     6        is already getting destroyed.
     7        https://bugs.webkit.org/show_bug.cgi?id=52402
     8
     9        * fast/block/merge-anonymous-block-remove-child-crash2-expected.txt: Added.
     10        * fast/block/merge-anonymous-block-remove-child-crash2.html: Added.
     11
    1122011-01-14  Tony Chang  <tony@chromium.org>
    213

  • trunk/Source/WebCore/ChangeLog

    r75808 r75810  
     12011-01-14  Abhishek Arya  <inferno@chromium.org>
     2
     3        Reviewed by David Hyatt.
     4
     5        Prevent merging of anonymous blocks if one of them is already getting
     6        destroyed.
     7        https://bugs.webkit.org/show_bug.cgi?id=52402
     8
     9        Test: fast/block/merge-anonymous-block-remove-child-crash2.html
     10
     11        * rendering/RenderBlock.cpp:
     12        (WebCore::RenderBlock::RenderBlock): initialize m_beingDestroyed to false.
     13        (WebCore::RenderBlock::destroy): set m_beingDestroyed to true.
     14        (WebCore::canMergeContiguousAnonymousBlocks): do not merge if any or prev or next is being destroyed.
     15        (WebCore::RenderBlock::removeChild): remove the hack previously done for preventing oldChild merging with nextBlock's next sibling.
     16        * rendering/RenderBlock.h:
     17        (WebCore::RenderBlock::beingDestroyed): public function for m_beingDestroyed.
     18
    1192011-01-14  Pavel Feldman  <pfeldman@chromium.org>
    220

  • trunk/Source/WebCore/rendering/RenderBlock.cpp

    r75537 r75810  
    113113      , m_rareData(0)
    114114      , m_lineHeight(-1)
     115      , m_beingDestroyed(false)
    115116{
    116117    setChildrenInline(true);
    … …  
    147148void RenderBlock::destroy()
    148149{
     150    // Mark as being destroyed to avoid trouble with merges in removeChild().
     151    m_beingDestroyed = true;
     152
    149153    // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
    150154    // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
    … …  
    927931        return false;
    928932
    929     if ((prev && (!prev->isAnonymousBlock() || toRenderBlock(prev)->continuation()))
    930         || (next && (!next->isAnonymousBlock() || toRenderBlock(next)->continuation())))
     933    if ((prev && (!prev->isAnonymousBlock() || toRenderBlock(prev)->continuation() || toRenderBlock(prev)->beingDestroyed()))
     934        || (next && (!next->isAnonymousBlock() || toRenderBlock(next)->continuation() || toRenderBlock(next)->beingDestroyed())))
    931935        return false;
    932936
    … …  
    988992            // Take all the children out of the |next| block and put them in
    989993            // the |prev| block.
    990             nextBlock->moveAllChildrenTo(prevBlock, nextBlock->hasLayer() || prevBlock->hasLayer());
    991 
    992             // FIXME: When we destroy nextBlock, it might happen that nextBlock's next sibling block and
    993             // oldChild can get merged. Since oldChild is getting removed, we do not want to move
    994             // nextBlock's next sibling block's children into it. By setting a fake continuation,
    995             // we prevent this from happening. This is not the best approach, we should replace this
    996             // something better later to automatically detect that oldChild is getting removed.
    997             RenderBlock* oldChildBlock = 0;
    998             if (oldChild->isAnonymous() && oldChild->isRenderBlock() && !toRenderBlock(oldChild)->continuation()) {
    999                 oldChildBlock = toRenderBlock(oldChild);
    1000                 oldChildBlock->setContinuation(oldChildBlock);               
    1001             }         
     994            nextBlock->moveAllChildrenTo(prevBlock, nextBlock->hasLayer() || prevBlock->hasLayer());       
    1002995           
    1003996            // Delete the now-empty block's lines and nuke it.
    … …  
    1005998            nextBlock->destroy();
    1006999            next = 0;
    1007 
    1008             // FIXME: Revert the continuation change done above.
    1009             if (oldChildBlock)
    1010                 oldChildBlock->setContinuation(0);
    10111000        }
    10121001    }

  • trunk/Source/WebCore/rendering/RenderBlock.h

    r74775 r75810  
    5656
    5757    virtual void destroy();
     58    bool beingDestroyed() const { return m_beingDestroyed; }
    5859
    5960    // These two functions are overridden for inline-block.
    … …  
    713714    RenderLineBoxList m_lineBoxes;   // All of the root line boxes created for this block flow.  For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
    714715
    715     mutable int m_lineHeight;
     716    mutable int m_lineHeight : 31;
     717    bool m_beingDestroyed : 1;
    716718
    717719    // RenderRubyBase objects need to be able to split and merge, moving their children around
Note: See TracChangeset for help on using the changeset viewer.