Changeset 81812 in webkit

Timestamp:

Mar 23, 2011 3:04:02 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2011-03-23 Luiz Agostini <​luiz.agostini@openbossa.org>

Reviewed by David Hyatt.

REGRESSION(81035): crash in RenderDetails::removeChild
​https://bugs.webkit.org/show_bug.cgi?id=56773

• fast/html/details-children-merge-crash-expected.txt: Added.
• fast/html/details-children-merge-crash.html: Added.

2011-03-23 Luiz Agostini <​luiz.agostini@openbossa.org>

Reviewed by David Hyatt.

REGRESSION(81035): crash in RenderDetails::removeChild
​https://bugs.webkit.org/show_bug.cgi?id=56773

Test: fast/html/details-children-merge-crash.html

Preventing merging of RenderDetails's anonymous children.

• rendering/RenderBlock.cpp: (WebCore::canMergeContiguousAnonymousBlocks):

Fixing RenderDetails::removeChild and cleaning m_marker in RenderDetails::destroy.

• rendering/RenderDetails.cpp: (WebCore::RenderDetails::destroy): (WebCore::RenderDetails::removeChild):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/html/details-children-merge-crash-expected.txt (added)
• LayoutTests/fast/html/details-children-merge-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderDetails.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-03-23  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION(81035): crash in RenderDetails::removeChild
+        https://bugs.webkit.org/show_bug.cgi?id=56773
+
+        * fast/html/details-children-merge-crash-expected.txt: Added.
+        * fast/html/details-children-merge-crash.html: Added.
+
 2011-03-23  Xiaomei Ji  <xji@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-03-23  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION(81035): crash in RenderDetails::removeChild
+        https://bugs.webkit.org/show_bug.cgi?id=56773
+
+        Test: fast/html/details-children-merge-crash.html
+
+        Preventing merging of RenderDetails's anonymous children.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::canMergeContiguousAnonymousBlocks):
+
+        Fixing RenderDetails::removeChild and cleaning m_marker in RenderDetails::destroy.
+
+        * rendering/RenderDetails.cpp:
+        (WebCore::RenderDetails::destroy):
+        (WebCore::RenderDetails::removeChild):
+
 2011-03-23  Xiaomei Ji  <xji@chromium.org>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -932 +932 @@
 {
     if (oldChild->documentBeingDestroyed() || oldChild->isInline() || oldChild->virtualContinuation())
+        return false;
+
+    if (oldChild->parent() && oldChild->parent()->isDetails())
         return false;
 

trunk/Source/WebCore/rendering/RenderDetails.cpp

@@ -47 +47 @@
 void RenderDetails::destroy()
 {
-    if (m_marker)
+    if (m_marker) {
         m_marker->destroy();
+        m_marker = 0;
+    }
 
     RenderBlock::destroy();
@@ -80 +82 @@
 void RenderDetails::removeChild(RenderObject* oldChild)
 {
-    if (oldChild == m_summaryBlock || oldChild == m_contentBlock) {
+    if (oldChild == m_summaryBlock) {
         RenderBlock::removeChild(oldChild);
         m_summaryBlock = 0;
@@ -86 +88 @@
     }
 
-    if (oldChild == m_mainSummary) {
+    if (oldChild == m_contentBlock) {
+        RenderBlock::removeChild(oldChild);
+        m_contentBlock = 0;
+        return;
+    }
+
+    if (oldChild == m_mainSummary && m_summaryBlock) {
         m_summaryBlock->removeChild(m_mainSummary);
         return;