Title: [141982] trunk
- Revision
- 141982
- Author
- commit-qu...@webkit.org
- Date
- 2013-02-06 03:32:16 -0800 (Wed, 06 Feb 2013)
Log Message
[CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())
https://bugs.webkit.org/show_bug.cgi?id=104517
Patch by Mihai Maerean <mmaer...@adobe.com> on 2013-02-06
Reviewed by Julien Chaffraix.
Source/WebCore:
The RenderObject::inRenderFlowThread bit could have become disconnected from the fact that the RenderObject
has (or not) an enclosing RenderFlowThread.
The cause of this was that, when setting or removing the parent of a RenderObject, the inRenderFlowThread flags
wasn't being set/reset for the children too.
This is now fixed by calling the new setInRenderFlowThreadIncludingDescendants.
The ASSERT was hit for anonymous blocks when detaching the document.
Test: fast/regions/detaching-regions-with-anonymous-blocks.html
* rendering/RenderObject.cpp:
(WebCore::RenderObject::setInRenderFlowThreadRecursive):
(WebCore):
* rendering/RenderObject.h:
(WebCore::RenderObject::setParent):
(RenderObject):
LayoutTests:
The test adds an anonymous block in a region and detaches the body of document. The ASSERT is not hit anymore.
* fast/regions/detaching-regions-with-anonymous-blocks-expected.txt: Added.
* fast/regions/detaching-regions-with-anonymous-blocks.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (141981 => 141982)
--- trunk/LayoutTests/ChangeLog 2013-02-06 11:24:03 UTC (rev 141981)
+++ trunk/LayoutTests/ChangeLog 2013-02-06 11:32:16 UTC (rev 141982)
@@ -1,3 +1,15 @@
+2013-02-06 Mihai Maerean <mmaer...@adobe.com>
+
+ [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())
+ https://bugs.webkit.org/show_bug.cgi?id=104517
+
+ Reviewed by Julien Chaffraix.
+
+ The test adds an anonymous block in a region and detaches the body of document. The ASSERT is not hit anymore.
+
+ * fast/regions/detaching-regions-with-anonymous-blocks-expected.txt: Added.
+ * fast/regions/detaching-regions-with-anonymous-blocks.html: Added.
+
2013-02-06 Marja Hölttä <ma...@chromium.org>
Take referrer policy into account when clearing the referrer header
Added: trunk/LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks-expected.txt (0 => 141982)
--- trunk/LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks-expected.txt 2013-02-06 11:32:16 UTC (rev 141982)
@@ -0,0 +1,3 @@
+Bug 104517: [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())
+
+This test PASSES if it does not CRASH or ASSERT.
Added: trunk/LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks.html (0 => 141982)
--- trunk/LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks.html (rev 0)
+++ trunk/LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks.html 2013-02-06 11:32:16 UTC (rev 141982)
@@ -0,0 +1,31 @@
+<!doctype html>
+<html>
+ <head>
+
+ <script type="text/_javascript_">
+ if(window.testRunner)
+ window.testRunner.dumpAsText();
+
+ window.addEventListener("load",function(){
+ // This previously caused the ASSERT to be hit.
+ var parentNode = document.body.parentNode;
+ parentNode.removeChild(document.body);
+
+ // Display the human readable test result.
+ var body = document.createElement("body");
+ parentNode.appendChild(body);
+ body.innerHTML = "<p>Bug <a href="" [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())</p> <p>This test PASSES if it does not CRASH or ASSERT.</p>";
+ });
+ </script>
+
+ </head>
+
+ <body>
+ <div style="-webkit-flow-into: flow;">
+ <span>
+ a <p>b</p> a
+ </span>
+ </div>
+ <div id="region" style="-webkit-flow-from:flow;"></div>
+ </body>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (141981 => 141982)
--- trunk/Source/WebCore/ChangeLog 2013-02-06 11:24:03 UTC (rev 141981)
+++ trunk/Source/WebCore/ChangeLog 2013-02-06 11:32:16 UTC (rev 141982)
@@ -1,3 +1,27 @@
+2013-02-06 Mihai Maerean <mmaer...@adobe.com>
+
+ [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())
+ https://bugs.webkit.org/show_bug.cgi?id=104517
+
+ Reviewed by Julien Chaffraix.
+
+ The RenderObject::inRenderFlowThread bit could have become disconnected from the fact that the RenderObject
+ has (or not) an enclosing RenderFlowThread.
+ The cause of this was that, when setting or removing the parent of a RenderObject, the inRenderFlowThread flags
+ wasn't being set/reset for the children too.
+ This is now fixed by calling the new setInRenderFlowThreadIncludingDescendants.
+
+ The ASSERT was hit for anonymous blocks when detaching the document.
+
+ Test: fast/regions/detaching-regions-with-anonymous-blocks.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::setInRenderFlowThreadRecursive):
+ (WebCore):
+ * rendering/RenderObject.h:
+ (WebCore::RenderObject::setParent):
+ (RenderObject):
+
2013-02-06 Marja Hölttä <ma...@chromium.org>
Take referrer policy into account when clearing the referrer header
Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (141981 => 141982)
--- trunk/Source/WebCore/rendering/RenderObject.cpp 2013-02-06 11:24:03 UTC (rev 141981)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp 2013-02-06 11:32:16 UTC (rev 141982)
@@ -278,6 +278,16 @@
return node() && node()->renderer() == this && node()->hasTagName(marqueeTag);
}
+void RenderObject::setInRenderFlowThreadIncludingDescendants(bool b)
+{
+ setInRenderFlowThread(b);
+
+ for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+ ASSERT(b != child->inRenderFlowThread());
+ child->setInRenderFlowThreadIncludingDescendants(b);
+ }
+}
+
void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
{
RenderObjectChildList* children = virtualChildren();
Modified: trunk/Source/WebCore/rendering/RenderObject.h (141981 => 141982)
--- trunk/Source/WebCore/rendering/RenderObject.h 2013-02-06 11:24:03 UTC (rev 141981)
+++ trunk/Source/WebCore/rendering/RenderObject.h 2013-02-06 11:32:16 UTC (rev 141982)
@@ -270,10 +270,10 @@
void setParent(RenderObject* parent)
{
m_parent = parent;
- if (parent && parent->inRenderFlowThread())
- setInRenderFlowThread(true);
+ if (parent && parent->inRenderFlowThread() && !inRenderFlowThread())
+ setInRenderFlowThreadIncludingDescendants(true);
else if (!parent && inRenderFlowThread())
- setInRenderFlowThread(false);
+ setInRenderFlowThreadIncludingDescendants(false);
}
//////////////////////////////////////////
private:
@@ -434,6 +434,8 @@
bool inRenderFlowThread() const { return m_bitfields.inRenderFlowThread(); }
void setInRenderFlowThread(bool b = true) { m_bitfields.setInRenderFlowThread(b); }
+ void setInRenderFlowThreadIncludingDescendants(bool = true);
+
virtual bool requiresForcedStyleRecalcPropagation() const { return false; }
#if ENABLE(MATHML)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
