Title: [187564] trunk
- Revision
- 187564
- Author
- za...@apple.com
- Date
- 2015-07-29 15:17:03 -0700 (Wed, 29 Jul 2015)
Log Message
Remove the spanner placeholder from m_spannerMap when the placeholder object
gets transferred to a descendant flow.
https://bugs.webkit.org/show_bug.cgi?id=147380
rdar://problem/21981078
Reviewed by David Hyatt.
Before r180328, the spanner placeholder was removed from m_spannerMap through
RenderMultiColumnFlowThread::removeFlowChildInfo() by calling flowThreadRelativeWillBeRemoved()
when the placeholder renderer got transferred to the descendant flow.
Now we just remove it from the map when the renderer is being detached.
Source/WebCore:
Test: fast/multicol/newmulticol/spanner-crash-with-embedded-columns.html
* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
LayoutTests:
* fast/multicol/newmulticol/spanner-crash-with-embedded-columns-expected.txt: Added.
* fast/multicol/newmulticol/spanner-crash-with-embedded-columns.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (187563 => 187564)
--- trunk/LayoutTests/ChangeLog 2015-07-29 22:00:57 UTC (rev 187563)
+++ trunk/LayoutTests/ChangeLog 2015-07-29 22:17:03 UTC (rev 187564)
@@ -1,3 +1,20 @@
+2015-07-29 Zalan Bujtas <za...@apple.com>
+
+ Remove the spanner placeholder from m_spannerMap when the placeholder object
+ gets transferred to a descendant flow.
+ https://bugs.webkit.org/show_bug.cgi?id=147380
+ rdar://problem/21981078
+
+ Reviewed by David Hyatt.
+
+ Before r180328, the spanner placeholder was removed from m_spannerMap through
+ RenderMultiColumnFlowThread::removeFlowChildInfo() by calling flowThreadRelativeWillBeRemoved()
+ when the placeholder renderer got transferred to the descendant flow.
+ Now we just remove it from the map when the renderer is being detached.
+
+ * fast/multicol/newmulticol/spanner-crash-with-embedded-columns-expected.txt: Added.
+ * fast/multicol/newmulticol/spanner-crash-with-embedded-columns.html: Added.
+
2015-07-29 Brady Eidson <beid...@apple.com>
Crash calling webSocket.close() from onError handler for blocked web socket.
Added: trunk/LayoutTests/fast/multicol/newmulticol/spanner-crash-with-embedded-columns-expected.txt (0 => 187564)
--- trunk/LayoutTests/fast/multicol/newmulticol/spanner-crash-with-embedded-columns-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/newmulticol/spanner-crash-with-embedded-columns-expected.txt 2015-07-29 22:17:03 UTC (rev 187564)
@@ -0,0 +1 @@
+PASS if no crash or assert.
Added: trunk/LayoutTests/fast/multicol/newmulticol/spanner-crash-with-embedded-columns.html (0 => 187564)
--- trunk/LayoutTests/fast/multicol/newmulticol/spanner-crash-with-embedded-columns.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/newmulticol/spanner-crash-with-embedded-columns.html 2015-07-29 22:17:03 UTC (rev 187564)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This test that moving a spanner from one flow to another does not end up in a crash.</title>
+<style>
+ html, body {
+ -webkit-column-width: 200px;
+ }
+</style>
+<script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+ function runTest() {
+ setTimeout(function() {
+ document.documentElement.style.webkitColumnWidth = "auto";
+ document.body.style.webkitColumnWidth = "auto";
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+ }
+</script>
+</head>
+<body _onload_="runTest()">
+<div style="-webkit-column-span: all"></div>
+PASS if no crash or assert.
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (187563 => 187564)
--- trunk/Source/WebCore/ChangeLog 2015-07-29 22:00:57 UTC (rev 187563)
+++ trunk/Source/WebCore/ChangeLog 2015-07-29 22:17:03 UTC (rev 187564)
@@ -1,3 +1,22 @@
+2015-07-29 Zalan Bujtas <za...@apple.com>
+
+ Remove the spanner placeholder from m_spannerMap when the placeholder object
+ gets transferred to a descendant flow.
+ https://bugs.webkit.org/show_bug.cgi?id=147380
+ rdar://problem/21981078
+
+ Reviewed by David Hyatt.
+
+ Before r180328, the spanner placeholder was removed from m_spannerMap through
+ RenderMultiColumnFlowThread::removeFlowChildInfo() by calling flowThreadRelativeWillBeRemoved()
+ when the placeholder renderer got transferred to the descendant flow.
+ Now we just remove it from the map when the renderer is being detached.
+
+ Test: fast/multicol/newmulticol/spanner-crash-with-embedded-columns.html
+
+ * rendering/RenderMultiColumnFlowThread.cpp:
+ (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
+
2015-07-29 Brady Eidson <beid...@apple.com>
Review feedback followup to: Crash in WebCore::DocumentLoader::stopLoadingForPolicyChange.
Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (187563 => 187564)
--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2015-07-29 22:00:57 UTC (rev 187563)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2015-07-29 22:17:03 UTC (rev 187564)
@@ -376,10 +376,11 @@
// We have to nuke the placeholder, since the ancestor already lost the mapping to it when
// we shifted the placeholder down into this flow thread.
+ placeholder.flowThread()->m_spannerMap.remove(spanner);
+ placeholder.parent()->removeChild(placeholder);
+
if (subtreeRoot == descendant)
subtreeRoot = spanner;
- placeholder.parent()->removeChild(placeholder);
-
// Now we process the spanner.
descendant = processPossibleSpannerDescendant(subtreeRoot, spanner);
continue;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
