Commit a0b824e8 authored by inferno@chromium.org's avatar inferno@chromium.org

2011-05-12 Carol Szabo <carol@webkit.org>

        Reviewed by David Hyatt.

        Fix reparenting and destruction of counter nodes. 
        https://bugs.webkit.org/show_bug.cgi?id=57929

        Fixed several issues related to not met assertions.
        See below in the per file description.

        Test: fast/css/counters/element-removal-crash.xhtml

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::removeChildren):
        Fixed the fact that Node::detach() used to be called
        while the DOM tree was in an inconsistent state.
        * rendering/RenderCounter.cpp:
        (WebCore::RenderCounter::rendererRemovedFromTree):
        Introduced this function to remove counters from
        descendents of renderers removed from the renderer
        tree not only from the removed renderers themselves.
        * rendering/RenderCounter.h:
        * rendering/RenderObjectChildList.cpp:
        (WebCore::RenderObjectChildList::removeChildNode):
        Changed to call RenderCounter::rendererRemovedFromTree
        instead of RenderCounter::destroyCounters.
2011-05-08 Abhishek Arya <inferno@chromium.org> and Carol Szabo  <carol@webkit.org>

        Reviewed by David Hyatt.

        Fix reparenting and destruction of counter nodes.
        https://bugs.webkit.org/show_bug.cgi?id=57929

        * fast/css/counters/element-removal-crash-expected.txt: Added.
        * fast/css/counters/element-removal-crash.xhtml: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@86358 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 8a4754eb
2011-05-08 Abhishek Arya <inferno@chromium.org> and Carol Szabo <carol@webkit.org>
Reviewed by David Hyatt.
Fix reparenting and destruction of counter nodes.
https://bugs.webkit.org/show_bug.cgi?id=57929
* fast/css/counters/element-removal-crash-expected.txt: Added.
* fast/css/counters/element-removal-crash.xhtml: Added.
2011-05-12 Chang Shu <cshu@webkit.org>
Reviewed by Darin Adler.
<span xmlns="http://www.w3.org/1999/xhtml">
<span/>
<style>
span
{
counter-increment: counter;
}
span:before
{
content: counter(counter);
}
</style>
<script>
if (window.layoutTestController)
{
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
function runTest()
{
document.documentElement.textContent = "PASS";
if (window.layoutTestController)
layoutTestController.notifyDone();
}
setTimeout('runTest()', 0);
</script>
<span/>
2011-05-12 Carol Szabo <carol@webkit.org>
Reviewed by David Hyatt.
Fix reparenting and destruction of counter nodes.
https://bugs.webkit.org/show_bug.cgi?id=57929
Fixed several issues related to not met assertions.
See below in the per file description.
Test: fast/css/counters/element-removal-crash.xhtml
* dom/ContainerNode.cpp:
(WebCore::ContainerNode::removeChildren):
Fixed the fact that Node::detach() used to be called
while the DOM tree was in an inconsistent state.
* rendering/RenderCounter.cpp:
(WebCore::RenderCounter::rendererRemovedFromTree):
Introduced this function to remove counters from
descendents of renderers removed from the renderer
tree not only from the removed renderers themselves.
* rendering/RenderCounter.h:
* rendering/RenderObjectChildList.cpp:
(WebCore::RenderObjectChildList::removeChildNode):
Changed to call RenderCounter::rendererRemovedFromTree
instead of RenderCounter::destroyCounters.
2011-05-12 Luke Macpherson <macpherson@chromium.org>
Reviewed by Dimitri Glazkov.
......@@ -551,21 +551,31 @@ void ContainerNode::removeChildren()
m_firstChild = next;
if (n == m_lastChild)
m_lastChild = 0;
if (n->attached())
n->detach();
removedChildren.append(n.release());
}
allowEventDispatch();
size_t removedChildrenCount = removedChildren.size();
size_t i;
// Detach the nodes only after properly removed from the tree because
// a. detaching requires a proper DOM tree (for counters and quotes for
// example) and during the previous loop the next sibling still points to
// the node being removed while the node being removed does not point back
// and does not point to the same parent as its next sibling.
// b. destroying Renderers of standalone nodes is sometimes faster.
for (i = 0; i < removedChildrenCount; ++i) {
Node* removedChild = removedChildren[i].get();
if (removedChild->attached())
removedChild->detach();
}
allowEventDispatch();
// Dispatch a single post-removal mutation event denoting a modified subtree.
childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
dispatchSubtreeModifiedEvent();
for (size_t i = 0; i < removedChildrenCount; ++i) {
for (i = 0; i < removedChildrenCount; ++i) {
Node* removedChild = removedChildren[i].get();
if (removedChild->inDocument())
removedChild->removedFromDocument();
......
......@@ -575,6 +575,19 @@ void RenderCounter::destroyCounterNode(RenderObject* owner, const AtomicString&
// map associated with a renderer, so there is no risk in leaking the map.
}
void RenderCounter::rendererRemovedFromTree(RenderObject* removedRenderer)
{
RenderObject* currentRenderer = removedRenderer->lastLeafChild();
if (!currentRenderer)
currentRenderer = removedRenderer;
while (true) {
destroyCounterNodes(currentRenderer);
if (currentRenderer == removedRenderer)
break;
currentRenderer = currentRenderer->previousInPreOrder();
}
}
static void updateCounters(RenderObject* renderer)
{
ASSERT(renderer->style());
......
......@@ -37,6 +37,7 @@ public:
static void destroyCounterNodes(RenderObject*);
static void destroyCounterNode(RenderObject*, const AtomicString& identifier);
static void rendererSubtreeAttached(RenderObject*);
static void rendererRemovedFromTree(RenderObject*);
static void rendererStyleChanged(RenderObject*, const RenderStyle* oldStyle, const RenderStyle* newStyle);
private:
......
......@@ -129,8 +129,7 @@ RenderObject* RenderObjectChildList::removeChildNode(RenderObject* owner, Render
oldChild->setNextSibling(0);
oldChild->setParent(0);
if (oldChild->m_hasCounterNodeMap)
RenderCounter::destroyCounterNodes(oldChild);
RenderCounter::rendererRemovedFromTree(oldChild);
RenderQuote::rendererRemovedFromTree(oldChild);
if (AXObjectCache::accessibilityEnabled())
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment