Commit dd34df48 authored by jchaffraix@webkit.org's avatar jchaffraix@webkit.org

Crash in WebCore::RenderTableSection::rowLogicalHeightChanged

https://webkit.org/b/76842

Reviewed by Darin Adler.

Source/WebCore:

Test: fast/table/crash-section-logical-height-changed-needsCellRecalc.html

The issue was that we would access our section's structure when it was dirty.

* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::rowLogicalHeightChanged):
Bail out if we need cells recalculation as our internal structure is not up-to-date
and we will recompute all the rows' heights as part of the recomputation anyway.

LayoutTests:

* fast/table/crash-section-logical-height-changed-needsCellRecalc-expected.txt: Added.
* fast/table/crash-section-logical-height-changed-needsCellRecalc.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@105685 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 23359ecd
2012-01-23 Julien Chaffraix <jchaffraix@webkit.org>
Crash in WebCore::RenderTableSection::rowLogicalHeightChanged
https://webkit.org/b/76842
Reviewed by Darin Adler.
* fast/table/crash-section-logical-height-changed-needsCellRecalc-expected.txt: Added.
* fast/table/crash-section-logical-height-changed-needsCellRecalc.html: Added.
2012-01-23 Dmitry Lomov <dslomov@google.com>
[Chromium] Implement layoutTestController.workerThreadCount in DRT
Bug 76842: Crash in WebCore::RenderTableSection::rowLogicalHeightChanged
This test passes if it does not crash nor ASSERT.
<style>
.c3 { position: fixed; }
.c12:first-letter { visibility: inherit; }
.c12 { -webkit-appearance: button; }
.c13 { display: table-row; }
.c13:nth-last-child(odd) { height: 80%; }
</style>
<script>
if (window.layoutTestController)
layoutTestController.dumpAsText();
function boom() {
var quote = document.createElement('q');
document.documentElement.appendChild(quote);
base = document.createElement('base');
base2 = document.createElement('base');
base2.setAttribute('class', 'c3');
quote.appendChild(base2);
var ins = document.createElement('ins');
base2.appendChild(ins);
var sub = document.createElement('sub');
var quote3 = document.createElement('q');
quote3.setAttribute('class', 'c12');
sub.appendChild(quote3);
figureRow = document.createElement('figure');
figureRow.setAttribute('class', 'c13');
document.documentElement.appendChild(figureRow);
var col = document.createElement('col');
col.setAttribute('class', 'c13');
document.documentElement.appendChild(col);
var select = document.createElement('select');
document.documentElement.appendChild(select);
code = document.createElement('code');
document.documentElement.appendChild(code);
quote2 = document.createElement('q');
setTimeout('quote2.appendChild(code);', 321);
ins.appendChild(sub);
setTimeout('base.appendChild(figureRow);', 251);
text = document.createTextNode('-1435037881');
setTimeout('figureRow.appendChild(text);', 206);
}
window.onload = boom;
</script>
<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=76842">76842</a>: Crash in WebCore::RenderTableSection::rowLogicalHeightChanged</p>
<p>This test passes if it does not crash nor ASSERT.</p>
2012-01-23 Julien Chaffraix <jchaffraix@webkit.org>
Crash in WebCore::RenderTableSection::rowLogicalHeightChanged
https://webkit.org/b/76842
Reviewed by Darin Adler.
Test: fast/table/crash-section-logical-height-changed-needsCellRecalc.html
The issue was that we would access our section's structure when it was dirty.
* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::rowLogicalHeightChanged):
Bail out if we need cells recalculation as our internal structure is not up-to-date
and we will recompute all the rows' heights as part of the recomputation anyway.
2012-01-23 Kentaro Hara <haraken@chromium.org>
[Refactoring] Make finish() of CodeGeneratorJS.pm empty
......@@ -1198,6 +1198,9 @@ void RenderTableSection::recalcCells()
// FIXME: This function could be made O(1) in certain cases (like for the non-most-constrainive cells' case).
void RenderTableSection::rowLogicalHeightChanged(unsigned rowIndex)
{
if (needsCellRecalc())
return;
setRowLogicalHeightToRowStyleLogicalHeightIfNotRelative(m_grid[rowIndex]);
for (RenderObject* cell = m_grid[rowIndex].rowRenderer->firstChild(); cell; cell = cell->nextSibling()) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment