projects / profile / ivi / webkit-efl.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 84396bd)
Source/WebCore: Crash due to accessing removed parent lineboxes when clearing view...
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 22 Feb 2012 21:33:33 +0000 (21:33 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 22 Feb 2012 21:33:33 +0000 (21:33 +0000)
https://bugs.webkit.org/show_bug.cgi?id=79264

Reviewed by Eric Seidel.

When our block needed a full layout, we were deleting our own lineboxes
and letting descendant children (at any level in hierarchy and not just
immediate children) clear their own lineboxes as we keep laying them out.
This was problematic because those descendant children lineboxes were
pointing to removed parent lineboxes in the meantime. An example scenario
where this would go wrong is first-letter object removal, which can cause
clearing view selection, leading to accessing parent lineboxes. The patch
modifies clearing the entire linebox tree upfront. It shouldn't introduce
performance issues since it will eventually happen as we are laying out
those children.

Test: fast/css-generated-content/first-letter-textbox-parent-crash.html

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlock::layoutInlineChildren):

LayoutTests: Crash due to accessing removed parent lineboxes when clearing view selection.
https://bugs.webkit.org/show_bug.cgi?id=79264

Reviewed by Eric Seidel.

* fast/css-generated-content/first-letter-textbox-parent-crash-expected.txt: Added.
* fast/css-generated-content/first-letter-textbox-parent-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108547 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/css-generated-content/first-letter-textbox-parent-crash-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/css-generated-content/first-letter-textbox-parent-crash.html [new file with mode: 0755] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/rendering/RenderBlockLineLayout.cpp patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 72f795a..1de78bb 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,5 +1,15 @@
 2012-02-22  Abhishek Arya  <inferno@chromium.org>
 
+        Crash due to accessing removed parent lineboxes when clearing view selection.
+        https://bugs.webkit.org/show_bug.cgi?id=79264
+ 
+        Reviewed by Eric Seidel.
+
+        * fast/css-generated-content/first-letter-textbox-parent-crash-expected.txt: Added.
+        * fast/css-generated-content/first-letter-textbox-parent-crash.html: Added.
+
+2012-02-22  Abhishek Arya  <inferno@chromium.org>
+
         Cloning and linebox issues in multi-column layout.
         https://bugs.webkit.org/show_bug.cgi?id=78273
 
diff --git a/LayoutTests/fast/css-generated-content/first-letter-textbox-parent-crash-expected.txt b/LayoutTests/fast/css-generated-content/first-letter-textbox-parent-crash-expected.txt
new file mode 100644 (file)
index 0000000..7ef22e9
--- /dev/null
+++ b/LayoutTests/fast/css-generated-content/first-letter-textbox-parent-crash-expected.txt
@@ -0,0 +1 @@
+PASS
diff --git a/LayoutTests/fast/css-generated-content/first-letter-textbox-parent-crash.html b/LayoutTests/fast/css-generated-content/first-letter-textbox-parent-crash.html
new file mode 100755 (executable)
index 0000000..eb49908
--- /dev/null
+++ b/LayoutTests/fast/css-generated-content/first-letter-textbox-parent-crash.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+#test2:first-letter { display: block; }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+window.onload = function() {
+    test1 = document.createElement('div');
+    document.body.appendChild(test1);
+    test2 = document.createElement('div');
+    test2.setAttribute('id', 'test2');
+    test2.appendChild(document.createTextNode('AAA'));
+    test2.style.display = 'inline-block';
+    test1.appendChild(test2); 
+    test1.appendChild(document.createTextNode('A'));
+    document.execCommand('selectall');
+    document.body.offsetTop;
+    document.styleSheets[0].insertRule("#test2 { text-transform: capitalize }");
+    document.body.offsetTop;
+    document.body.innerHTML = "PASS";
+}
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index e56934a..c275cac 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,5 +1,28 @@
 2012-02-22  Abhishek Arya  <inferno@chromium.org>
 
+        Crash due to accessing removed parent lineboxes when clearing view selection.
+        https://bugs.webkit.org/show_bug.cgi?id=79264
+
+        Reviewed by Eric Seidel.
+
+        When our block needed a full layout, we were deleting our own lineboxes
+        and letting descendant children (at any level in hierarchy and not just 
+        immediate children) clear their own lineboxes as we keep laying them out.
+        This was problematic because those descendant children lineboxes were
+        pointing to removed parent lineboxes in the meantime. An example scenario
+        where this would go wrong is first-letter object removal, which can cause
+        clearing view selection, leading to accessing parent lineboxes. The patch
+        modifies clearing the entire linebox tree upfront. It shouldn't introduce
+        performance issues since it will eventually happen as we are laying out
+        those children.
+ 
+        Test: fast/css-generated-content/first-letter-textbox-parent-crash.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2012-02-22  Abhishek Arya  <inferno@chromium.org>
+
         Cloning and linebox issues in multi-column layout.
         https://bugs.webkit.org/show_bug.cgi?id=78273
 
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 296cb06..47b6324 100755 (executable)
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -1462,7 +1462,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
     LineLayoutState layoutState(isFullLayout, repaintLogicalTop, repaintLogicalBottom);
 
     if (isFullLayout)
-        lineBoxes()->deleteLineBoxes(renderArena());
+        deleteLineBoxTree();
 
     // Text truncation only kicks in if your overflow isn't visible and your text-overflow-mode isn't
     // clip.
Domain: Web Framework / Uncategorized;