Title: [105795] branches/chromium/963
- Revision
- 105795
- Author
- [email protected]
- Date
- 2012-01-24 13:23:13 -0800 (Tue, 24 Jan 2012)
Log Message
Merge 105685 - Crash in WebCore::RenderTableSection::rowLogicalHeightChanged
BUG=108918
Review URL: https://chromiumcodereview.appspot.com/9214019
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc-expected.txt (from rev 105685, trunk/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc-expected.txt) (0 => 105795)
--- branches/chromium/963/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc-expected.txt 2012-01-24 21:23:13 UTC (rev 105795)
@@ -0,0 +1,5 @@
+Bug 76842: Crash in WebCore::RenderTableSection::rowLogicalHeightChanged
+
+This test passes if it does not crash nor ASSERT.
+
+
Copied: branches/chromium/963/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc.html (from rev 105685, trunk/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc.html) (0 => 105795)
--- branches/chromium/963/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/table/crash-section-logical-height-changed-needsCellRecalc.html 2012-01-24 21:23:13 UTC (rev 105795)
@@ -0,0 +1,53 @@
+<style>
+.c3 { position: fixed; }
+.c12:first-letter { visibility: inherit; }
+.c12 { -webkit-appearance: button; }
+.c13 { display: table-row; }
+.c13:nth-last-child(odd) { height: 80%; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function boom() {
+ var quote = document.createElement('q');
+ document.documentElement.appendChild(quote);
+
+ base = document.createElement('base');
+ base2 = document.createElement('base');
+ base2.setAttribute('class', 'c3');
+ quote.appendChild(base2);
+
+ var ins = document.createElement('ins');
+ base2.appendChild(ins);
+
+ var sub = document.createElement('sub');
+ var quote3 = document.createElement('q');
+ quote3.setAttribute('class', 'c12');
+ sub.appendChild(quote3);
+
+ figureRow = document.createElement('figure');
+ figureRow.setAttribute('class', 'c13');
+ document.documentElement.appendChild(figureRow);
+
+ var col = document.createElement('col');
+ col.setAttribute('class', 'c13');
+ document.documentElement.appendChild(col);
+
+ var select = document.createElement('select');
+ document.documentElement.appendChild(select);
+
+ code = document.createElement('code');
+ document.documentElement.appendChild(code);
+
+ quote2 = document.createElement('q');
+ setTimeout('quote2.appendChild(code);', 321);
+ ins.appendChild(sub);
+ setTimeout('base.appendChild(figureRow);', 251);
+ text = document.createTextNode('-1435037881');
+ setTimeout('figureRow.appendChild(text);', 206);
+}
+window._onload_ = boom;
+</script>
+<p>Bug <a href="" Crash in WebCore::RenderTableSection::rowLogicalHeightChanged</p>
+<p>This test passes if it does not crash nor ASSERT.</p>
Modified: branches/chromium/963/Source/WebCore/rendering/RenderTableSection.cpp (105794 => 105795)
--- branches/chromium/963/Source/WebCore/rendering/RenderTableSection.cpp 2012-01-24 21:22:07 UTC (rev 105794)
+++ branches/chromium/963/Source/WebCore/rendering/RenderTableSection.cpp 2012-01-24 21:23:13 UTC (rev 105795)
@@ -1155,6 +1155,22 @@
setNeedsLayout(true);
}
+// FIXME: This function could be made O(1) in certain cases (like for the non-most-constrainive cells' case).
+void RenderTableSection::rowLogicalHeightChanged(unsigned rowIndex)
+{
+ if (needsCellRecalc())
+ return;
+
+ setRowLogicalHeightToRowStyleLogicalHeightIfNotRelative(m_grid[rowIndex]);
+
+ for (RenderObject* cell = m_grid[rowIndex].rowRenderer->firstChild(); cell; cell = cell->nextSibling()) {
+ if (!cell->isTableCell())
+ continue;
+
+ updateLogicalHeightForCell(m_grid[rowIndex], toRenderTableCell(cell));
+ }
+}
+
void RenderTableSection::setNeedsCellRecalc()
{
m_needsCellRecalc = true;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
