Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(469)

Side by Side Diff: Source/core/rendering/RenderBlock.cpp

Issue 880113002: Fix crash when establishing an inline continuation inside a block continuation. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Remove assertion in LayoutTable::addChildIgnoringContinuation() - crashed fast/table/crash-bad-chil… Created 5 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « Source/core/layout/LayoutTable.cpp ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org) 2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
3 * (C) 1999 Antti Koivisto (koivisto@kde.org) 3 * (C) 1999 Antti Koivisto (koivisto@kde.org)
4 * (C) 2007 David Smith (catfish.man@gmail.com) 4 * (C) 2007 David Smith (catfish.man@gmail.com)
5 * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved. 5 * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
6 * Copyright (C) Research In Motion Limited 2010. All rights reserved. 6 * Copyright (C) Research In Motion Limited 2010. All rights reserved.
7 * 7 *
8 * This library is free software; you can redistribute it and/or 8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Library General Public 9 * modify it under the terms of the GNU Library General Public
10 * License as published by the Free Software Foundation; either 10 * License as published by the Free Software Foundation; either
(...skipping 432 matching lines...) Expand 10 before | Expand all | Expand 10 after
443 } 443 }
444 444
445 if (!beforeChild && !last->firstChild()) 445 if (!beforeChild && !last->firstChild())
446 return nextToLast; 446 return nextToLast;
447 return last; 447 return last;
448 } 448 }
449 449
450 void RenderBlock::addChildToContinuation(RenderObject* newChild, RenderObject* b eforeChild) 450 void RenderBlock::addChildToContinuation(RenderObject* newChild, RenderObject* b eforeChild)
451 { 451 {
452 RenderBlock* flow = continuationBefore(beforeChild); 452 RenderBlock* flow = continuationBefore(beforeChild);
453 ASSERT(!beforeChild || beforeChild->parent()->isAnonymousColumnSpanBlock() | | beforeChild->parent()->isRenderBlock());
454 RenderBoxModelObject* beforeChildParent = 0; 453 RenderBoxModelObject* beforeChildParent = 0;
455 if (beforeChild) 454 if (beforeChild) {
456 beforeChildParent = toRenderBoxModelObject(beforeChild->parent()); 455 beforeChildParent = toRenderBoxModelObject(beforeChild->parent());
457 else { 456 // Don't attempt to insert into something that isn't a RenderBlockFlow ( block
457 // container). While the DOM nodes of |beforeChild| and |newChild| are s iblings, there may
458 // be anonymous table wrapper objects around |beforeChild| on the layout side. Therefore,
459 // find the nearest RenderBlockFlow. If it turns out that the new render er doesn't belong
460 // inside the anonymous table, this will make sure that it's really put on the outside. If
461 // it turns out that it does belong inside it, the normal child insertio n machinery will
462 // make sure it ends up there, and at the right place too. We cannot jus t guess that it's
463 // going to be right under the parent of |beforeChild|.
464 while (beforeChildParent && !beforeChildParent->isRenderBlockFlow()) {
465 ASSERT(!beforeChildParent->virtualContinuation());
466 ASSERT(beforeChildParent->isAnonymous());
467 RELEASE_ASSERT(beforeChildParent != this);
468 beforeChildParent = toRenderBoxModelObject(beforeChildParent->parent ());
469 }
470 ASSERT(beforeChildParent);
471 } else {
458 RenderBoxModelObject* cont = flow->continuation(); 472 RenderBoxModelObject* cont = flow->continuation();
459 if (cont) 473 if (cont)
460 beforeChildParent = cont; 474 beforeChildParent = cont;
461 else 475 else
462 beforeChildParent = flow; 476 beforeChildParent = flow;
463 } 477 }
464 478
465 if (newChild->isFloatingOrOutOfFlowPositioned()) { 479 if (newChild->isFloatingOrOutOfFlowPositioned()) {
466 beforeChildParent->addChildIgnoringContinuation(newChild, beforeChild); 480 beforeChildParent->addChildIgnoringContinuation(newChild, beforeChild);
467 return; 481 return;
(...skipping 3479 matching lines...) Expand 10 before | Expand all | Expand 10 after
3947 void RenderBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* m arkedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const Render Object* obj) const 3961 void RenderBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* m arkedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const Render Object* obj) const
3948 { 3962 {
3949 showRenderObject(); 3963 showRenderObject();
3950 for (const RootInlineBox* root = firstRootBox(); root; root = root->nextRoot Box()) 3964 for (const RootInlineBox* root = firstRootBox(); root; root = root->nextRoot Box())
3951 root->showLineTreeAndMark(markedBox1, markedLabel1, markedBox2, markedLa bel2, obj, 1); 3965 root->showLineTreeAndMark(markedBox1, markedLabel1, markedBox2, markedLa bel2, obj, 1);
3952 } 3966 }
3953 3967
3954 #endif 3968 #endif
3955 3969
3956 } // namespace blink 3970 } // namespace blink
OLDNEW
« no previous file with comments | « Source/core/layout/LayoutTable.cpp ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698