[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc
jschuh at chromium.org
jschuh at chromium.org
Wed Dec 22 13:58:38 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit e94df972033a027763daf7546fd45a42496df78e
Author: jschuh at chromium.org <jschuh at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu Sep 30 20:31:45 2010 +0000
2010-09-30 Cris Neckar <cdn at chromium.org>
Reviewed by Darin Adler.
Added check to test for removed counter node when calling findPlaceForCounter() in updateCounters().
Added refcounting to counternodes in countermaps.
https://bugs.webkit.org/show_bug.cgi?id=46387
Test: fast/css/counters/counter-traverse-table-cell.html
* rendering/CounterNode.cpp:
(WebCore::CounterNode::create):
* rendering/CounterNode.h:
* rendering/RenderCounter.cpp:
(WebCore::makeCounterNode):
(WebCore::destroyCounterNodeWithoutMapRemoval):
(WebCore::RenderCounter::destroyCounterNodes):
(WebCore::RenderCounter::destroyCounterNode):
(WebCore::updateCounters):
2010-09-30 Cris Neckar <cdn at chromium.org>
Reviewed by Darin Adler.
Tests for crash in counter nodes when traversing table cells.
https://bugs.webkit.org/show_bug.cgi?id=46387
* fast/css/counters/counter-traverse-table-cell-expected.txt: Added.
* fast/css/counters/counter-traverse-table-cell.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@68819 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 002034b..e4d6533 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-09-30 Cris Neckar <cdn at chromium.org>
+
+ Reviewed by Darin Adler.
+
+ Tests for crash in counter nodes when traversing table cells.
+ https://bugs.webkit.org/show_bug.cgi?id=46387
+
+ * fast/css/counters/counter-traverse-table-cell-expected.txt: Added.
+ * fast/css/counters/counter-traverse-table-cell.html: Added.
+
2010-09-30 Alpha Lam <hclam at chromium.org>
Unreviewed. Build fix.
diff --git a/LayoutTests/fast/css/counters/counter-traverse-table-cell-expected.txt b/LayoutTests/fast/css/counters/counter-traverse-table-cell-expected.txt
new file mode 100644
index 0000000..2186b92
--- /dev/null
+++ b/LayoutTests/fast/css/counters/counter-traverse-table-cell-expected.txt
@@ -0,0 +1 @@
+This tests that we don't crash when using the CSS counters feature.
diff --git a/LayoutTests/fast/css/counters/counter-traverse-table-cell.html b/LayoutTests/fast/css/counters/counter-traverse-table-cell.html
new file mode 100644
index 0000000..b70c92c
--- /dev/null
+++ b/LayoutTests/fast/css/counters/counter-traverse-table-cell.html
@@ -0,0 +1,34 @@
+<html>
+ <head>
+ <script>
+ function test()
+ {
+ document.getElementsByTagName("iframe")[0].src = "";
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ }
+ </script>
+ </head>
+ <body id="body" onload="test()">
+ This tests that we don't crash when using the CSS counters feature.
+ <iframe src="data:text/html,
+ <style>
+ .control {
+ counter-reset: inline;
+ display: table;
+ }
+ * {
+ display: table-cell;
+ }
+ span {
+ counter-reset: inline;
+ }
+ </style>
+ <div class='control'></div>
+ <div>
+ <span></span><span>
+ </div>
+ <span>
+ "></iframe>
+ </body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index ee3ecac..561342a 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,23 @@
+2010-09-30 Cris Neckar <cdn at chromium.org>
+
+ Reviewed by Darin Adler.
+
+ Added check to test for removed counter node when calling findPlaceForCounter() in updateCounters().
+ Added refcounting to counternodes in countermaps.
+ https://bugs.webkit.org/show_bug.cgi?id=46387
+
+ Test: fast/css/counters/counter-traverse-table-cell.html
+
+ * rendering/CounterNode.cpp:
+ (WebCore::CounterNode::create):
+ * rendering/CounterNode.h:
+ * rendering/RenderCounter.cpp:
+ (WebCore::makeCounterNode):
+ (WebCore::destroyCounterNodeWithoutMapRemoval):
+ (WebCore::RenderCounter::destroyCounterNodes):
+ (WebCore::RenderCounter::destroyCounterNode):
+ (WebCore::updateCounters):
+
2010-09-30 David Hyatt <hyatt at apple.com>
Reviewed by Beth Dakin.
diff --git a/WebCore/rendering/CounterNode.cpp b/WebCore/rendering/CounterNode.cpp
index c164c81..ac83d5a 100644
--- a/WebCore/rendering/CounterNode.cpp
+++ b/WebCore/rendering/CounterNode.cpp
@@ -41,6 +41,11 @@ CounterNode::CounterNode(RenderObject* o, bool hasResetType, int value)
{
}
+PassRefPtr<CounterNode> CounterNode::create(RenderObject* renderer, bool hasResetType, int value)
+{
+ return adoptRef(new CounterNode(renderer, hasResetType, value));
+}
+
CounterNode* CounterNode::nextInPreOrderAfterChildren(const CounterNode* stayWithin) const
{
if (this == stayWithin)
diff --git a/WebCore/rendering/CounterNode.h b/WebCore/rendering/CounterNode.h
index e35fb61..529d409 100644
--- a/WebCore/rendering/CounterNode.h
+++ b/WebCore/rendering/CounterNode.h
@@ -24,6 +24,7 @@
#include <wtf/Forward.h>
#include <wtf/Noncopyable.h>
+#include <wtf/RefCounted.h>
// This implements a counter tree that is used for finding parents in counters() lookup,
// and for propagating count changes when nodes are added or removed.
@@ -38,9 +39,9 @@ namespace WebCore {
class RenderObject;
-class CounterNode : public Noncopyable {
+class CounterNode : public RefCounted<CounterNode> {
public:
- CounterNode(RenderObject*, bool isReset, int value);
+ static PassRefPtr<CounterNode> create(RenderObject*, bool isReset, int value);
bool actsAsReset() const { return m_hasResetType || !m_parent; }
bool hasResetType() const { return m_hasResetType; }
@@ -64,6 +65,7 @@ public:
void removeChild(CounterNode*, const AtomicString& identifier);
private:
+ CounterNode(RenderObject*, bool isReset, int value);
int computeCountInParent() const;
void recount(const AtomicString& identifier);
diff --git a/WebCore/rendering/RenderCounter.cpp b/WebCore/rendering/RenderCounter.cpp
index 639221d..ba9c503 100644
--- a/WebCore/rendering/RenderCounter.cpp
+++ b/WebCore/rendering/RenderCounter.cpp
@@ -35,7 +35,7 @@ namespace WebCore {
using namespace HTMLNames;
-typedef HashMap<RefPtr<AtomicStringImpl>, CounterNode*> CounterMap;
+typedef HashMap<RefPtr<AtomicStringImpl>, RefPtr<CounterNode> > CounterMap;
typedef HashMap<const RenderObject*, CounterMap*> CounterMaps;
static CounterNode* makeCounterNode(RenderObject*, const AtomicString& identifier, bool alwaysCreateCounter);
@@ -235,10 +235,12 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
{
ASSERT(object);
- if (object->m_hasCounterNodeMap)
- if (CounterMap* nodeMap = counterMaps().get(object))
- if (CounterNode* node = nodeMap->get(identifier.impl()))
+ if (object->m_hasCounterNodeMap) {
+ if (CounterMap* nodeMap = counterMaps().get(object)) {
+ if (CounterNode* node = nodeMap->get(identifier.impl()).get())
return node;
+ }
+ }
bool isReset = false;
int value = 0;
@@ -247,9 +249,9 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
CounterNode* newParent = 0;
CounterNode* newPreviousSibling = 0;
- CounterNode* newNode = new CounterNode(object, isReset, value);
+ RefPtr<CounterNode> newNode = CounterNode::create(object, isReset, value);
if (findPlaceForCounter(object, identifier, isReset, newParent, newPreviousSibling))
- newParent->insertAfter(newNode, newPreviousSibling, identifier);
+ newParent->insertAfter(newNode.get(), newPreviousSibling, identifier);
CounterMap* nodeMap;
if (object->m_hasCounterNodeMap)
nodeMap = counterMaps().get(object);
@@ -260,7 +262,7 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
}
nodeMap->set(identifier.impl(), newNode);
if (newNode->parent() || !object->nextInPreOrder(object->parent()))
- return newNode;
+ return newNode.get();
// Checking if some nodes that were previously counter tree root nodes
// should become children of this node now.
CounterMaps& maps = counterMaps();
@@ -268,7 +270,7 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
for (RenderObject* currentRenderer = object->nextInPreOrder(stayWithin); currentRenderer; currentRenderer = currentRenderer->nextInPreOrder(stayWithin)) {
if (!currentRenderer->m_hasCounterNodeMap)
continue;
- CounterNode* currentCounter = maps.get(currentRenderer)->get(identifier.impl());
+ CounterNode* currentCounter = maps.get(currentRenderer)->get(identifier.impl()).get();
if (!currentCounter)
continue;
if (currentCounter->parent()) {
@@ -282,7 +284,7 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
if (currentRenderer->lastChild())
currentRenderer = currentRenderer->lastChild();
}
- return newNode;
+ return newNode.get();
}
RenderCounter::RenderCounter(Document* node, const CounterContent& counter)
@@ -345,9 +347,9 @@ void RenderCounter::invalidate(const AtomicString& identifier)
static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier, CounterNode* node)
{
CounterNode* previous;
- for (CounterNode* child = node->lastDescendant(); child && child != node; child = previous) {
+ for (RefPtr<CounterNode> child = node->lastDescendant(); child && child != node; child = previous) {
previous = child->previousInPreOrder();
- child->parent()->removeChild(child, identifier);
+ child->parent()->removeChild(child.get(), identifier);
ASSERT(counterMaps().get(child->renderer())->get(identifier.impl()) == child);
counterMaps().get(child->renderer())->remove(identifier.impl());
if (!child->renderer()->documentBeingDestroyed()) {
@@ -355,7 +357,6 @@ static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier,
if (children)
children->invalidateCounters(child->renderer(), identifier);
}
- delete child;
}
RenderObject* renderer = node->renderer();
if (!renderer->documentBeingDestroyed()) {
@@ -364,7 +365,6 @@ static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier,
}
if (CounterNode* parent = node->parent())
parent->removeChild(node, identifier);
- delete node;
}
void RenderCounter::destroyCounterNodes(RenderObject* renderer)
@@ -377,7 +377,7 @@ void RenderCounter::destroyCounterNodes(RenderObject* renderer)
CounterMap::const_iterator end = map->end();
for (CounterMap::const_iterator it = map->begin(); it != end; ++it) {
AtomicString identifier(it->first.get());
- destroyCounterNodeWithoutMapRemoval(identifier, it->second);
+ destroyCounterNodeWithoutMapRemoval(identifier, it->second.get());
}
maps.remove(mapsIterator);
delete map;
@@ -392,7 +392,7 @@ void RenderCounter::destroyCounterNode(RenderObject* renderer, const AtomicStrin
CounterMap::iterator mapIterator = map->find(identifier.impl());
if (mapIterator == map->end())
return;
- destroyCounterNodeWithoutMapRemoval(identifier, mapIterator->second);
+ destroyCounterNodeWithoutMapRemoval(identifier, mapIterator->second.get());
map->remove(mapIterator);
// We do not delete "map" here even if empty because we expect to reuse
// it soon. In order for a renderer to lose all its counters permanently,
@@ -422,21 +422,24 @@ static void updateCounters(RenderObject* renderer)
CounterMap* counterMap = counterMaps().get(renderer);
ASSERT(counterMap);
for (CounterDirectiveMap::const_iterator it = directiveMap->begin(); it != end; ++it) {
- CounterNode* node = counterMap->get(it->first.get());
+ RefPtr<CounterNode> node = counterMap->get(it->first.get());
if (!node) {
makeCounterNode(renderer, AtomicString(it->first.get()), false);
continue;
}
CounterNode* newParent = 0;
CounterNode* newPreviousSibling;
+
findPlaceForCounter(renderer, AtomicString(it->first.get()), node->hasResetType(), newParent, newPreviousSibling);
+ if (node != counterMap->get(it->first.get()))
+ continue;
CounterNode* parent = node->parent();
if (newParent == parent && newPreviousSibling == node->previousSibling())
continue;
if (parent)
- parent->removeChild(node, it->first.get());
+ parent->removeChild(node.get(), it->first.get());
if (newParent)
- newParent->insertAfter(node, newPreviousSibling, it->first.get());
+ newParent->insertAfter(node.get(), newPreviousSibling, it->first.get());
}
}
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list