[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-10851-g50815da

Wed Dec 22 18:41:31 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit 702cd3daa0f82bcd14ac6d1d934cc5b03fc6d373
Author: commit-queue at webkit.org <commit-queue at webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Wed Dec 15 23:06:43 2010 +0000

    2010-12-15  Yong Li  <yoli at rim.com>
    
            Reviewed by Darin Adler.
    
            Reproduce stack overflow when there are too many sibling inline boxes.
            https://bugs.webkit.org/show_bug.cgi?id=48255
    
            * fast/overflow/lots-of-sibling-inline-boxes.html: Added.
    2010-12-15  Yong Li  <yoli at rim.com>
    
            Reviewed by Darin Adler.
    
            Fix stack overflow when there are too many sibling inline boxes by using
            a loop to traverse children instead of calling each sibling from the first child.
            https://bugs.webkit.org/show_bug.cgi?id=48255
    
            Test: fast/overflow/lots-of-sibling-inline-boxes.html
    
            * rendering/InlineBox.h:
            (WebCore::InlineBox::setConstructed):
            (WebCore::InlineBox::next):
            * rendering/InlineFlowBox.h:
            (WebCore::InlineFlowBox::setConstructed):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74145 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index ce50601..4f6e003 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,12 @@
+2010-12-15  Yong Li  <yoli at rim.com>
+
+        Reviewed by Darin Adler.
+
+        Reproduce stack overflow when there are too many sibling inline boxes.
+        https://bugs.webkit.org/show_bug.cgi?id=48255
+
+        * fast/overflow/lots-of-sibling-inline-boxes.html: Added.
+
 2010-12-15  Jian Li  <jianli at chromium.org>
 
         Unreviewed. Updated chromium test_expectations to skip a test that
diff --git a/LayoutTests/accessibility/document-attributes-expected.txt b/LayoutTests/fast/overflow/lots-of-sibling-inline-boxes-expected.txt
similarity index 100%
copy from LayoutTests/accessibility/document-attributes-expected.txt
copy to LayoutTests/fast/overflow/lots-of-sibling-inline-boxes-expected.txt
diff --git a/LayoutTests/fast/overflow/lots-of-sibling-inline-boxes.html b/LayoutTests/fast/overflow/lots-of-sibling-inline-boxes.html
new file mode 100644
index 0000000..72aa449
--- /dev/null
+++ b/LayoutTests/fast/overflow/lots-of-sibling-inline-boxes.html
@@ -0,0 +1,11 @@
+<body>
+<script>
+    for (var i = 0; i < 130000; ++i)
+        document.write("<a>1</a>");
+
+    document.body.innerHTML = "<html><body>Passed</body></html>";
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</body>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index b645203..c34e123 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2010-12-15  Yong Li  <yoli at rim.com>
+
+        Reviewed by Darin Adler.
+
+        Fix stack overflow when there are too many sibling inline boxes by using
+        a loop to traverse children instead of calling each sibling from the first child.
+        https://bugs.webkit.org/show_bug.cgi?id=48255
+
+        Test: fast/overflow/lots-of-sibling-inline-boxes.html
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::setConstructed):
+        (WebCore::InlineBox::next):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::setConstructed):
+
 2010-12-15  Sam Weinig  <sam at webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/WebCore/rendering/InlineBox.h b/WebCore/rendering/InlineBox.h
index e50a24c..5b3f682 100644
--- a/WebCore/rendering/InlineBox.h
+++ b/WebCore/rendering/InlineBox.h
@@ -131,6 +131,8 @@ public:
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
 
+    InlineBox* next() const { return m_next; }
+
     // Overloaded new operator.
     void* operator new(size_t, RenderArena*) throw();
 
@@ -176,12 +178,7 @@ public:
     }
 
     bool isConstructed() { return m_constructed; }
-    virtual void setConstructed()
-    {
-        m_constructed = true;
-        if (m_next)
-            m_next->setConstructed();
-    }
+    virtual void setConstructed() { m_constructed = true; }
 
     void setExtracted(bool b = true) { m_extracted = b; }
     
diff --git a/WebCore/rendering/InlineFlowBox.h b/WebCore/rendering/InlineFlowBox.h
index b92a829..19f9d16 100644
--- a/WebCore/rendering/InlineFlowBox.h
+++ b/WebCore/rendering/InlineFlowBox.h
@@ -76,8 +76,8 @@ public:
     virtual void setConstructed()
     {
         InlineBox::setConstructed();
-        if (firstChild())
-            firstChild()->setConstructed();
+        for (InlineBox* child = firstChild(); child; child = child->next())
+            child->setConstructed();
     }
 
     void addToLine(InlineBox* child);

-- 
WebKit Debian packaging

