REGRESSION (r182215): Reproducible crash at drawsvg.org due to reentrant layout
authordarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 15 Jun 2015 22:01:58 +0000 (22:01 +0000)
committerdarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 15 Jun 2015 22:01:58 +0000 (22:01 +0000)
commit2e8dd9cc2d7d4147035a19e5febdf3ee9a4a0e49
tree457ec758f9e87136c81844c7ddf8189f1cac1080
parentd102f4d86fbab9103f5ffbe1495f89e022bb291b
REGRESSION (r182215): Reproducible crash at drawsvg.org due to reentrant layout
https://bugs.webkit.org/show_bug.cgi?id=145964

Reviewed by Simon Fraser.

Source/WebCore:

Test: svg/as-object/mutate-on-load.html

* page/FrameView.cpp:
(WebCore::FrameView::forceLayoutParentViewIfNeeded): Don't do a synchronous layout here,
because it can lead indirectly to unwanted layout reentrancy. Instead schedule a layout.

LayoutTests:

* svg/as-object/mutate-on-load-expected.html: Added.
* svg/as-object/mutate-on-load.html: Added.
* svg/as-object/resources/embedded-mutates-on-load.svg: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@185567 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/svg/as-object/mutate-on-load-expected.html [new file with mode: 0644]
LayoutTests/svg/as-object/mutate-on-load.html [new file with mode: 0644]
LayoutTests/svg/as-object/resources/embedded-mutates-on-load.svg [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/page/FrameView.cpp