REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBloc...
authorantti@apple.com <antti@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Jul 2016 21:24:45 +0000 (21:24 +0000)
committerantti@apple.com <antti@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Jul 2016 21:24:45 +0000 (21:24 +0000)
commit41c8e48fe6d1ee2ef1adc39dd94a451deae5c7cf
tree5f562b1aea9a7b1b8d6e58372bb444a2f67b2c1b
parentbabab9c567dd515d562a5326b7edc9cbbc4fedd4
REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
https://bugs.webkit.org/show_bug.cgi?id=159519

Reviewed by Zalan Bujtas.

Source/WebCore:

Test: fast/inline/trailing-floats-inline-crash.html

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::checkFloatsInCleanLine):

    Use the existing deletionHasBegun bit in RenderStyle to assert against this reliably.

* rendering/RenderLineBoxList.cpp:
(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

    In some cases a special TrailingFloatsRootInlineBox may be added as the last root linebox of a flow.
    If it is combined with br the existing invalidation that invalidates the next and previous line may
    not be sufficient. Test for this case and invalidate the TrailingFloatsRootInlineBox too if it exists.

* rendering/RootInlineBox.h:
(WebCore::RootInlineBox::isTrailingFloatsRootInlineBox):
* rendering/TrailingFloatsRootInlineBox.h:
* rendering/style/RenderStyle.h:
(WebCore::RenderStyle::deletionHasBegun):

    Expose the bit in debug.

LayoutTests:

* fast/inline/trailing-floats-inline-crash-expected.txt: Added.
* fast/inline/trailing-floats-inline-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@202931 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/inline/trailing-floats-inline-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/inline/trailing-floats-inline-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlockLineLayout.cpp
Source/WebCore/rendering/RenderLineBoxList.cpp
Source/WebCore/rendering/RootInlineBox.h
Source/WebCore/rendering/TrailingFloatsRootInlineBox.h
Source/WebCore/rendering/style/RenderStyle.h