RootInlineBox::m_lineBreakObj becomes invalid when a child renderer is removed and...
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 15 Jun 2015 23:56:48 +0000 (23:56 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 15 Jun 2015 23:56:48 +0000 (23:56 +0000)
commit5d8b3f205cd748f9e4dc814cc5a20dc5d436b74d
tree115df2c6770df2a68232d100b32491a48ece6e97
parent96a0cc85e50a40fd8bd8b4488fc7c0861350f106
RootInlineBox::m_lineBreakObj becomes invalid when a child renderer is removed and the line does not get marked dirty.
https://bugs.webkit.org/show_bug.cgi?id=145988
rdar://problem/20959137

Reviewed by David Hyatt.

This patch ensures that we find the right first inline box so that we can dirty the
the appropriate line boxes.
With marking the right line boxes dirty, now we can update RootInlineBox::m_lineBreakObj at the next layout.

Source/WebCore:

Test: fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html

* rendering/RenderInline.cpp:
(WebCore::RenderInline::culledInlineFirstLineBox):
(WebCore::RenderInline::culledInlineLastLineBox):
* rendering/RootInlineBox.cpp:
(WebCore::RootInlineBox::setLineBreakInfo): Deleted. Remove misleading assert and comment.

LayoutTests:

* fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt: Added.
* fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@185572 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean-expected.txt [new file with mode: 0644]
LayoutTests/fast/inline/crash-when-child-renderer-is-removed-and-line-stays-clean.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderInline.cpp
Source/WebCore/rendering/RootInlineBox.cpp