Improve "bad parent" and "bad child list" assertions in line boxes
authordarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 19 Dec 2013 17:40:53 +0000 (17:40 +0000)
committerdarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 19 Dec 2013 17:40:53 +0000 (17:40 +0000)
https://bugs.webkit.org/show_bug.cgi?id=125656

Reviewed by Sam Weinig.

* rendering/InlineBox.cpp:
(WebCore::InlineBox::root): Use parent() function with assertions rather than
using m_parent function, which skips the assertions.
* rendering/RenderText.cpp:
(WebCore::RenderText::removeAndDestroyTextBoxes): Call invalidateParentChildLists
if we are in the optimized document-destruction code path and destroying children
without removing them from their parents.
* rendering/RenderTextLineBoxes.cpp:
(WebCore::RenderTextLineBoxes::invalidateParentChildLists): Added.
* rendering/RenderTextLineBoxes.h: Added invalidateParentChildLists.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@160837 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog
Source/WebCore/rendering/InlineBox.cpp
Source/WebCore/rendering/RenderText.cpp
Source/WebCore/rendering/RenderTextLineBoxes.cpp
Source/WebCore/rendering/RenderTextLineBoxes.h

index 67320a0..5c53a36 100644 (file)
@@ -1,3 +1,21 @@
+2013-12-16  Darin Adler  <darin@apple.com>
+
+        Improve "bad parent" and "bad child list" assertions in line boxes
+        https://bugs.webkit.org/show_bug.cgi?id=125656
+
+        Reviewed by Sam Weinig.
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::root): Use parent() function with assertions rather than
+        using m_parent function, which skips the assertions.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::removeAndDestroyTextBoxes): Call invalidateParentChildLists
+        if we are in the optimized document-destruction code path and destroying children
+        without removing them from their parents.
+        * rendering/RenderTextLineBoxes.cpp:
+        (WebCore::RenderTextLineBoxes::invalidateParentChildLists): Added.
+        * rendering/RenderTextLineBoxes.h: Added invalidateParentChildLists.
+
 2013-12-19  Dan Bernstein  <mitz@apple.com>
 
         <rdar://problem/15696824> [CFNetwork] Loading stops at server redirects
index cbde55b..eb2b90e 100644 (file)
@@ -164,16 +164,16 @@ void InlineBox::adjustPosition(float dx, float dy)
 
 const RootInlineBox& InlineBox::root() const
 { 
-    if (m_parent)
-        return m_parent->root(); 
+    if (parent())
+        return parent()->root();
     ASSERT_WITH_SECURITY_IMPLICATION(isRootInlineBox());
     return toRootInlineBox(*this);
 }
 
 RootInlineBox& InlineBox::root()
 { 
-    if (m_parent)
-        return m_parent->root(); 
+    if (parent())
+        return parent()->root();
     ASSERT_WITH_SECURITY_IMPLICATION(isRootInlineBox());
     return toRootInlineBox(*this);
 }
index 66c315b..87ee08a 100644 (file)
@@ -267,6 +267,10 @@ void RenderText::removeAndDestroyTextBoxes()
 {
     if (!documentBeingDestroyed())
         m_lineBoxes.removeAllFromParent(*this);
+#if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
+    else
+        m_lineBoxes.invalidateParentChildLists();
+#endif
     m_lineBoxes.deleteAll();
 }
 
index 968a082..4ad4c15 100644 (file)
@@ -694,4 +694,14 @@ RenderTextLineBoxes::~RenderTextLineBoxes()
 }
 #endif
 
+#if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
+void RenderTextLineBoxes::invalidateParentChildLists()
+{
+    for (auto box = m_first; box; box = box->nextTextBox()) {
+        if (auto parent = box->parent())
+            parent->setHasBadChildList();
+    }
+}
+#endif
+
 }
index 62c75ec..d0b570f 100644 (file)
@@ -82,6 +82,10 @@ public:
     ~RenderTextLineBoxes();
 #endif
 
+#if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
+    void invalidateParentChildLists();
+#endif
+
 private:
     void checkConsistency() const;