ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderE...
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 15 Jan 2016 21:49:33 +0000 (21:49 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 15 Jan 2016 21:49:33 +0000 (21:49 +0000)
https://bugs.webkit.org/show_bug.cgi?id=123331

Reviewed by Darin Adler.

Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).

Source/WebCore:

Test: fast/regions/input-box-with-region-assert.html

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::willBeDestroyed):
(WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
(WebCore::RenderBlockFlow::setRenderNamedFlowFragment):

LayoutTests:

* fast/regions/input-box-with-region-assert-expected.txt: Added.
* fast/regions/input-box-with-region-assert.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@195146 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/regions/input-box-with-region-assert-expected.txt [new file with mode: 0644]
LayoutTests/fast/regions/input-box-with-region-assert.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlockFlow.cpp

index 3c138b5..b1749c2 100644 (file)
@@ -1,3 +1,16 @@
+2016-01-15  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal
+        https://bugs.webkit.org/show_bug.cgi?id=123331
+
+        Reviewed by Darin Adler.
+
+        Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
+        could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).
+
+        * fast/regions/input-box-with-region-assert-expected.txt: Added.
+        * fast/regions/input-box-with-region-assert.html: Added.
+
 2016-01-15  Joseph Pecoraro  <pecoraro@apple.com>
 
         Web Inspector: Fix some typos in unit tests
diff --git a/LayoutTests/fast/regions/input-box-with-region-assert-expected.txt b/LayoutTests/fast/regions/input-box-with-region-assert-expected.txt
new file mode 100644 (file)
index 0000000..d177235
--- /dev/null
@@ -0,0 +1 @@
+Pass if no crash or assert in debug. 
diff --git a/LayoutTests/fast/regions/input-box-with-region-assert.html b/LayoutTests/fast/regions/input-box-with-region-assert.html
new file mode 100644 (file)
index 0000000..01c0f67
--- /dev/null
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that flow child can be added to an input element.</title>
+</head>
+<body>
+Pass if no crash or assert in debug.
+<input style="-webkit-flow-from: thread">
+</body>
+<script>
+    if (window.testRunner)
+      testRunner.dumpAsText();
+</script>
+</html>
\ No newline at end of file
index 86de3b0..87fe541 100644 (file)
@@ -1,3 +1,20 @@
+2016-01-15  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION FAILED: canHaveChildren() || canHaveGeneratedChildren() in WebCore::RenderElement::insertChildInternal
+        https://bugs.webkit.org/show_bug.cgi?id=123331
+
+        Reviewed by Darin Adler.
+
+        Do not set named flow fragment bit on the flow until after the renderer is attached. Setting/resetting it too early
+        could affect the attach/detach process itself (This is similar to attaching a multi column flow thread).
+
+        Test: fast/regions/input-box-with-region-assert.html
+
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::willBeDestroyed):
+        (WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):
+        (WebCore::RenderBlockFlow::setRenderNamedFlowFragment):
+
 2016-01-15  Simon Fraser  <simon.fraser@apple.com>
 
         Add kdebug_trace signposts for a few WebCore operations
index 03f756c..cdf85de 100644 (file)
@@ -144,7 +144,7 @@ void RenderBlockFlow::insertedIntoTree()
 void RenderBlockFlow::willBeDestroyed()
 {
     if (renderNamedFlowFragment())
-        setRenderNamedFlowFragment(0);
+        setRenderNamedFlowFragment(nullptr);
 
     // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
     // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
@@ -3151,8 +3151,8 @@ void RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded()
     if (style().isDisplayRegionType() && style().hasFlowFrom() && !style().specifiesColumns()) {
         RenderNamedFlowFragment* flowFragment = new RenderNamedFlowFragment(document(), RenderNamedFlowFragment::createStyle(style()));
         flowFragment->initializeStyle();
+        addChild(flowFragment);
         setRenderNamedFlowFragment(flowFragment);
-        addChild(renderNamedFlowFragment());
     }
 }
 
@@ -3198,8 +3198,8 @@ void RenderBlockFlow::updateLogicalHeight()
 void RenderBlockFlow::setRenderNamedFlowFragment(RenderNamedFlowFragment* flowFragment)
 {
     RenderBlockFlowRareData& rareData = ensureRareBlockFlowData();
-    if (rareData.m_renderNamedFlowFragment)
-        rareData.m_renderNamedFlowFragment->destroy();
+    if (auto* flowFragmentOnFlow = std::exchange(rareData.m_renderNamedFlowFragment, nullptr))
+        flowFragmentOnFlow->destroy();
     rareData.m_renderNamedFlowFragment = flowFragment;
 }