WebCore:
authormitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 24 Oct 2008 19:10:51 +0000 (19:10 +0000)
committermitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 24 Oct 2008 19:10:51 +0000 (19:10 +0000)
        Reviewed by Sam Weinig.

        - fix https://bugs.webkit.org/show_bug.cgi?id=21851
          <rdar://problem/6304151> REGRESSION (r36513): Crash when removing a widget with percent height

        Test: fast/replaced/percent-height-in-anonymous-block-widget.html

        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::destroy): Copied code added to
        RenderBox::destroy() in r36513 into this function.

LayoutTests:

        Reviewed by Sam Weinig.

        - test for https://bugs.webkit.org/show_bug.cgi?id=21851
          <rdar://problem/6304151> REGRESSION (r36513): Crash when removing a widget with percent height

        * fast/replaced/percent-height-in-anonymous-block-widget.html: Added.
        * platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.checksum: Added.
        * platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.png: Added.
        * platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@37849 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/replaced/percent-height-in-anonymous-block-widget.html [new file with mode: 0644]
LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.checksum [new file with mode: 0644]
LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.png [new file with mode: 0644]
LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.txt [new file with mode: 0644]
WebCore/ChangeLog
WebCore/rendering/RenderWidget.cpp

index 7eef892..30a473b 100644 (file)
@@ -1,3 +1,15 @@
+2008-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - test for https://bugs.webkit.org/show_bug.cgi?id=21851
+          <rdar://problem/6304151> REGRESSION (r36513): Crash when removing a widget with percent height
+
+        * fast/replaced/percent-height-in-anonymous-block-widget.html: Added.
+        * platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.checksum: Added.
+        * platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.png: Added.
+        * platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.txt: Added.
+
 2008-10-24  David Kilzer  <ddkilzer@apple.com>
 
         Rolled out r37840.
diff --git a/LayoutTests/fast/replaced/percent-height-in-anonymous-block-widget.html b/LayoutTests/fast/replaced/percent-height-in-anonymous-block-widget.html
new file mode 100644 (file)
index 0000000..3510e56
--- /dev/null
@@ -0,0 +1,16 @@
+<body>
+    <p>
+        This tests for a crash when removing a widget whose height is specified
+        as a percentage of a non-immediate ancestor&rsquo;s height.
+    </p>
+    <div style="height: 50px; background: blue; width: 100px;" id="target">
+        <div></div>
+        <embed id="object" style="height: 100%;">
+    </div>
+</body>
+<script>
+    document.body.offsetLeft;
+    var object = document.getElementById("object");
+    var parent = object.parentNode;
+    parent.removeChild(object);
+</script>
diff --git a/LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.checksum b/LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.checksum
new file mode 100644 (file)
index 0000000..4480a6d
--- /dev/null
@@ -0,0 +1 @@
+cd8835912a29f602bb67a8d75e33962f
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.png b/LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.png
new file mode 100644 (file)
index 0000000..6c93b59
Binary files /dev/null and b/LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.png differ
diff --git a/LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.txt b/LayoutTests/platform/mac/fast/replaced/percent-height-in-anonymous-block-widget-expected.txt
new file mode 100644 (file)
index 0000000..b9921dc
--- /dev/null
@@ -0,0 +1,14 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x36
+        RenderText {#text} at (0,0) size 745x36
+          text run at (0,0) width 456: "This tests for a crash when removing a widget whose height is specified "
+          text run at (456,0) width 289: "as a percentage of a non-immediate ancestor\x{2019}s"
+          text run at (0,18) width 43: "height."
+      RenderBlock {DIV} at (0,52) size 100x50 [bgcolor=#0000FF]
+        RenderBlock {DIV} at (0,0) size 100x0
+        RenderBlock (anonymous) at (0,0) size 100x0
+          RenderText {#text} at (0,0) size 0x0
index 5daffcb..5081f41 100644 (file)
@@ -1,3 +1,16 @@
+2008-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21851
+          <rdar://problem/6304151> REGRESSION (r36513): Crash when removing a widget with percent height
+
+        Test: fast/replaced/percent-height-in-anonymous-block-widget.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Copied code added to
+        RenderBox::destroy() in r36513 into this function.
+
 2008-10-24  Timothy Hatcher  <timothy@apple.com>
 
         Add a mechanism to ask the InspectorClient for key/value setting pairs.
index 6ba0f84..8243995 100644 (file)
@@ -99,6 +99,9 @@ void RenderWidget::destroy()
     if (layer)
         layer->clearClipRect();
 
+    if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
+        RenderBlock::removePercentHeightDescendant(this);
+
     setNode(0);
     deref(arena);