Fix for 3621138, crash on hrweb.apple.com. Make sure that in the case where objects...

	blocks that we just delete all line boxes.

        Reviewed by kocienda

        * khtml/rendering/render_block.cpp:
        (khtml::RenderBlock::removeChild):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@7006 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/WebCore/ChangeLog-2005-08-23 b/WebCore/ChangeLog-2005-08-23
index 31fc185ee794fbae1adf4f4c51f3545464947a6a..6d11da2d3754c6bd51bcc645e830c40cf62a502d 100644 (file)
--- a/WebCore/ChangeLog-2005-08-23
+++ b/WebCore/ChangeLog-2005-08-23
@@ -1,3 +1,13 @@
+2004-07-12  David Hyatt  <hyatt@apple.com>
+
+       Fix for 3621138, crash on hrweb.apple.com.  Make sure that in the case where objects get pulled up from merging
+       blocks that we just delete all line boxes.
+       
+        Reviewed by kocienda
+
+        * khtml/rendering/render_block.cpp:
+        (khtml::RenderBlock::removeChild):
+
 2004-07-10  Maciej Stachowiak  <mjs@apple.com>
 
         Reviewed by John.

diff --git a/WebCore/khtml/rendering/render_block.cpp b/WebCore/khtml/rendering/render_block.cpp
index a978411d19cd177e2a989da82975765697c0e599..2f89fe55a38d96c374e7a6cc7c86deebe7201e32 100644 (file)
--- a/WebCore/khtml/rendering/render_block.cpp
+++ b/WebCore/khtml/rendering/render_block.cpp
@@ -264,17 +264,6 @@ void RenderBlock::makeChildrenNonInline(RenderObject *insertionPoint)
     }
 }
 
-void RenderBlock::removeChildrenFromLineBoxes()
-{
-    // In the case where we do a collapse/merge from the destruction
-    // of a block in between two anonymous blocks with inlines (see removeChild in render_block.cpp),
-    // we have line boxes that need to have their parents nulled.
-    KHTMLAssert(!documentBeingDestroyed());
-    for (InlineFlowBox* box = m_firstLineBox; box; box = box->nextFlowBox())
-        for (InlineBox* child = box->firstChild(); child; child = child->nextOnLine())
-            child->remove();
-}
-
 void RenderBlock::removeChild(RenderObject *oldChild)
 {
     // If this child is a block, and if our previous and next siblings are
@@ -286,9 +275,6 @@ void RenderBlock::removeChild(RenderObject *oldChild)
     if (!documentBeingDestroyed() && !isInline() && !oldChild->isInline() && !oldChild->continuation() &&
         prev && prev->isAnonymousBlock() && prev->childrenInline() &&
         next && next->isAnonymousBlock() && next->childrenInline()) {
-        // Clean up the line box children inside |next|.
-        static_cast<RenderBlock*>(next)->removeChildrenFromLineBoxes();
-        
         // Take all the children out of the |next| block and put them in
         // the |prev| block.
         RenderObject* o = next->firstChild();
@@ -321,7 +307,8 @@ void RenderBlock::removeChild(RenderObject *oldChild)
             appendChildNode(anonBlock->removeChildNode(no));
             no->setNeedsLayoutAndMinMaxRecalc();
         }
-        
+        setNeedsLayoutAndMinMaxRecalc();
+
         // Nuke the now-empty block.
         anonBlock->detach();
     }

diff --git a/WebCore/khtml/rendering/render_block.h b/WebCore/khtml/rendering/render_block.h
index 9cb16eb9a17a77a857216e2ba4f2fdb58151e561..271d83d238c5b7c52414d87ec8a6ff078a5fd8c8 100644 (file)
--- a/WebCore/khtml/rendering/render_block.h
+++ b/WebCore/khtml/rendering/render_block.h
@@ -213,7 +213,6 @@ public:
 
 protected:
     void newLine();
-    void removeChildrenFromLineBoxes();
 
 private:
     DOM::Position positionForBox(InlineBox *box, bool start=true) const;