2006-12-02 Mitz Pettel <mitz@webkit.org>
authorap <ap@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 2 Dec 2006 14:02:57 +0000 (14:02 +0000)
committerap <ap@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 2 Dec 2006 14:02:57 +0000 (14:02 +0000)
        Reviewed by Hyatt.

        - fix http://bugs.webkit.org/show_bug.cgi?id=11672
          REGRESSION (r17068): Repro crash due to painting without layout

        Test: fast/dynamic/containing-block-change.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::setStyle): Changed the logic used
        to find absolutely positioned descendant's current containing block to
        match the changes made to containingBlock() in the fix for bug 9347.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@17986 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/dynamic/containing-block-change-expected.checksum [new file with mode: 0644]
LayoutTests/fast/dynamic/containing-block-change-expected.png [new file with mode: 0644]
LayoutTests/fast/dynamic/containing-block-change-expected.txt [new file with mode: 0644]
LayoutTests/fast/dynamic/containing-block-change.html [new file with mode: 0644]
WebCore/ChangeLog
WebCore/rendering/RenderObject.cpp

index 9bfbbb46ead72d6c6f111dc8a262310207a127bb..841fa40ad2c411ce9d54674b8565c915765e2d9c 100644 (file)
@@ -1,3 +1,15 @@
+2006-12-02  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Hyatt.
+
+        - test for http://bugs.webkit.org/show_bug.cgi?id=11672
+          REGRESSION (r17068): Repro crash due to painting without layout
+
+        * fast/dynamic/containing-block-change-expected.checksum: Added.
+        * fast/dynamic/containing-block-change-expected.png: Added.
+        * fast/dynamic/containing-block-change-expected.txt: Added.
+        * fast/dynamic/containing-block-change.html: Added.
+
 2006-12-01  Justin Garcia  <justin.garcia@apple.com>
 
         Reviewed by john
diff --git a/LayoutTests/fast/dynamic/containing-block-change-expected.checksum b/LayoutTests/fast/dynamic/containing-block-change-expected.checksum
new file mode 100644 (file)
index 0000000..a91be28
--- /dev/null
@@ -0,0 +1 @@
+26d62cfb10f4b7f1d0b36712332cba30
\ No newline at end of file
diff --git a/LayoutTests/fast/dynamic/containing-block-change-expected.png b/LayoutTests/fast/dynamic/containing-block-change-expected.png
new file mode 100644 (file)
index 0000000..5167c6b
Binary files /dev/null and b/LayoutTests/fast/dynamic/containing-block-change-expected.png differ
diff --git a/LayoutTests/fast/dynamic/containing-block-change-expected.txt b/LayoutTests/fast/dynamic/containing-block-change-expected.txt
new file mode 100644 (file)
index 0000000..7fe7307
--- /dev/null
@@ -0,0 +1,27 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {P} at (0,0) size 784x36
+        RenderText {#text} at (0,0) size 172x18
+          text run at (0,0) width 172: "This is a regression test for "
+        RenderInline {I} at (0,0) size 763x36
+          RenderInline {A} at (0,0) size 301x18 [color=#0000EE]
+            RenderText {#text} at (172,0) size 301x18
+              text run at (172,0) width 301: "http://bugs.webkit.org/show_bug.cgi?id=11672"
+          RenderText {#text} at (473,0) size 763x36
+            text run at (473,0) width 4: " "
+            text run at (477,0) width 286: "REGRESSION (r17068): Repro crash due to"
+            text run at (0,18) width 146: "painting without layout"
+        RenderText {#text} at (146,18) size 128x18
+          text run at (146,18) width 128: ". It should not crash."
+layer at (8,60) size 6x6
+  RenderTable {TABLE} at (0,52) size 6x6
+    RenderTableSection {TBODY} at (0,0) size 6x6
+      RenderTableRow {TR} at (0,2) size 6x2
+        RenderTableCell {TD} at (2,2) size 2x2 [r=0 c=0 rs=1 cs=1]
+layer at (19,123) size 84x18
+  RenderBlock (positioned) {DIV} at (11,63) size 84x18
+    RenderText {#text} at (0,0) size 84x18
+      text run at (0,0) width 84: "Lorem ipsum"
diff --git a/LayoutTests/fast/dynamic/containing-block-change.html b/LayoutTests/fast/dynamic/containing-block-change.html
new file mode 100644 (file)
index 0000000..4265881
--- /dev/null
@@ -0,0 +1,30 @@
+<script>
+    function test()
+    {
+        document.body.offsetTop;    // force layout
+        if (window.layoutTestController)
+            layoutTestController.display();
+        var t = document.getElementById('t');
+        t.style.position = 'relative';
+        document.body.offsetTop;    // force layout
+        t.lastChild.removeChild(t.lastChild.lastChild);
+        if (window.layoutTestController)
+            layoutTestController.display();
+    }
+</script>
+<body onload="test()">
+    <p>
+        This is a regression test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=11672">http://bugs.webkit.org/show_bug.cgi?id=11672</a>
+        REGRESSION (r17068): Repro crash due to painting without layout</i>. It should not crash.
+    </p>
+    <table id = "t">
+        <tr>
+            <td>
+                <div style="position: absolute;">Lorem ipsum</div>
+            </td>
+        </tr>
+        <tr>
+            <td></td>
+        </tr>
+    </table>
+</body>
index 4e02e1b83371e541f4008d89ecada966a362b38e..b342c8e44c314ad8873a65c04b23e39ebd6771e5 100644 (file)
@@ -1,3 +1,17 @@
+2006-12-02  Mitz Pettel  <mitz@webkit.org>
+
+        Reviewed by Hyatt.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=11672
+          REGRESSION (r17068): Repro crash due to painting without layout
+
+        Test: fast/dynamic/containing-block-change.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle): Changed the logic used
+        to find absolutely positioned descendant's current containing block to
+        match the changes made to containingBlock() in the fix for bug 9347.
+
 2006-12-02  MorganL  <morganl.webkit@yahoo.com>
 
         Reviewed by Darin.
index 35cfb8a406f90c82ca4875e0d991348337193dfa..32cb0f9e49a5b4d92d3ba95aa222b04595f7974e 100644 (file)
@@ -2164,7 +2164,7 @@ void RenderObject::setStyle(RenderStyle* style)
                     // Remove our absolutely positioned descendants from their current containing block.
                     // They will be inserted into our positioned objects list during layout.
                     RenderObject* cb = parent();
-                    while (cb && (cb->style()->position() == StaticPosition || (cb->isInline() && !cb->isReplaced())) && !cb->isRoot() && !cb->isRenderView()) {
+                    while (cb && (cb->style()->position() == StaticPosition || (cb->isInline() && !cb->isReplaced())) && !cb->isRenderView()) {
                         if (cb->style()->position() == RelativePosition && cb->isInline() && !cb->isReplaced()) {
                             cb = cb->containingBlock();
                             break;