summaryrefslogtreecommitdiffstats
path: root/WebCore/rendering
diff options
context:
space:
mode:
Diffstat (limited to 'WebCore/rendering')
-rw-r--r--WebCore/rendering/RenderBlock.cpp16
-rw-r--r--WebCore/rendering/RenderBlock.h4
-rw-r--r--WebCore/rendering/RenderBox.cpp28
-rw-r--r--WebCore/rendering/RenderTable.cpp4
-rw-r--r--WebCore/rendering/RenderTextControlMultiLine.cpp2
5 files changed, 31 insertions, 23 deletions
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index 4609f1b..22e8afb 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -117,6 +117,7 @@ RenderBlock::RenderBlock(Node* node)
, m_continuation(0)
, m_rareData(0)
, m_lineHeight(-1)
+ , m_beingDestroyed(false)
{
setChildrenInline(true);
}
@@ -151,6 +152,9 @@ RenderBlock::~RenderBlock()
void RenderBlock::destroy()
{
+ // Mark as being destroyed to avoid trouble with merges in removeChild().
+ m_beingDestroyed = true;
+
// Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will
// properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise.
children()->destroyLeftoverChildren();
@@ -930,8 +934,8 @@ static bool canMergeContiguousAnonymousBlocks(RenderObject* oldChild, RenderObje
if (oldChild->documentBeingDestroyed() || oldChild->isInline() || oldChild->virtualContinuation())
return false;
- if ((prev && (!prev->isAnonymousBlock() || toRenderBlock(prev)->continuation()))
- || (next && (!next->isAnonymousBlock() || toRenderBlock(next)->continuation())))
+ if ((prev && (!prev->isAnonymousBlock() || toRenderBlock(prev)->continuation() || toRenderBlock(prev)->beingDestroyed()))
+ || (next && (!next->isAnonymousBlock() || toRenderBlock(next)->continuation() || toRenderBlock(next)->beingDestroyed())))
return false;
// FIXME: This check isn't required when inline run-ins can't be split into continuations.
@@ -1007,10 +1011,6 @@ void RenderBlock::removeChild(RenderObject* oldChild)
nextBlock->deleteLineBoxTree();
nextBlock->destroy();
next = 0;
-
- // FIXME: Revert the continuation change done above.
- if (oldChildBlock)
- oldChildBlock->setContinuation(0);
}
}
@@ -3033,7 +3033,7 @@ void RenderBlock::removeFloatingObject(RenderBox* o)
// Special-case zero- and less-than-zero-height floats: those don't touch
// the line that they're on, but it still needs to be dirtied. This is
// accomplished by pretending they have a height of 1.
- logicalBottom = max(logicalBottom, logicalTop + 1);
+ logicalBottom = max(logicalBottom, logicalTop == numeric_limits<int>::max() ? logicalTop : logicalTop + 1);
markLinesDirtyInBlockRange(0, logicalBottom);
}
m_floatingObjects->removeRef(it.current());
@@ -3807,7 +3807,7 @@ void RenderBlock::markLinesDirtyInBlockRange(int logicalTop, int logicalBottom,
RootInlineBox* lowestDirtyLine = lastRootBox();
RootInlineBox* afterLowest = lowestDirtyLine;
- while (lowestDirtyLine && lowestDirtyLine->blockLogicalHeight() >= logicalBottom) {
+ while (lowestDirtyLine && lowestDirtyLine->blockLogicalHeight() >= logicalBottom && logicalBottom < numeric_limits<int>::max()) {
afterLowest = lowestDirtyLine;
lowestDirtyLine = lowestDirtyLine->prevRootBox();
}
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index 5153218..cc06954 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -55,6 +55,7 @@ public:
RenderObjectChildList* children() { return &m_children; }
virtual void destroy();
+ bool beingDestroyed() const { return m_beingDestroyed; }
// These two functions are overridden for inline-block.
virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
@@ -717,7 +718,8 @@ private:
RenderObjectChildList m_children;
RenderLineBoxList m_lineBoxes; // All of the root line boxes created for this block flow. For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
- mutable int m_lineHeight;
+ mutable int m_lineHeight : 31;
+ bool m_beingDestroyed : 1;
// RenderRubyBase objects need to be able to split and merge, moving their children around
// (calling moveChildTo, moveAllChildrenTo, and makeChildrenNonInline).
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index ebd7d54..140d326 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -227,26 +227,30 @@ void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
return;
if (isFloating()) {
- RenderBlock* outermostBlock = containingBlock();
- for (RenderBlock* p = outermostBlock; p && !p->isRenderView(); p = p->containingBlock()) {
- if (p->containsFloat(this))
- outermostBlock = p;
+ RenderBlock* parentBlock = 0;
+ for (RenderObject* curr = parent(); curr && !curr->isRenderView(); curr = curr->parent()) {
+ if (curr->isRenderBlock()) {
+ RenderBlock* currBlock = toRenderBlock(curr);
+ if (currBlock->containsFloat(this))
+ parentBlock = currBlock;
+ else
+ break;
+ }
}
- if (outermostBlock) {
- RenderObject* parent = outermostBlock->parent();
+ if (parentBlock) {
+ RenderObject* parent = parentBlock->parent();
if (parent && parent->isFlexibleBox())
- outermostBlock = toRenderBlock(parent);
+ parentBlock = toRenderBlock(parent);
- outermostBlock->markAllDescendantsWithFloatsForLayout(this, false);
+ parentBlock->markAllDescendantsWithFloatsForLayout(this, false);
}
}
if (isPositioned()) {
- RenderObject* p;
- for (p = parent(); p; p = p->parent()) {
- if (p->isRenderBlock())
- toRenderBlock(p)->removePositionedObject(this);
+ for (RenderObject* curr = parent(); curr; curr = curr->parent()) {
+ if (curr->isRenderBlock())
+ toRenderBlock(curr)->removePositionedObject(this);
}
}
}
diff --git a/WebCore/rendering/RenderTable.cpp b/WebCore/rendering/RenderTable.cpp
index 43b6b03..521dea1 100644
--- a/WebCore/rendering/RenderTable.cpp
+++ b/WebCore/rendering/RenderTable.cpp
@@ -167,7 +167,7 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
if (!wrapInAnonymousSection) {
// If the next renderer is actually wrapped in an anonymous table section, we need to go up and find that.
- while (beforeChild && !beforeChild->isTableSection() && !beforeChild->isTableCol() && beforeChild->style()->display() != TABLE_CAPTION)
+ while (beforeChild && beforeChild->parent() != this)
beforeChild = beforeChild->parent();
RenderBox::addChild(child, beforeChild);
@@ -1172,6 +1172,8 @@ int RenderTable::firstLineBoxBaseline() const
if (isWritingModeRoot())
return -1;
+ recalcSectionsIfNeeded();
+
RenderTableSection* firstNonEmptySection = m_head ? m_head : (m_firstBody ? m_firstBody : m_foot);
if (firstNonEmptySection && !firstNonEmptySection->numRows())
firstNonEmptySection = sectionBelow(firstNonEmptySection, true);
diff --git a/WebCore/rendering/RenderTextControlMultiLine.cpp b/WebCore/rendering/RenderTextControlMultiLine.cpp
index eaa7eca..1a7ba36 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -41,7 +41,7 @@ RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placehol
RenderTextControlMultiLine::~RenderTextControlMultiLine()
{
- if (node())
+ if (node() && node()->inDocument())
static_cast<HTMLTextAreaElement*>(node())->rendererWillBeDestroyed();
}
generated by cgit v1.1 at 2025-05-12 19:18:19 +0000