<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[164928] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/164928">164928</a></dd>
<dt>Author</dt> <dd>darin@apple.com</dd>
<dt>Date</dt> <dd>2014-03-01 15:22:56 -0800 (Sat, 01 Mar 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Improve "bad parent" and "bad child list" assertions in line boxes
https://bugs.webkit.org/show_bug.cgi?id=125656
Reviewed by Sam Weinig.
My previous fix for this problem was incomplete. This continuation of that fix addresses
the flaw in the original and adds additional lifetime checking so problems can be seen in
debug builds without a memory debugger.
* rendering/InlineBox.cpp:
(WebCore::InlineBox::assertNotDeleted): Added. Poor man's memory debugging helper.
(WebCore::InlineBox::~InlineBox): Refactored body into a new function named
invalidateParentChildList. Added code to update the deletion sentinel to record
that this object is deleted.
(WebCore::InlineBox::setHasBadParent): Moved here from header since this debug-only
feature does not need to be inlined. Added a call to assertNotDeleted.
(WebCore::InlineBox::invalidateParentChildList): Added. Refactored from the destructor,
this is used by RenderTextLineBoxes.
* rendering/InlineBox.h: Added the deletion sentinel, and called it in the parent
function. Also changed the expansion/setExpansion functions to use the type name "int",
since we don't use the type name "signed" in the WebKit coding style.
* rendering/InlineFlowBox.cpp:
(WebCore::InlineFlowBox::~InlineFlowBox): Call setHasBadChildList rather than doing the
setHasBadParent work on children directly, to avoid code duplication.
(WebCore::InlineFlowBox::setHasBadChildList): Moved here from header. Added code to set
"has bad parent" on all children, something we previously did only on destruction. Also
added assertNotDeleted.
(WebCore::InlineFlowBox::checkConsistency): Added call to assertNotDeleted. Also tweaked
code style and variable names a little bit.
* rendering/InlineFlowBox.h: Moved setHasBadChildList out of the header when it's on.
The empty version for ASSERT_WITH_SECURITY_IMPLICATION_DISABLED is still in the header.
* rendering/RenderTextLineBoxes.cpp:
(WebCore::RenderTextLineBoxes::invalidateParentChildLists): Call the new
InlineBox::invalidateParentChildList function instead of calling setHasBadChildList directly.
The new function checks m_hasBadParent, something we couldn't do here.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineBoxcpp">trunk/Source/WebCore/rendering/InlineBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineBoxh">trunk/Source/WebCore/rendering/InlineBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineFlowBoxcpp">trunk/Source/WebCore/rendering/InlineFlowBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingInlineFlowBoxh">trunk/Source/WebCore/rendering/InlineFlowBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderTextLineBoxescpp">trunk/Source/WebCore/rendering/RenderTextLineBoxes.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (164927 => 164928)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-03-01 23:05:02 UTC (rev 164927)
+++ trunk/Source/WebCore/ChangeLog 2014-03-01 23:22:56 UTC (rev 164928)
</span><span class="lines">@@ -1,3 +1,45 @@
</span><ins>+2014-03-01 Darin Adler <darin@apple.com>
+
+ Improve "bad parent" and "bad child list" assertions in line boxes
+ https://bugs.webkit.org/show_bug.cgi?id=125656
+
+ Reviewed by Sam Weinig.
+
+ My previous fix for this problem was incomplete. This continuation of that fix addresses
+ the flaw in the original and adds additional lifetime checking so problems can be seen in
+ debug builds without a memory debugger.
+
+ * rendering/InlineBox.cpp:
+ (WebCore::InlineBox::assertNotDeleted): Added. Poor man's memory debugging helper.
+ (WebCore::InlineBox::~InlineBox): Refactored body into a new function named
+ invalidateParentChildList. Added code to update the deletion sentinel to record
+ that this object is deleted.
+ (WebCore::InlineBox::setHasBadParent): Moved here from header since this debug-only
+ feature does not need to be inlined. Added a call to assertNotDeleted.
+ (WebCore::InlineBox::invalidateParentChildList): Added. Refactored from the destructor,
+ this is used by RenderTextLineBoxes.
+
+ * rendering/InlineBox.h: Added the deletion sentinel, and called it in the parent
+ function. Also changed the expansion/setExpansion functions to use the type name "int",
+ since we don't use the type name "signed" in the WebKit coding style.
+
+ * rendering/InlineFlowBox.cpp:
+ (WebCore::InlineFlowBox::~InlineFlowBox): Call setHasBadChildList rather than doing the
+ setHasBadParent work on children directly, to avoid code duplication.
+ (WebCore::InlineFlowBox::setHasBadChildList): Moved here from header. Added code to set
+ "has bad parent" on all children, something we previously did only on destruction. Also
+ added assertNotDeleted.
+ (WebCore::InlineFlowBox::checkConsistency): Added call to assertNotDeleted. Also tweaked
+ code style and variable names a little bit.
+
+ * rendering/InlineFlowBox.h: Moved setHasBadChildList out of the header when it's on.
+ The empty version for ASSERT_WITH_SECURITY_IMPLICATION_DISABLED is still in the header.
+
+ * rendering/RenderTextLineBoxes.cpp:
+ (WebCore::RenderTextLineBoxes::invalidateParentChildLists): Call the new
+ InlineBox::invalidateParentChildList function instead of calling setHasBadChildList directly.
+ The new function checks m_hasBadParent, something we couldn't do here.
+
</ins><span class="cx"> 2014-03-01 Benjamin Poulain <benjamin@webkit.org>
</span><span class="cx">
</span><span class="cx"> Optimized querySelector(All) when selector contains #id
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineBox.cpp (164927 => 164928)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineBox.cpp 2014-03-01 23:05:02 UTC (rev 164927)
+++ trunk/Source/WebCore/rendering/InlineBox.cpp 2014-03-01 23:22:56 UTC (rev 164928)
</span><span class="lines">@@ -43,6 +43,7 @@
</span><span class="cx"> float c;
</span><span class="cx"> uint32_t d : 32;
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><ins>+ unsigned s;
</ins><span class="cx"> bool f;
</span><span class="cx"> #endif
</span><span class="cx"> };
</span><span class="lines">@@ -50,11 +51,31 @@
</span><span class="cx"> COMPILE_ASSERT(sizeof(InlineBox) == sizeof(SameSizeAsInlineBox), InlineBox_size_guard);
</span><span class="cx">
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><ins>+
+void InlineBox::assertNotDeleted() const
+{
+ ASSERT(m_deletionSentinel == deletionSentinelNotDeletedValue);
+}
+
</ins><span class="cx"> InlineBox::~InlineBox()
</span><span class="cx"> {
</span><ins>+ invalidateParentChildList();
+ m_deletionSentinel = deletionSentinelDeletedValue;
+}
+
+void InlineBox::setHasBadParent()
+{
+ assertNotDeleted();
+ m_hasBadParent = true;
+}
+
+void InlineBox::invalidateParentChildList()
+{
+ assertNotDeleted();
</ins><span class="cx"> if (!m_hasBadParent && m_parent)
</span><span class="cx"> m_parent->setHasBadChildList();
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> void InlineBox::removeFromParent()
</span><span class="lines">@@ -64,6 +85,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #ifndef NDEBUG
</span><ins>+
</ins><span class="cx"> const char* InlineBox::boxName() const
</span><span class="cx"> {
</span><span class="cx"> return "InlineBox";
</span><span class="lines">@@ -101,6 +123,7 @@
</span><span class="cx"> fputc(' ', stderr);
</span><span class="cx"> fprintf(stderr, "\t%s %p\n", renderer().renderName(), &renderer());
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> float InlineBox::logicalHeight() const
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineBox.h (164927 => 164928)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineBox.h 2014-03-01 23:05:02 UTC (rev 164927)
+++ trunk/Source/WebCore/rendering/InlineBox.h 2014-03-01 23:22:56 UTC (rev 164928)
</span><span class="lines">@@ -37,6 +37,8 @@
</span><span class="cx"> public:
</span><span class="cx"> virtual ~InlineBox();
</span><span class="cx">
</span><ins>+ void assertNotDeleted() const;
+
</ins><span class="cx"> virtual void deleteLine() = 0;
</span><span class="cx"> virtual void extractLine() = 0;
</span><span class="cx"> virtual void attachLine() = 0;
</span><span class="lines">@@ -69,7 +71,6 @@
</span><span class="cx"> virtual void paint(PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom) = 0;
</span><span class="cx"> virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) = 0;
</span><span class="cx">
</span><del>-public:
</del><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> void showTreeForThis() const;
</span><span class="cx"> void showLineTreeForThis() const;
</span><span class="lines">@@ -148,6 +149,7 @@
</span><span class="cx">
</span><span class="cx"> InlineFlowBox* parent() const
</span><span class="cx"> {
</span><ins>+ assertNotDeleted();
</ins><span class="cx"> ASSERT_WITH_SECURITY_IMPLICATION(!m_hasBadParent);
</span><span class="cx"> return m_parent;
</span><span class="cx"> }
</span><span class="lines">@@ -237,6 +239,7 @@
</span><span class="cx">
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><span class="cx"> void setHasBadParent();
</span><ins>+ void invalidateParentChildList();
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> int expansion() const { return m_bitfields.expansion(); }
</span><span class="lines">@@ -368,6 +371,7 @@
</span><span class="cx"> , m_renderer(renderer)
</span><span class="cx"> , m_logicalWidth(0)
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><ins>+ , m_deletionSentinel(deletionSentinelNotDeletedValue)
</ins><span class="cx"> , m_hasBadParent(false)
</span><span class="cx"> #endif
</span><span class="cx"> {
</span><span class="lines">@@ -383,6 +387,7 @@
</span><span class="cx"> , m_logicalWidth(logicalWidth)
</span><span class="cx"> , m_bitfields(firstLine, constructed, dirty, extracted, isHorizontal)
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><ins>+ , m_deletionSentinel(deletionSentinelNotDeletedValue)
</ins><span class="cx"> , m_hasBadParent(false)
</span><span class="cx"> #endif
</span><span class="cx"> {
</span><span class="lines">@@ -401,14 +406,17 @@
</span><span class="cx"> void setHasHyphen(bool hasHyphen) { m_bitfields.setHasEllipsisBoxOrHyphen(hasHyphen); }
</span><span class="cx"> bool canHaveLeadingExpansion() const { return m_bitfields.hasSelectedChildrenOrCanHaveLeadingExpansion(); }
</span><span class="cx"> void setCanHaveLeadingExpansion(bool canHaveLeadingExpansion) { m_bitfields.setHasSelectedChildrenOrCanHaveLeadingExpansion(canHaveLeadingExpansion); }
</span><del>- signed expansion() { return m_bitfields.expansion(); }
- void setExpansion(signed expansion) { m_bitfields.setExpansion(expansion); }
</del><ins>+ int expansion() { return m_bitfields.expansion(); }
+ void setExpansion(int expansion) { m_bitfields.setExpansion(expansion); }
</ins><span class="cx">
</span><span class="cx"> // For InlineFlowBox and InlineTextBox
</span><span class="cx"> bool extracted() const { return m_bitfields.extracted(); }
</span><span class="cx">
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><span class="cx"> private:
</span><ins>+ static const unsigned deletionSentinelNotDeletedValue = 0xF0F0F0F0U;
+ static const unsigned deletionSentinelDeletedValue = 0xF0DEADF0U;
+ unsigned m_deletionSentinel;
</ins><span class="cx"> bool m_hasBadParent;
</span><span class="cx"> #endif
</span><span class="cx"> };
</span><span class="lines">@@ -417,16 +425,15 @@
</span><span class="cx"> TYPE_CASTS_BASE(ToValueTypeName, InlineBox, object, object->predicate, object.predicate)
</span><span class="cx">
</span><span class="cx"> #if ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><ins>+
</ins><span class="cx"> inline InlineBox::~InlineBox()
</span><span class="cx"> {
</span><span class="cx"> }
</span><del>-#endif
</del><span class="cx">
</span><del>-#if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
-inline void InlineBox::setHasBadParent()
</del><ins>+inline void InlineBox::assertNotDeleted() const
</ins><span class="cx"> {
</span><del>- m_hasBadParent = true;
</del><span class="cx"> }
</span><ins>+
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineFlowBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineFlowBox.cpp (164927 => 164928)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineFlowBox.cpp 2014-03-01 23:05:02 UTC (rev 164927)
+++ trunk/Source/WebCore/rendering/InlineFlowBox.cpp 2014-03-01 23:22:56 UTC (rev 164928)
</span><span class="lines">@@ -50,13 +50,22 @@
</span><span class="cx"> COMPILE_ASSERT(sizeof(InlineFlowBox) == sizeof(SameSizeAsInlineFlowBox), InlineFlowBox_should_stay_small);
</span><span class="cx">
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><ins>+
</ins><span class="cx"> InlineFlowBox::~InlineFlowBox()
</span><span class="cx"> {
</span><del>- if (!m_hasBadChildList) {
- for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
- child->setHasBadParent();
- }
</del><ins>+ setHasBadChildList();
</ins><span class="cx"> }
</span><ins>+
+void InlineFlowBox::setHasBadChildList()
+{
+ assertNotDeleted();
+ if (m_hasBadChildList)
+ return;
+ for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
+ child->setHasBadParent();
+ m_hasBadChildList = true;
+}
+
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> LayoutUnit InlineFlowBox::getFlowSpacingLogicalWidth()
</span><span class="lines">@@ -1664,15 +1673,16 @@
</span><span class="cx">
</span><span class="cx"> void InlineFlowBox::checkConsistency() const
</span><span class="cx"> {
</span><ins>+ assertNotDeleted();
</ins><span class="cx"> ASSERT_WITH_SECURITY_IMPLICATION(!m_hasBadChildList);
</span><span class="cx"> #ifdef CHECK_CONSISTENCY
</span><del>- const InlineBox* prev = 0;
- for (const InlineBox* child = m_firstChild; child; child = child->nextOnLine()) {
</del><ins>+ const InlineBox* previousChild = nullptr;
+ for (const InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
</ins><span class="cx"> ASSERT(child->parent() == this);
</span><del>- ASSERT(child->prevOnLine() == prev);
- prev = child;
</del><ins>+ ASSERT(child->prevOnLine() == previousChild);
+ previousChild = child;
</ins><span class="cx"> }
</span><del>- ASSERT(prev == m_lastChild);
</del><ins>+ ASSERT(previousChild == m_lastChild);
</ins><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingInlineFlowBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/InlineFlowBox.h (164927 => 164928)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/InlineFlowBox.h 2014-03-01 23:05:02 UTC (rev 164927)
+++ trunk/Source/WebCore/rendering/InlineFlowBox.h 2014-03-01 23:22:56 UTC (rev 164928)
</span><span class="lines">@@ -352,18 +352,21 @@
</span><span class="cx"> INLINE_BOX_OBJECT_TYPE_CASTS(InlineFlowBox, isInlineFlowBox())
</span><span class="cx">
</span><span class="cx"> #ifdef NDEBUG
</span><ins>+
</ins><span class="cx"> inline void InlineFlowBox::checkConsistency() const
</span><span class="cx"> {
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx"> #endif
</span><span class="cx">
</span><ins>+#if ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
+
</ins><span class="cx"> inline void InlineFlowBox::setHasBadChildList()
</span><span class="cx"> {
</span><del>-#if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
- m_hasBadChildList = true;
-#endif
</del><span class="cx"> }
</span><span class="cx">
</span><ins>+#endif
+
</ins><span class="cx"> } // namespace WebCore
</span><span class="cx">
</span><span class="cx"> #ifndef NDEBUG
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderTextLineBoxescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderTextLineBoxes.cpp (164927 => 164928)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderTextLineBoxes.cpp 2014-03-01 23:05:02 UTC (rev 164927)
+++ trunk/Source/WebCore/rendering/RenderTextLineBoxes.cpp 2014-03-01 23:22:56 UTC (rev 164928)
</span><span class="lines">@@ -697,10 +697,8 @@
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><span class="cx"> void RenderTextLineBoxes::invalidateParentChildLists()
</span><span class="cx"> {
</span><del>- for (auto box = m_first; box; box = box->nextTextBox()) {
- if (auto parent = box->parent())
- parent->setHasBadChildList();
- }
</del><ins>+ for (auto box = m_first; box; box = box->nextTextBox())
+ box->invalidateParentChildList();
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>