<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"

"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />

<title>[168067] trunk/Source/WebCore</title>

</head>

<body>

<style type="text/css"><!--

#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }

#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }

#msg dt:after { content:':';}

#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }

#msg dl a { font-weight: bold}

#msg dl a:link    { color:#fc3; }

#msg dl a:active  { color:#ff0; }

#msg dl a:visited { color:#cc6; }

h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }

#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }

#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }

#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }

#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }

#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }

#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }

#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }

#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }

#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }

#logmsg pre { background: #eee; padding: 1em; }

#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}

#logmsg dl { margin: 0; }

#logmsg dt { font-weight: bold; }

#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }

#logmsg dd:before { content:'\00bb';}

#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }

#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }

#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }

#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }

#logmsg table th.Corner { text-align: left; }

#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }

#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }

#patch { width: 100%; }

#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}

#patch .propset h4, #patch .binary h4 {margin:0;}

#patch pre {padding:0;line-height:1.2em;margin:0;}

#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}

#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}

#patch span {display:block;padding:0 10px;}

#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}

#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}

#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}

#patch .lines, .info {color:#888;background:#fff;}

--></style>

<div id="msg">

<dl class="meta">

<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/168067">168067</a></dd>

<dt>Author</dt> <dd>rego@igalia.com</dd>

<dt>Date</dt> <dd>2014-04-30 17:12:59 -0700 (Wed, 30 Apr 2014)</dd>

</dl>

<h3>Log Message</h3>

<pre>Unreviewed, rolling out <a href="http://trac.webkit.org/projects/webkit/changeset/167879">r167879</a> and <a href="http://trac.webkit.org/projects/webkit/changeset/167942">r167942</a>.

https://bugs.webkit.org/show_bug.cgi?id=132408

OrderIterator changes caused regressions in flexbox (Requested

by rego on #webkit).

We're keeping the new layout test introduced in <a href="http://trac.webkit.org/projects/webkit/changeset/167942">r167942</a>

(fast/flexbox/order-iterator-crash.html) to avoid similar

regressions in the future.

Reverted changesets:

&quot;OrderIterator refactoring to avoid extra loops&quot;

https://bugs.webkit.org/show_bug.cgi?id=119061

http://trac.webkit.org/changeset/167879

&quot;REGRESSION (<a href="http://trac.webkit.org/projects/webkit/changeset/167879">r167879</a>): Heap-use-after-free in

WebCore::RenderFlexibleBox&quot;

https://bugs.webkit.org/show_bug.cgi?id=132337

http://trac.webkit.org/changeset/167942</pre>

<h3>Modified Paths</h3>

<ul>

<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>

<li><a href="#trunkSourceWebCorerenderingOrderIteratorcpp">trunk/Source/WebCore/rendering/OrderIterator.cpp</a></li>

<li><a href="#trunkSourceWebCorerenderingOrderIteratorh">trunk/Source/WebCore/rendering/OrderIterator.h</a></li>

<li><a href="#trunkSourceWebCorerenderingRenderFlexibleBoxcpp">trunk/Source/WebCore/rendering/RenderFlexibleBox.cpp</a></li>

<li><a href="#trunkSourceWebCorerenderingRenderFlexibleBoxh">trunk/Source/WebCore/rendering/RenderFlexibleBox.h</a></li>

<li><a href="#trunkSourceWebCorerenderingRenderGridcpp">trunk/Source/WebCore/rendering/RenderGrid.cpp</a></li>

<li><a href="#trunkSourceWebCorerenderingRenderGridh">trunk/Source/WebCore/rendering/RenderGrid.h</a></li>

</ul>

</div>

<div id="patch">

<h3>Diff</h3>

<a id="trunkSourceWebCoreChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (168066 => 168067)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-05-01 00:08:51 UTC (rev 168066)

+++ trunk/Source/WebCore/ChangeLog        2014-05-01 00:12:59 UTC (rev 168067)

</span><span class="lines">@@ -1,3 +1,26 @@

</span><ins>+2014-04-30  Manuel Rego Casasnovas  &lt;rego@igalia.com&gt;

+

+        Unreviewed, rolling out r167879 and r167942.

+        https://bugs.webkit.org/show_bug.cgi?id=132408

+

+        OrderIterator changes caused regressions in flexbox (Requested

+        by rego on #webkit).

+

+        We're keeping the new layout test introduced in r167942

+        (fast/flexbox/order-iterator-crash.html) to avoid similar

+        regressions in the future.

+

+        Reverted changesets:

+

+        &quot;OrderIterator refactoring to avoid extra loops&quot;

+        https://bugs.webkit.org/show_bug.cgi?id=119061

+        http://trac.webkit.org/changeset/167879

+

+        &quot;REGRESSION (r167879): Heap-use-after-free in

+        WebCore::RenderFlexibleBox&quot;

+        https://bugs.webkit.org/show_bug.cgi?id=132337

+        http://trac.webkit.org/changeset/167942

+

</ins><span class="cx"> 2014-04-30  Enrica Casucci  &lt;enrica@apple.com&gt;

</span><span class="cx"> 

<span class="cx">         Cursor gets thinner on empty lines.

</span></span></pre></div>

<a id="trunkSourceWebCorerenderingOrderIteratorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/OrderIterator.cpp (168066 => 168067)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/rendering/OrderIterator.cpp        2014-05-01 00:08:51 UTC (rev 168066)

+++ trunk/Source/WebCore/rendering/OrderIterator.cpp        2014-05-01 00:12:59 UTC (rev 168067)

</span><span class="lines">@@ -32,56 +32,66 @@

</span><span class="cx"> #include &quot;config.h&quot;

</span><span class="cx"> #include &quot;OrderIterator.h&quot;

</span><span class="cx"> 

</span><del>-#include &quot;RenderBox.h&quot;

</del><ins>+#include &quot;RenderFlexibleBox.h&quot;

+#include &quot;RenderGrid.h&quot;

</ins><span class="cx"> 

</span><span class="cx"> namespace WebCore {

</span><span class="cx"> 

</span><del>-RenderBox* OrderIterator::currentChild() const

</del><ins>+static const int cInvalidIndex = -1;

+

+OrderIterator::OrderIterator(RenderBox&amp; containerBox)

+    : m_containerBox(containerBox)

</ins><span class="cx"> {

</span><del>-    if (m_childrenIndex == m_children.size())

-        return nullptr;

</del><ins>+    reset();

+}

</ins><span class="cx"> 

</span><del>-    return m_children[m_childrenIndex].first;

</del><ins>+void OrderIterator::setOrderValues(OrderValues&amp;&amp; orderValues)

+{

+    reset();

+    m_orderValues = std::move(orderValues);

+    if (m_orderValues.size() &lt; 2)

+        return;

+

+    std::sort(m_orderValues.begin(), m_orderValues.end());

+    auto nextElement = std::unique(m_orderValues.begin(), m_orderValues.end());

+    m_orderValues.shrinkCapacity(nextElement - m_orderValues.begin());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> RenderBox* OrderIterator::first()

</span><span class="cx"> {

</span><del>-    m_childrenIndex = 0;

-    return currentChild();

</del><ins>+    reset();

+    return next();

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> RenderBox* OrderIterator::next()

</span><span class="cx"> {

</span><del>-    ++m_childrenIndex;

-    return currentChild();

-}

</del><ins>+    int endIndex = m_orderValues.size();

+    do {

+        if (m_currentChild) {

+            m_currentChild = m_currentChild-&gt;nextSiblingBox();

+            continue;

+        }

</ins><span class="cx"> 

</span><del>-void OrderIterator::invalidate()

-{

-    m_children.clear();

-}

</del><ins>+        if (m_orderIndex == endIndex)

+            return nullptr;

</ins><span class="cx"> 

</span><del>-static bool compareByOrderValueAndIndex(std::pair&lt;RenderBox*, int&gt; childAndIndex1, std::pair&lt;RenderBox*, int&gt; childAndIndex2)

-{

-    if (childAndIndex1.first-&gt;style().order() != childAndIndex2.first-&gt;style().order())

-        return childAndIndex1.first-&gt;style().order() &lt; childAndIndex2.first-&gt;style().order();

-    return childAndIndex1.second &lt; childAndIndex2.second;

-}

</del><ins>+        if (m_orderIndex != cInvalidIndex) {

+            ++m_orderIndex;

+            if (m_orderIndex == endIndex)

+                return nullptr;

+        } else

+            m_orderIndex = 0;

</ins><span class="cx"> 

</span><del>-OrderIteratorPopulator::~OrderIteratorPopulator()

-{

-    if (!m_allChildrenHaveDefaultOrderValue)

-        std::sort(m_iterator.m_children.begin(), m_iterator.m_children.end(), compareByOrderValueAndIndex);

</del><ins>+        m_currentChild = m_containerBox.firstChildBox();

+    } while (!m_currentChild || m_currentChild-&gt;style().order() != m_orderValues[m_orderIndex]);

+

+    return m_currentChild;

</ins><span class="cx"> }

</span><span class="cx"> 

</span><del>-void OrderIteratorPopulator::collectChild(RenderBox&amp; child)

</del><ins>+void OrderIterator::reset()

</ins><span class="cx"> {

</span><del>-    std::pair&lt;RenderBox*, int&gt; childAndIndex = { &amp;child, m_childIndex++ };

-    m_iterator.m_children.append(childAndIndex);

-

-    if (m_allChildrenHaveDefaultOrderValue &amp;&amp; child.style().order())

-        m_allChildrenHaveDefaultOrderValue = false;

</del><ins>+    m_currentChild = nullptr;

+    m_orderIndex = cInvalidIndex;

</ins><span class="cx"> }

</span><span class="cx"> 

</span><del>-

</del><span class="cx"> } // namespace WebCore

</span></span></pre></div>

<a id="trunkSourceWebCorerenderingOrderIteratorh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/OrderIterator.h (168066 => 168067)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/rendering/OrderIterator.h        2014-05-01 00:08:51 UTC (rev 168066)

+++ trunk/Source/WebCore/rendering/OrderIterator.h        2014-05-01 00:12:59 UTC (rev 168067)

</span><span class="lines">@@ -41,41 +41,24 @@

</span><span class="cx"> 

</span><span class="cx"> class OrderIterator {

</span><span class="cx"> public:

</span><del>-    friend class OrderIteratorPopulator;

</del><ins>+    OrderIterator(RenderBox&amp;);

</ins><span class="cx"> 

</span><del>-    RenderBox* currentChild() const;

</del><ins>+    typedef Vector&lt;int, 1&gt; OrderValues;

+    void setOrderValues(OrderValues&amp;&amp;);

+

+    RenderBox* currentChild() const { return m_currentChild; }

</ins><span class="cx">     RenderBox* first();

</span><span class="cx">     RenderBox* next();

</span><span class="cx"> 

</span><del>-    void invalidate();

-

</del><span class="cx"> private:

</span><span class="cx">     void reset();

</span><span class="cx"> 

</span><del>-    Vector&lt;std::pair&lt;RenderBox*, int&gt;&gt; m_children;

-    size_t m_childrenIndex;

</del><ins>+    RenderBox&amp; m_containerBox;

+    RenderBox* m_currentChild;

+    OrderValues m_orderValues;

+    int m_orderIndex;

</ins><span class="cx"> };

</span><span class="cx"> 

</span><del>-class OrderIteratorPopulator {

-public:

-    OrderIteratorPopulator(OrderIterator&amp; iterator)

-        : m_iterator(iterator)

-        , m_childIndex(0)

-        , m_allChildrenHaveDefaultOrderValue(true)

-    {

-        m_iterator.invalidate();

-    }

-

-    ~OrderIteratorPopulator();

-

-    void collectChild(RenderBox&amp;);

-

-private:

-    OrderIterator&amp; m_iterator;

-    size_t m_childIndex;

-    bool m_allChildrenHaveDefaultOrderValue;

-};

-

</del><span class="cx"> } // namespace WebCore

</span><span class="cx"> 

</span><span class="cx"> #endif //  OrderIterator_h

</span></span></pre></div>

<a id="trunkSourceWebCorerenderingRenderFlexibleBoxcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlexibleBox.cpp (168066 => 168067)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/rendering/RenderFlexibleBox.cpp        2014-05-01 00:08:51 UTC (rev 168066)

+++ trunk/Source/WebCore/rendering/RenderFlexibleBox.cpp        2014-05-01 00:12:59 UTC (rev 168067)

</span><span class="lines">@@ -68,6 +68,7 @@

</span><span class="cx"> 

</span><span class="cx"> RenderFlexibleBox::RenderFlexibleBox(Element&amp; element, PassRef&lt;RenderStyle&gt; style)

</span><span class="cx">     : RenderBlock(element, std::move(style), 0)

</span><ins>+    , m_orderIterator(*this)

</ins><span class="cx">     , m_numberOfInFlowChildrenOnFirstLine(-1)

</span><span class="cx"> {

<span class="cx">     setChildrenInline(false); // All of our children must be block-level.

</span><span class="lines">@@ -75,6 +76,7 @@

</span><span class="cx"> 

</span><span class="cx"> RenderFlexibleBox::RenderFlexibleBox(Document&amp; document, PassRef&lt;RenderStyle&gt; style)

</span><span class="cx">     : RenderBlock(document, std::move(style), 0)

</span><ins>+    , m_orderIterator(*this)

</ins><span class="cx">     , m_numberOfInFlowChildrenOnFirstLine(-1)

</span><span class="cx"> {

<span class="cx">     setChildrenInline(false); // All of our children must be block-level.

</span><span class="lines">@@ -273,11 +275,13 @@

</span><span class="cx"> 

</span><span class="cx">     dirtyForLayoutFromPercentageHeightDescendants();

</span><span class="cx"> 

</span><del>-    prepareOrderIteratorAndMargins();

</del><ins>+    Vector&lt;LineContext&gt; lineContexts;

+    OrderIterator::OrderValues orderValues;

+    computeMainAxisPreferredSizes(orderValues);

+    m_orderIterator.setOrderValues(std::move(orderValues));

</ins><span class="cx"> 

</span><span class="cx">     ChildFrameRects oldChildRects;

</span><span class="cx">     appendChildFrameRects(oldChildRects);

</span><del>-    Vector&lt;LineContext&gt; lineContexts;

</del><span class="cx">     layoutFlexItems(relayoutChildren, lineContexts);

</span><span class="cx"> 

</span><span class="cx">     updateLogicalHeight();

</span><span class="lines">@@ -830,12 +834,16 @@

</span><span class="cx">     return minimumValueForLength(margin, availableSize);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-void RenderFlexibleBox::prepareOrderIteratorAndMargins()

</del><ins>+void RenderFlexibleBox::computeMainAxisPreferredSizes(OrderIterator::OrderValues&amp; orderValues)

</ins><span class="cx"> {

</span><del>-    OrderIteratorPopulator populator(m_orderIterator);

</del><ins>+    ASSERT(orderValues.isEmpty());

</ins><span class="cx"> 

</span><span class="cx">     for (RenderBox* child = firstChildBox(); child; child = child-&gt;nextSiblingBox()) {

</span><del>-        populator.collectChild(*child);

</del><ins>+        // Avoid growing the vector for the common-case default value of 0. This optimizes the most common case which is

+        // one or a few values with the default order 0

+        int order = child-&gt;style().order();

+        if (orderValues.isEmpty() || orderValues.last() != order)

+            orderValues.append(order);

</ins><span class="cx"> 

</span><span class="cx">         if (child-&gt;isOutOfFlowPositioned())

</span><span class="cx">             continue;

</span><span class="lines">@@ -1392,10 +1400,4 @@

</span><span class="cx">     return isHorizontalFlow();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-void RenderFlexibleBox::removeChild(RenderObject&amp; child)

-{

-    RenderBlock::removeChild(child);

-    m_orderIterator.invalidate();

</del><span class="cx"> }

</span><del>-

-}

</del></span></pre></div>

<a id="trunkSourceWebCorerenderingRenderFlexibleBoxh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlexibleBox.h (168066 => 168067)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/rendering/RenderFlexibleBox.h        2014-05-01 00:08:51 UTC (rev 168066)

+++ trunk/Source/WebCore/rendering/RenderFlexibleBox.h        2014-05-01 00:12:59 UTC (rev 168067)

</span><span class="lines">@@ -60,8 +60,6 @@

</span><span class="cx">     bool isTopLayoutOverflowAllowed() const override;

</span><span class="cx">     bool isLeftLayoutOverflowAllowed() const override;

</span><span class="cx"> 

</span><del>-    void removeChild(RenderObject&amp;) override;

-

</del><span class="cx"> protected:

</span><span class="cx">     virtual void computeIntrinsicLogicalWidths(LayoutUnit&amp; minLogicalWidth, LayoutUnit&amp; maxLogicalWidth) const override;

</span><span class="cx">     virtual void computePreferredLogicalWidths() override;

</span><span class="lines">@@ -139,7 +137,7 @@

</span><span class="cx">     LayoutUnit marginBoxAscentForChild(RenderBox&amp;);

</span><span class="cx"> 

</span><span class="cx">     LayoutUnit computeChildMarginValue(const Length&amp; margin);

</span><del>-    void prepareOrderIteratorAndMargins();

</del><ins>+    void computeMainAxisPreferredSizes(OrderIterator::OrderValues&amp;);

</ins><span class="cx">     LayoutUnit adjustChildSizeForMinAndMax(RenderBox&amp;, LayoutUnit childSize);

</span><span class="cx">     bool computeNextFlexLine(OrderedFlexItemList&amp; orderedChildren, LayoutUnit&amp; preferredMainAxisExtent, double&amp; totalFlexGrow, double&amp; totalWeightedFlexShrink, LayoutUnit&amp; minMaxAppliedMainAxisExtent, bool&amp; hasInfiniteLineLength);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorerenderingRenderGridcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderGrid.cpp (168066 => 168067)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/rendering/RenderGrid.cpp        2014-05-01 00:08:51 UTC (rev 168066)

+++ trunk/Source/WebCore/rendering/RenderGrid.cpp        2014-05-01 00:12:59 UTC (rev 168067)

</span><span class="lines">@@ -164,6 +164,7 @@

</span><span class="cx"> 

</span><span class="cx"> RenderGrid::RenderGrid(Element&amp; element, PassRef&lt;RenderStyle&gt; style)

</span><span class="cx">     : RenderBlock(element, std::move(style), 0)

</span><ins>+    , m_orderIterator(*this)

</ins><span class="cx"> {

<span class="cx">     // All of our children must be block level.

</span><span class="cx">     setChildrenInline(false);

</span><span class="lines">@@ -698,12 +699,17 @@

</span><span class="cx"> 

</span><span class="cx"> void RenderGrid::populateExplicitGridAndOrderIterator()

</span><span class="cx"> {

</span><del>-    OrderIteratorPopulator populator(m_orderIterator);

</del><ins>+    // FIXME: We should find a way to share OrderValues's initialization code with RenderFlexibleBox.

+    OrderIterator::OrderValues orderValues;

</ins><span class="cx">     size_t maximumRowIndex = std::max&lt;size_t&gt;(1, explicitGridRowCount());

</span><span class="cx">     size_t maximumColumnIndex = std::max&lt;size_t&gt;(1, explicitGridColumnCount());

</span><span class="cx"> 

</span><span class="cx">     for (RenderBox* child = firstChildBox(); child; child = child-&gt;nextSiblingBox()) {

</span><del>-        populator.collectChild(*child);

</del><ins>+        // Avoid growing the vector for the common-case default value of 0. This optimizes the most common case which is

+        // one or a few values with the default order 0

+        int order = child-&gt;style().order();

+        if (orderValues.isEmpty() || orderValues.last() != order)

+            orderValues.append(order);

</ins><span class="cx"> 

<span class="cx">         // This function bypasses the cache (cachedGridCoordinate()) as it is used to build it.

</span><span class="cx">         std::unique_ptr&lt;GridSpan&gt; rowPositions = resolveGridPositionsFromStyle(child, ForRows);

</span><span class="lines">@@ -720,6 +726,8 @@

</span><span class="cx">     m_grid.grow(maximumRowIndex);

</span><span class="cx">     for (size_t i = 0; i &lt; m_grid.size(); ++i)

</span><span class="cx">         m_grid[i].grow(maximumColumnIndex);

</span><ins>+

+    m_orderIterator.setOrderValues(std::move(orderValues));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void RenderGrid::placeSpecifiedMajorAxisItemsOnGrid(const Vector&lt;RenderBox*&gt;&amp; autoGridItems)

</span><span class="lines">@@ -1186,12 +1194,6 @@

</span><span class="cx">     return &quot;RenderGrid&quot;;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-void RenderGrid::removeChild(RenderObject&amp; child)

-{

-    RenderBlock::removeChild(child);

-    m_orderIterator.invalidate();

-}

-

</del><span class="cx"> } // namespace WebCore

</span><span class="cx"> 

</span><span class="cx"> #endif /* ENABLE(CSS_GRID_LAYOUT) */

</span></span></pre></div>

<a id="trunkSourceWebCorerenderingRenderGridh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderGrid.h (168066 => 168067)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/rendering/RenderGrid.h        2014-05-01 00:08:51 UTC (rev 168066)

+++ trunk/Source/WebCore/rendering/RenderGrid.h        2014-05-01 00:12:59 UTC (rev 168067)

</span><span class="lines">@@ -58,8 +58,6 @@

</span><span class="cx">     const Vector&lt;LayoutUnit&gt;&amp; columnPositions() const { return m_columnPositions; }

</span><span class="cx">     const Vector&lt;LayoutUnit&gt;&amp; rowPositions() const { return m_rowPositions; }

</span><span class="cx"> 

</span><del>-    void removeChild(RenderObject&amp;) override;

-

</del><span class="cx"> private:

</span><span class="cx">     virtual const char* renderName() const override;

</span><span class="cx">     virtual bool isRenderGrid() const override { return true; }

</span></span></pre>

</div>

</div>

</body>

</html>