<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[208597] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/208597">208597</a></dd>
<dt>Author</dt> <dd>zalan@apple.com</dd>
<dt>Date</dt> <dd>2016-11-11 10:56:54 -0800 (Fri, 11 Nov 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>RenderFlowThread::removeLineRegionInfo shouldn't call HashMap::contains before HashMap::remove
https://bugs.webkit.org/show_bug.cgi?id=164639

Reviewed by Simon Fraser.

Also instead of asserting that the incoming renderer is not nullptr, we could just pass a reference in.

No change in functionality.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::invalidateFlowThreadContainingBlockIncludingDescendants):
(WebCore::canComputeRegionRangeForBox):
(WebCore::RenderBlock::computeRegionRangeForBoxChild):
(WebCore::RenderBlock::estimateRegionRangeForBoxChild):
(WebCore::RenderBlock::updateRegionRangeForBoxChild):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::hasRegionRangeInFlowThread):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::removeFromRenderFlowThreadIncludingDescendants):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::removeFlowChildInfo):
(WebCore::RenderFlowThread::validateRegions):
(WebCore::RenderFlowThread::removeRenderBoxRegionInfo):
(WebCore::RenderFlowThread::removeLineRegionInfo):
(WebCore::RenderFlowThread::clearRenderBoxRegionInfoAndCustomStyle):
(WebCore::RenderFlowThread::setRegionRangeForBox):
(WebCore::RenderFlowThread::hasCachedRegionRangeForBox):
(WebCore::RenderFlowThread::computedRegionRangeForBox):
(WebCore::RenderFlowThread::checkLinesConsistency):
* rendering/RenderFlowThread.h:
* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::setRegionRangeForBox):
* rendering/RenderMultiColumnFlowThread.h:
* rendering/RenderNamedFlowFragment.cpp:
(WebCore::RenderNamedFlowFragment::clearObjectStyleInRegion):
* rendering/RenderNamedFlowFragment.h:
* rendering/RenderNamedFlowThread.cpp:
(WebCore::RenderNamedFlowThread::clearRenderObjectCustomStyle):
(WebCore::RenderNamedFlowThread::removeFlowChildInfo):
* rendering/RenderNamedFlowThread.h:
* rendering/RenderRegion.cpp:
(WebCore::RenderRegion::removeRenderBoxRegionInfo):
* rendering/RenderRegion.h:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockcpp">trunk/Source/WebCore/rendering/RenderBlock.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxcpp">trunk/Source/WebCore/rendering/RenderBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderElementcpp">trunk/Source/WebCore/rendering/RenderElement.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadcpp">trunk/Source/WebCore/rendering/RenderFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadh">trunk/Source/WebCore/rendering/RenderFlowThread.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnFlowThreadcpp">trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnFlowThreadh">trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderNamedFlowFragmentcpp">trunk/Source/WebCore/rendering/RenderNamedFlowFragment.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderNamedFlowFragmenth">trunk/Source/WebCore/rendering/RenderNamedFlowFragment.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderNamedFlowThreadcpp">trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderNamedFlowThreadh">trunk/Source/WebCore/rendering/RenderNamedFlowThread.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderRegioncpp">trunk/Source/WebCore/rendering/RenderRegion.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderRegionh">trunk/Source/WebCore/rendering/RenderRegion.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/ChangeLog        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -1,3 +1,49 @@
</span><ins>+2016-11-11  Zalan Bujtas  &lt;zalan@apple.com&gt;
+
+        RenderFlowThread::removeLineRegionInfo shouldn't call HashMap::contains before HashMap::remove
+        https://bugs.webkit.org/show_bug.cgi?id=164639
+
+        Reviewed by Simon Fraser.
+
+        Also instead of asserting that the incoming renderer is not nullptr, we could just pass a reference in. 
+
+        No change in functionality.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::invalidateFlowThreadContainingBlockIncludingDescendants):
+        (WebCore::canComputeRegionRangeForBox):
+        (WebCore::RenderBlock::computeRegionRangeForBoxChild):
+        (WebCore::RenderBlock::estimateRegionRangeForBoxChild):
+        (WebCore::RenderBlock::updateRegionRangeForBoxChild):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::hasRegionRangeInFlowThread):
+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::removeFromRenderFlowThreadIncludingDescendants):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::removeFlowChildInfo):
+        (WebCore::RenderFlowThread::validateRegions):
+        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo):
+        (WebCore::RenderFlowThread::removeLineRegionInfo):
+        (WebCore::RenderFlowThread::clearRenderBoxRegionInfoAndCustomStyle):
+        (WebCore::RenderFlowThread::setRegionRangeForBox):
+        (WebCore::RenderFlowThread::hasCachedRegionRangeForBox):
+        (WebCore::RenderFlowThread::computedRegionRangeForBox):
+        (WebCore::RenderFlowThread::checkLinesConsistency):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::RenderMultiColumnFlowThread::setRegionRangeForBox):
+        * rendering/RenderMultiColumnFlowThread.h:
+        * rendering/RenderNamedFlowFragment.cpp:
+        (WebCore::RenderNamedFlowFragment::clearObjectStyleInRegion):
+        * rendering/RenderNamedFlowFragment.h:
+        * rendering/RenderNamedFlowThread.cpp:
+        (WebCore::RenderNamedFlowThread::clearRenderObjectCustomStyle):
+        (WebCore::RenderNamedFlowThread::removeFlowChildInfo):
+        * rendering/RenderNamedFlowThread.h:
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::removeRenderBoxRegionInfo):
+        * rendering/RenderRegion.h:
+
</ins><span class="cx"> 2016-11-11  Megan Gardner  &lt;megan_gardner@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [Cocoa] Support wide gamut for Drag Image UI
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlock.cpp        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -3394,11 +3394,11 @@
</span><span class="cx">     setCachedFlowThreadContainingBlockNeedsUpdate();
</span><span class="cx"> 
</span><span class="cx">     if (flowThread)
</span><del>-        flowThread-&gt;removeFlowChildInfo(this);
</del><ins>+        flowThread-&gt;removeFlowChildInfo(*this);
</ins><span class="cx"> 
</span><span class="cx">     for (auto&amp; child : childrenOfType&lt;RenderElement&gt;(*this)) {
</span><span class="cx">         if (flowThread)
</span><del>-            flowThread-&gt;removeFlowChildInfo(&amp;child);
</del><ins>+            flowThread-&gt;removeFlowChildInfo(child);
</ins><span class="cx">         if (is&lt;RenderBlock&gt;(child))
</span><span class="cx">             downcast&lt;RenderBlock&gt;(child).invalidateFlowThreadContainingBlockIncludingDescendants();
</span><span class="cx">     }
</span><span class="lines">@@ -3621,9 +3621,8 @@
</span><span class="cx">     return flowThread-&gt;regionAtBlockOffset(this, offsetFromLogicalTopOfFirstPage() + blockOffset, true);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static bool canComputeRegionRangeForBox(const RenderBlock* parentBlock, const RenderBox&amp; childBox, const RenderFlowThread* flowThreadContainingBlock)
</del><ins>+static bool canComputeRegionRangeForBox(const RenderBlock&amp; parentBlock, const RenderBox&amp; childBox, const RenderFlowThread* flowThreadContainingBlock)
</ins><span class="cx"> {
</span><del>-    ASSERT(parentBlock);
</del><span class="cx">     ASSERT(!childBox.isRenderNamedFlowThread());
</span><span class="cx"> 
</span><span class="cx">     if (!flowThreadContainingBlock)
</span><span class="lines">@@ -3653,7 +3652,7 @@
</span><span class="cx"> void RenderBlock::computeRegionRangeForBoxChild(const RenderBox&amp; box) const
</span><span class="cx"> {
</span><span class="cx">     RenderFlowThread* flowThread = flowThreadContainingBlock();
</span><del>-    ASSERT(canComputeRegionRangeForBox(this, box, flowThread));
</del><ins>+    ASSERT(canComputeRegionRangeForBox(*this, box, flowThread));
</ins><span class="cx"> 
</span><span class="cx">     RenderRegion* startRegion;
</span><span class="cx">     RenderRegion* endRegion;
</span><span class="lines">@@ -3665,13 +3664,13 @@
</span><span class="cx">         endRegion = flowThread-&gt;regionAtBlockOffset(this, offsetFromLogicalTopOfFirstRegion + logicalHeightForChild(box), true);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    flowThread-&gt;setRegionRangeForBox(&amp;box, startRegion, endRegion);
</del><ins>+    flowThread-&gt;setRegionRangeForBox(box, startRegion, endRegion);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderBlock::estimateRegionRangeForBoxChild(const RenderBox&amp; box) const
</span><span class="cx"> {
</span><span class="cx">     RenderFlowThread* flowThread = flowThreadContainingBlock();
</span><del>-    if (!canComputeRegionRangeForBox(this, box, flowThread))
</del><ins>+    if (!canComputeRegionRangeForBox(*this, box, flowThread))
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     if (childBoxIsUnsplittableForFragmentation(box)) {
</span><span class="lines">@@ -3686,13 +3685,13 @@
</span><span class="cx">     RenderRegion* startRegion = flowThread-&gt;regionAtBlockOffset(this, offsetFromLogicalTopOfFirstRegion, true);
</span><span class="cx">     RenderRegion* endRegion = flowThread-&gt;regionAtBlockOffset(this, offsetFromLogicalTopOfFirstRegion + estimatedValues.m_extent, true);
</span><span class="cx"> 
</span><del>-    flowThread-&gt;setRegionRangeForBox(&amp;box, startRegion, endRegion);
</del><ins>+    flowThread-&gt;setRegionRangeForBox(box, startRegion, endRegion);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool RenderBlock::updateRegionRangeForBoxChild(const RenderBox&amp; box) const
</span><span class="cx"> {
</span><span class="cx">     RenderFlowThread* flowThread = flowThreadContainingBlock();
</span><del>-    if (!canComputeRegionRangeForBox(this, box, flowThread))
</del><ins>+    if (!canComputeRegionRangeForBox(*this, box, flowThread))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     RenderRegion* startRegion = nullptr;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBox.cpp        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -203,7 +203,7 @@
</span><span class="cx">     if (!flowThread || !flowThread-&gt;hasValidRegionInfo())
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    return flowThread-&gt;hasCachedRegionRangeForBox(this);
</del><ins>+    return flowThread-&gt;hasCachedRegionRangeForBox(*this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> LayoutRect RenderBox::clientBoxRectInRegion(RenderRegion* region) const
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderElement.cpp (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderElement.cpp        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderElement.cpp        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -2208,7 +2208,7 @@
</span><span class="cx">     // We have to ask for our containing flow thread as it may be above the removed sub-tree.
</span><span class="cx">     RenderFlowThread* flowThreadContainingBlock = this-&gt;flowThreadContainingBlock();
</span><span class="cx">     while (flowThreadContainingBlock) {
</span><del>-        flowThreadContainingBlock-&gt;removeFlowChildInfo(this);
</del><ins>+        flowThreadContainingBlock-&gt;removeFlowChildInfo(*this);
</ins><span class="cx"> 
</span><span class="cx">         if (flowThreadContainingBlock-&gt;flowThreadState() == NotInsideFlowThread)
</span><span class="cx">             break;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.cpp (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -91,11 +91,11 @@
</span><span class="cx">         invalidateRegions();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderFlowThread::removeFlowChildInfo(RenderElement* child)
</del><ins>+void RenderFlowThread::removeFlowChildInfo(RenderElement&amp; child)
</ins><span class="cx"> {
</span><del>-    if (is&lt;RenderBlockFlow&gt;(*child))
</del><ins>+    if (is&lt;RenderBlockFlow&gt;(child))
</ins><span class="cx">         removeLineRegionInfo(downcast&lt;RenderBlockFlow&gt;(child));
</span><del>-    if (is&lt;RenderBox&gt;(*child))
</del><ins>+    if (is&lt;RenderBox&gt;(child))
</ins><span class="cx">         removeRenderBoxRegionInfo(downcast&lt;RenderBox&gt;(child));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -171,7 +171,7 @@
</span><span class="cx">                 previousRegionLogicalWidth = regionLogicalWidth;
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            setRegionRangeForBox(this, m_regionList.first(), m_regionList.last());
</del><ins>+            setRegionRangeForBox(*this, m_regionList.first(), m_regionList.last());
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -559,7 +559,7 @@
</span><span class="cx">     return renderRegion;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderFlowThread::removeRenderBoxRegionInfo(RenderBox* box)
</del><ins>+void RenderFlowThread::removeRenderBoxRegionInfo(RenderBox&amp; box)
</ins><span class="cx"> {
</span><span class="cx">     if (!hasRegions())
</span><span class="cx">         return;
</span><span class="lines">@@ -572,7 +572,7 @@
</span><span class="cx"> 
</span><span class="cx">     RenderRegion* startRegion = nullptr;
</span><span class="cx">     RenderRegion* endRegion = nullptr;
</span><del>-    if (getRegionRangeForBox(box, startRegion, endRegion)) {
</del><ins>+    if (getRegionRangeForBox(&amp;box, startRegion, endRegion)) {
</ins><span class="cx">         for (auto it = m_regionList.find(startRegion), end = m_regionList.end(); it != end; ++it) {
</span><span class="cx">             RenderRegion* region = *it;
</span><span class="cx">             region-&gt;removeRenderBoxRegionInfo(box);
</span><span class="lines">@@ -584,21 +584,19 @@
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx">     // We have to make sure we did not leave any RenderBoxRegionInfo attached.
</span><span class="cx">     for (auto&amp; region : m_regionList)
</span><del>-        ASSERT(!region-&gt;renderBoxRegionInfo(box));
</del><ins>+        ASSERT(!region-&gt;renderBoxRegionInfo(&amp;box));
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    m_regionRangeMap.remove(box);
</del><ins>+    m_regionRangeMap.remove(&amp;box);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderFlowThread::removeLineRegionInfo(const RenderBlockFlow* blockFlow)
</del><ins>+void RenderFlowThread::removeLineRegionInfo(const RenderBlockFlow&amp; blockFlow)
</ins><span class="cx"> {
</span><del>-    if (!m_lineToRegionMap || blockFlow-&gt;lineLayoutPath() == SimpleLinesPath)
</del><ins>+    if (!m_lineToRegionMap || blockFlow.lineLayoutPath() == SimpleLinesPath)
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    for (RootInlineBox* curr = blockFlow-&gt;firstRootBox(); curr; curr = curr-&gt;nextRootBox()) {
-        if (m_lineToRegionMap-&gt;contains(curr))
-            m_lineToRegionMap-&gt;remove(curr);
-    }
</del><ins>+    for (auto* curr = blockFlow.firstRootBox(); curr; curr = curr-&gt;nextRootBox())
+        m_lineToRegionMap-&gt;remove(curr);
</ins><span class="cx"> 
</span><span class="cx">     ASSERT_WITH_SECURITY_IMPLICATION(checkLinesConsistency(blockFlow));
</span><span class="cx"> }
</span><span class="lines">@@ -699,7 +697,7 @@
</span><span class="cx">     return m_regionList.last();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderFlowThread::clearRenderBoxRegionInfoAndCustomStyle(const RenderBox* box,
</del><ins>+void RenderFlowThread::clearRenderBoxRegionInfoAndCustomStyle(const RenderBox&amp; box,
</ins><span class="cx">     const RenderRegion* newStartRegion, const RenderRegion* newEndRegion,
</span><span class="cx">     const RenderRegion* oldStartRegion, const RenderRegion* oldEndRegion)
</span><span class="cx"> {
</span><span class="lines">@@ -716,7 +714,7 @@
</span><span class="cx">         if (!(insideOldRegionRange &amp;&amp; insideNewRegionRange)) {
</span><span class="cx">             if (is&lt;RenderNamedFlowFragment&gt;(*region))
</span><span class="cx">                 downcast&lt;RenderNamedFlowFragment&gt;(*region).clearObjectStyleInRegion(box);
</span><del>-            if (region-&gt;renderBoxRegionInfo(box))
</del><ins>+            if (region-&gt;renderBoxRegionInfo(&amp;box))
</ins><span class="cx">                 region-&gt;removeRenderBoxRegionInfo(box);
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -727,14 +725,14 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderFlowThread::setRegionRangeForBox(const RenderBox* box, RenderRegion* startRegion, RenderRegion* endRegion)
</del><ins>+void RenderFlowThread::setRegionRangeForBox(const RenderBox&amp; box, RenderRegion* startRegion, RenderRegion* endRegion)
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(hasRegions());
</span><span class="cx">     ASSERT(startRegion &amp;&amp; endRegion &amp;&amp; startRegion-&gt;flowThread() == this &amp;&amp; endRegion-&gt;flowThread() == this);
</span><span class="cx"> 
</span><del>-    auto it = m_regionRangeMap.find(box);
</del><ins>+    auto it = m_regionRangeMap.find(&amp;box);
</ins><span class="cx">     if (it == m_regionRangeMap.end()) {
</span><del>-        m_regionRangeMap.set(box, RenderRegionRange(startRegion, endRegion));
</del><ins>+        m_regionRangeMap.set(&amp;box, RenderRegionRange(startRegion, endRegion));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -747,11 +745,9 @@
</span><span class="cx">     range.setRange(startRegion, endRegion);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool RenderFlowThread::hasCachedRegionRangeForBox(const RenderBox* box) const
</del><ins>+bool RenderFlowThread::hasCachedRegionRangeForBox(const RenderBox&amp; box) const
</ins><span class="cx"> {
</span><del>-    ASSERT(box);
-
-    return m_regionRangeMap.contains(box);
</del><ins>+    return m_regionRangeMap.contains(&amp;box);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool RenderFlowThread::getRegionRangeForBoxFromCachedInfo(const RenderBox* box, RenderRegion*&amp; startRegion, RenderRegion*&amp; endRegion) const
</span><span class="lines">@@ -802,11 +798,10 @@
</span><span class="cx">     if (getRegionRangeForBox(box, startRegion, endRegion))
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    // Search the region range using the information provided by the
-    // containing block chain.
-    RenderBox* cb = const_cast&lt;RenderBox*&gt;(box);
-    while (!cb-&gt;isRenderFlowThread()) {
-        InlineElementBox* boxWrapper = cb-&gt;inlineBoxWrapper();
</del><ins>+    // Search the region range using the information provided by the containing block chain.
+    auto* containingBlock = const_cast&lt;RenderBox*&gt;(box);
+    while (!containingBlock-&gt;isRenderFlowThread()) {
+        InlineElementBox* boxWrapper = containingBlock-&gt;inlineBoxWrapper();
</ins><span class="cx">         if (boxWrapper &amp;&amp; boxWrapper-&gt;root().containingRegion()) {
</span><span class="cx">             startRegion = endRegion = boxWrapper-&gt;root().containingRegion();
</span><span class="cx">             ASSERT(m_regionList.contains(startRegion));
</span><span class="lines">@@ -816,18 +811,17 @@
</span><span class="cx">         // FIXME: Use the containingBlock() value once we patch all the layout systems to be region range aware
</span><span class="cx">         // (e.g. if we use containingBlock() the shadow controls of a video element won't get the range from the
</span><span class="cx">         // video box because it's not a block; they need to be patched separately).
</span><del>-        ASSERT(cb-&gt;parent());
-        cb = &amp;cb-&gt;parent()-&gt;enclosingBox();
-        ASSERT(cb);
</del><ins>+        ASSERT(containingBlock-&gt;parent());
+        containingBlock = &amp;containingBlock-&gt;parent()-&gt;enclosingBox();
+        ASSERT(containingBlock);
</ins><span class="cx"> 
</span><span class="cx">         // If a box doesn't have a cached region range it usually means the box belongs to a line so startRegion should be equal with endRegion.
</span><span class="cx">         // FIXME: Find the cases when this startRegion should not be equal with endRegion and make sure these boxes have cached region ranges.
</span><del>-        if (hasCachedRegionRangeForBox(cb)) {
-            startRegion = endRegion = regionAtBlockOffset(cb, box-&gt;offsetFromLogicalTopOfFirstPage(), true);
</del><ins>+        if (containingBlock &amp;&amp; hasCachedRegionRangeForBox(*containingBlock)) {
+            startRegion = endRegion = regionAtBlockOffset(containingBlock, containingBlock-&gt;offsetFromLogicalTopOfFirstPage(), true);
</ins><span class="cx">             return true;
</span><span class="cx">         }
</span><span class="cx">     }
</span><del>-
</del><span class="cx">     ASSERT_NOT_REACHED();
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="lines">@@ -931,7 +925,7 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><del>-bool RenderFlowThread::checkLinesConsistency(const RenderBlockFlow* removedBlock) const
</del><ins>+bool RenderFlowThread::checkLinesConsistency(const RenderBlockFlow&amp; removedBlock) const
</ins><span class="cx"> {
</span><span class="cx">     if (!m_lineToRegionMap)
</span><span class="cx">         return true;
</span><span class="lines">@@ -939,7 +933,7 @@
</span><span class="cx">     for (auto&amp; linePair : *m_lineToRegionMap.get()) {
</span><span class="cx">         const RootInlineBox* line = linePair.key;
</span><span class="cx">         RenderRegion* region = linePair.value;
</span><del>-        if (&amp;line-&gt;blockFlow() == removedBlock)
</del><ins>+        if (&amp;line-&gt;blockFlow() == &amp;removedBlock)
</ins><span class="cx">             return false;
</span><span class="cx">         if (line-&gt;blockFlow().flowThreadState() == NotInsideFlowThread)
</span><span class="cx">             return false;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.h (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.h        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.h        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -60,13 +60,13 @@
</span><span class="cx"> public:
</span><span class="cx">     virtual ~RenderFlowThread() { }
</span><span class="cx"> 
</span><del>-    virtual void removeFlowChildInfo(RenderElement*);
</del><ins>+    virtual void removeFlowChildInfo(RenderElement&amp;);
</ins><span class="cx"> #ifndef NDEBUG
</span><span class="cx">     bool hasChildInfo(RenderObject* child) const { return is&lt;RenderBox&gt;(child) &amp;&amp; m_regionRangeMap.contains(downcast&lt;RenderBox&gt;(child)); }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #if !ASSERT_WITH_SECURITY_IMPLICATION_DISABLED
</span><del>-    bool checkLinesConsistency(const RenderBlockFlow*) const;
</del><ins>+    bool checkLinesConsistency(const RenderBlockFlow&amp;) const;
</ins><span class="cx"> #endif
</span><span class="cx">     
</span><span class="cx">     void deleteLines() override;
</span><span class="lines">@@ -133,10 +133,10 @@
</span><span class="cx">     bool previousRegionCountChanged() const { return m_previousRegionCount != m_regionList.size(); };
</span><span class="cx">     void updatePreviousRegionCount() { m_previousRegionCount = m_regionList.size(); };
</span><span class="cx"> 
</span><del>-    virtual void setRegionRangeForBox(const RenderBox*, RenderRegion*, RenderRegion*);
</del><ins>+    virtual void setRegionRangeForBox(const RenderBox&amp;, RenderRegion*, RenderRegion*);
</ins><span class="cx">     bool getRegionRangeForBox(const RenderBox*, RenderRegion*&amp; startRegion, RenderRegion*&amp; endRegion) const;
</span><span class="cx">     bool computedRegionRangeForBox(const RenderBox*, RenderRegion*&amp; startRegion, RenderRegion*&amp; endRegion) const;
</span><del>-    bool hasCachedRegionRangeForBox(const RenderBox*) const;
</del><ins>+    bool hasCachedRegionRangeForBox(const RenderBox&amp;) const;
</ins><span class="cx"> 
</span><span class="cx">     // Check if the object is in region and the region is part of this flow thread.
</span><span class="cx">     bool objectInFlowRegion(const RenderObject*, const RenderRegion*) const;
</span><span class="lines">@@ -200,7 +200,7 @@
</span><span class="cx">     void pushFlowThreadLayoutState(const RenderObject&amp;);
</span><span class="cx">     void popFlowThreadLayoutState();
</span><span class="cx">     LayoutUnit offsetFromLogicalTopOfFirstRegion(const RenderBlock*) const;
</span><del>-    void clearRenderBoxRegionInfoAndCustomStyle(const RenderBox*, const RenderRegion*, const RenderRegion*, const RenderRegion*, const RenderRegion*);
</del><ins>+    void clearRenderBoxRegionInfoAndCustomStyle(const RenderBox&amp;, const RenderRegion*, const RenderRegion*, const RenderRegion*, const RenderRegion*);
</ins><span class="cx"> 
</span><span class="cx">     void addRegionsVisualEffectOverflow(const RenderBox*);
</span><span class="cx">     void addRegionsVisualOverflowFromTheme(const RenderBlock*);
</span><span class="lines">@@ -274,8 +274,8 @@
</span><span class="cx"> 
</span><span class="cx">     bool getRegionRangeForBoxFromCachedInfo(const RenderBox*, RenderRegion*&amp; startRegion, RenderRegion*&amp; endRegion) const;
</span><span class="cx"> 
</span><del>-    void removeRenderBoxRegionInfo(RenderBox*);
-    void removeLineRegionInfo(const RenderBlockFlow*);
</del><ins>+    void removeRenderBoxRegionInfo(RenderBox&amp;);
+    void removeLineRegionInfo(const RenderBlockFlow&amp;);
</ins><span class="cx"> 
</span><span class="cx">     RenderRegionList m_regionList;
</span><span class="cx">     unsigned short m_previousRegionCount;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -545,7 +545,7 @@
</span><span class="cx">     return columnSet;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderMultiColumnFlowThread::setRegionRangeForBox(const RenderBox* box, RenderRegion* startRegion, RenderRegion* endRegion)
</del><ins>+void RenderMultiColumnFlowThread::setRegionRangeForBox(const RenderBox&amp; box, RenderRegion* startRegion, RenderRegion* endRegion)
</ins><span class="cx"> {
</span><span class="cx">     // Some column sets may have zero height, which means that two or more sets may start at the
</span><span class="cx">     // exact same flow thread position, which means that some parts of the code may believe that a
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnFlowThreadh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -121,7 +121,7 @@
</span><span class="cx">     void setPageBreak(const RenderBlock*, LayoutUnit offset, LayoutUnit spaceShortage) override;
</span><span class="cx">     void updateMinimumPageHeight(const RenderBlock*, LayoutUnit offset, LayoutUnit minHeight) override;
</span><span class="cx">     RenderRegion* regionAtBlockOffset(const RenderBox*, LayoutUnit, bool extendLastRegion = false) const override;
</span><del>-    void setRegionRangeForBox(const RenderBox*, RenderRegion*, RenderRegion*) override;
</del><ins>+    void setRegionRangeForBox(const RenderBox&amp;, RenderRegion*, RenderRegion*) override;
</ins><span class="cx">     bool addForcedRegionBreak(const RenderBlock*, LayoutUnit, RenderBox* breakChild, bool isBefore, LayoutUnit* offsetBreakAdjustment = 0) override;
</span><span class="cx">     bool isPageLogicalHeightKnown() const override;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderNamedFlowFragmentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderNamedFlowFragment.cpp (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderNamedFlowFragment.cpp        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderNamedFlowFragment.cpp        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -401,14 +401,13 @@
</span><span class="cx">     m_rendererRegionStyle.set(&amp;renderer, WTFMove(styleInfo));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderNamedFlowFragment::clearObjectStyleInRegion(const RenderElement* object)
</del><ins>+void RenderNamedFlowFragment::clearObjectStyleInRegion(const RenderElement&amp; object)
</ins><span class="cx"> {
</span><del>-    ASSERT(object);
-    m_rendererRegionStyle.remove(object);
</del><ins>+    m_rendererRegionStyle.remove(&amp;object);
</ins><span class="cx"> 
</span><span class="cx">     // Clear the style for the children of this object.
</span><del>-    for (auto&amp; child : childrenOfType&lt;RenderElement&gt;(*object))
-        clearObjectStyleInRegion(&amp;child);
</del><ins>+    for (auto&amp; child : childrenOfType&lt;RenderElement&gt;(object))
+        clearObjectStyleInRegion(child);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderNamedFlowFragment::setRegionObjectsRegionStyle()
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderNamedFlowFragmenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderNamedFlowFragment.h (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderNamedFlowFragment.h        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderNamedFlowFragment.h        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx">     RenderLayerModelObject&amp; layerOwner() const { return downcast&lt;RenderLayerModelObject&gt;(*parent()); }
</span><span class="cx"> 
</span><span class="cx">     bool hasCustomRegionStyle() const { return m_hasCustomRegionStyle; }
</span><del>-    void clearObjectStyleInRegion(const RenderElement*);
</del><ins>+    void clearObjectStyleInRegion(const RenderElement&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void setRegionObjectsRegionStyle();
</span><span class="cx">     void restoreRegionObjectsOriginalStyle();
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderNamedFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -779,7 +779,7 @@
</span><span class="cx">     m_hasRegionsWithStyling = hasRegionsWithStyling;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderNamedFlowThread::clearRenderObjectCustomStyle(const RenderElement* object)
</del><ins>+void RenderNamedFlowThread::clearRenderObjectCustomStyle(const RenderElement&amp; object)
</ins><span class="cx"> {
</span><span class="cx">     // Clear the styles for the object in the regions.
</span><span class="cx">     // FIXME: Region styling is not computed only for the region range of the object so this is why we need to walk the whole chain.
</span><span class="lines">@@ -787,7 +787,7 @@
</span><span class="cx">         downcast&lt;RenderNamedFlowFragment&gt;(*region).clearObjectStyleInRegion(object);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderNamedFlowThread::removeFlowChildInfo(RenderElement* child)
</del><ins>+void RenderNamedFlowThread::removeFlowChildInfo(RenderElement&amp; child)
</ins><span class="cx"> {
</span><span class="cx">     RenderFlowThread::removeFlowChildInfo(child);
</span><span class="cx">     clearRenderObjectCustomStyle(child);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderNamedFlowThreadh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderNamedFlowThread.h (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderNamedFlowThread.h        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderNamedFlowThread.h        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -82,9 +82,9 @@
</span><span class="cx">     bool hasRegionsWithStyling() const { return m_hasRegionsWithStyling; }
</span><span class="cx">     void checkRegionsWithStyling();
</span><span class="cx"> 
</span><del>-    void clearRenderObjectCustomStyle(const RenderElement*);
</del><ins>+    void clearRenderObjectCustomStyle(const RenderElement&amp;);
</ins><span class="cx"> 
</span><del>-    void removeFlowChildInfo(RenderElement*) override;
</del><ins>+    void removeFlowChildInfo(RenderElement&amp;) override;
</ins><span class="cx"> 
</span><span class="cx">     LayoutUnit flowContentBottom() const { return m_flowContentBottom; }
</span><span class="cx">     void dispatchNamedFlowEvents();
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderRegioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderRegion.cpp (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderRegion.cpp        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderRegion.cpp        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -325,9 +325,9 @@
</span><span class="cx">     return m_renderBoxRegionInfo.take(box);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderRegion::removeRenderBoxRegionInfo(const RenderBox* box)
</del><ins>+void RenderRegion::removeRenderBoxRegionInfo(const RenderBox&amp; box)
</ins><span class="cx"> {
</span><del>-    m_renderBoxRegionInfo.remove(box);
</del><ins>+    m_renderBoxRegionInfo.remove(&amp;box);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderRegion::deleteAllRenderBoxRegionInfo()
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderRegionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderRegion.h (208596 => 208597)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderRegion.h        2016-11-11 18:54:21 UTC (rev 208596)
+++ trunk/Source/WebCore/rendering/RenderRegion.h        2016-11-11 18:56:54 UTC (rev 208597)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx">     RenderBoxRegionInfo* setRenderBoxRegionInfo(const RenderBox*, LayoutUnit logicalLeftInset, LayoutUnit logicalRightInset,
</span><span class="cx">         bool containingBlockChainIsInset);
</span><span class="cx">     std::unique_ptr&lt;RenderBoxRegionInfo&gt; takeRenderBoxRegionInfo(const RenderBox*);
</span><del>-    void removeRenderBoxRegionInfo(const RenderBox*);
</del><ins>+    void removeRenderBoxRegionInfo(const RenderBox&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void deleteAllRenderBoxRegionInfo();
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>