[webkit-reviews] review granted: [Bug 133155] REGRESSION(r167870): Crash in simple line layout code with :after : [Attachment 231834] patch

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has granted Antti Koivisto <koivisto at iki.fi>'s
request for review:
Bug 133155: REGRESSION(r167870): Crash in simple line layout code with :after
https://bugs.webkit.org/show_bug.cgi?id=133155

Attachment 231834: patch
https://bugs.webkit.org/attachment.cgi?id=231834&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=231834&action=review


Looks great.

> Source/WebCore/rendering/RenderBlockFlow.cpp:3423
>  const SimpleLineLayout::Layout* RenderBlockFlow::simpleLineLayout() const
>  {
> -    if (m_lineLayoutPath == UndeterminedPath)
> -	   const_cast<RenderBlockFlow&>(*this).m_lineLayoutPath =
SimpleLineLayout::canUseFor(*this) ? SimpleLinesPath : LineBoxesPath;
> -
> -    if (m_lineLayoutPath == SimpleLinesPath)
> -	   return m_simpleLineLayout.get();
> -
> -    const_cast<RenderBlockFlow&>(*this).createLineBoxes();
> -    return nullptr;
> +    ASSERT(m_lineLayoutPath <= SimpleLinesPath || !m_simpleLineLayout);
> +    return m_simpleLineLayout.get();
>  }

Maybe we should move this back to the header file and make it an inline
function again.

I don’t think the assertion is strong enough. It’s seems like it’s not OK to
get a non-nullptr value if m_lineLayoutPath is UndeterminedPath. But maybe we
can’t put the stronger assertion in because we still need to get at
m_simpleLineLayout in the time window before we determine whether to use it or
not.