[Webkit-unassigned] [Bug 133155] REGRESSION(r167870): Crash in simple line layout code with :after
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed May 21 11:28:53 PDT 2014
https://bugs.webkit.org/show_bug.cgi?id=133155
Darin Adler <darin at apple.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #231834|review? |review+
Flag| |
--- Comment #3 from Darin Adler <darin at apple.com> 2014-05-21 11:29:15 PST ---
(From update of attachment 231834)
View in context: https://bugs.webkit.org/attachment.cgi?id=231834&action=review
Looks great.
> Source/WebCore/rendering/RenderBlockFlow.cpp:3423
> const SimpleLineLayout::Layout* RenderBlockFlow::simpleLineLayout() const
> {
> - if (m_lineLayoutPath == UndeterminedPath)
> - const_cast<RenderBlockFlow&>(*this).m_lineLayoutPath = SimpleLineLayout::canUseFor(*this) ? SimpleLinesPath : LineBoxesPath;
> -
> - if (m_lineLayoutPath == SimpleLinesPath)
> - return m_simpleLineLayout.get();
> -
> - const_cast<RenderBlockFlow&>(*this).createLineBoxes();
> - return nullptr;
> + ASSERT(m_lineLayoutPath <= SimpleLinesPath || !m_simpleLineLayout);
> + return m_simpleLineLayout.get();
> }
Maybe we should move this back to the header file and make it an inline function again.
I don’t think the assertion is strong enough. It’s seems like it’s not OK to get a non-nullptr value if m_lineLayoutPath is UndeterminedPath. But maybe we can’t put the stronger assertion in because we still need to get at m_simpleLineLayout in the time window before we determine whether to use it or not.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list