Bug 180251 – Nullptr deref in WebCore::RenderTableCaption::containingBlockLogicalWidthForContent

• Component: Layout and Rendering
• Status: RESOLVED FIXED

[zalan]

rdar://problem/34138562

[zalan]

Created attachment 328095 [details]
Patch

[zalan]

In an ideal world we would never end up calling containingBlockLogicalWidthForContent on a detached renderer. There's no reason why we would want the containing block's logical width unless we are performing layout.

[Simon Fraser (smfr)]

Comment on attachment 328095 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=328095&action=review

> LayoutTests/fast/table/caption-crash-when-layer-backed.html:6
> +    will-change: -webkit-transform; 

No prefix.

> LayoutTests/fast/table/caption-crash-when-layer-backed.html:8
> +    -webkit-background-clip: content; 

Not sure why this is needed.

[zalan]

Created attachment 328119 [details]
Patch

[zalan]

(In reply to Simon Fraser (smfr) from comment #3)
> Comment on attachment 328095 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=328095&action=review
> 
> > LayoutTests/fast/table/caption-crash-when-layer-backed.html:6
> > +    will-change: -webkit-transform; 
> 
> No prefix.
> 
> > LayoutTests/fast/table/caption-crash-when-layer-backed.html:8
> > +    -webkit-background-clip: content; 
> 
> Not sure why this is needed.
backgroundClip needs to be either PaddingFillBox or ContentFillBox to force padding/border etc resolving.

[WebKit Commit Bot]

Comment on attachment 328119 [details]
Patch

Clearing flags on attachment: 328119

Committed r225402: <https://trac.webkit.org/changeset/225402>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.