Summary: | iExploder(#12): Assertion failure in RenderContainer::removeChildNode | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Alexey Proskuryakov <ap> | ||||||||
Component: | Layout and Rendering | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | bugs-webkit, mitz | ||||||||
Priority: | P2 | Keywords: | HasReduction | ||||||||
Version: | 420+ | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.4 | ||||||||||
Attachments: |
|
Description
Alexey Proskuryakov
2006-04-16 04:04:05 PDT
Created attachment 7739 [details]
test case
Created attachment 7741 [details]
Reduced test case (crashes when closing the window)
The root cause of this bug is that RenderInline::splitFlow() recycles the button's inner anonymous block for the beginning of the split flow and puts the rest in sibling anonymous blocks, whereas the button expects all its children to be in the inner anonymous block it created initially. I think the inner anonymous block should be maintained as the button's only child, so splitFlow() should avoid recycling it. Since only buttons need this behavior, maybe it's okay to simply check if the anonymous block's parent is a button. Created attachment 7743 [details]
Don't allow splitting button's inner container
...or you can call it isButton() and reverse the values.
Comment on attachment 7743 [details]
Don't allow splitting button's inner container
The patch looks totally sane. The layout test could possibly have been simpler (using JS to test the number of children for instance). My only concern is performance, I have no idea how hot this code is. I'm going to r+ and leave hyatt or darin to complain if I was wrong.
Oops, you are refereing to render tree children here. nm then. JS can't access those. |