Bug 133155 - REGRESSION(r167870): Crash in simple line layout code with :after
Summary: REGRESSION(r167870): Crash in simple line layout code with :after
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2014-05-21 11:04 PDT by Antti Koivisto
Modified: 2014-05-21 23:14 PDT (History)
6 users (show)

See Also:


Attachments
patch (5.77 KB, patch)
2014-05-21 11:20 PDT, Antti Koivisto
darin: review+
Details | Formatted Diff | Diff
patch 2 (9.13 KB, patch)
2014-05-21 13:40 PDT, Antti Koivisto
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Antti Koivisto 2014-05-21 11:04:32 PDT
<style>
a { display: none; }
a:after { content: "bar"; }
div:hover a { display: inline-block }
</style>
<div>foo<a></a></div>
Comment 1 Antti Koivisto 2014-05-21 11:05:14 PDT
<rdar://problem/16977696>
Comment 2 Antti Koivisto 2014-05-21 11:20:56 PDT
Created attachment 231834 [details]
patch
Comment 3 Darin Adler 2014-05-21 11:29:15 PDT
Comment on attachment 231834 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=231834&action=review

Looks great.

> Source/WebCore/rendering/RenderBlockFlow.cpp:3423
>  const SimpleLineLayout::Layout* RenderBlockFlow::simpleLineLayout() const
>  {
> -    if (m_lineLayoutPath == UndeterminedPath)
> -        const_cast<RenderBlockFlow&>(*this).m_lineLayoutPath = SimpleLineLayout::canUseFor(*this) ? SimpleLinesPath : LineBoxesPath;
> -
> -    if (m_lineLayoutPath == SimpleLinesPath)
> -        return m_simpleLineLayout.get();
> -
> -    const_cast<RenderBlockFlow&>(*this).createLineBoxes();
> -    return nullptr;
> +    ASSERT(m_lineLayoutPath <= SimpleLinesPath || !m_simpleLineLayout);
> +    return m_simpleLineLayout.get();
>  }

Maybe we should move this back to the header file and make it an inline function again.

I don’t think the assertion is strong enough. It’s seems like it’s not OK to get a non-nullptr value if m_lineLayoutPath is UndeterminedPath. But maybe we can’t put the stronger assertion in because we still need to get at m_simpleLineLayout in the time window before we determine whether to use it or not.
Comment 4 Antti Koivisto 2014-05-21 13:40:17 PDT
Created attachment 231839 [details]
patch 2
Comment 5 Antti Koivisto 2014-05-21 13:41:12 PDT
> I don’t think the assertion is strong enough. It’s seems like it’s not OK to get a non-nullptr value if m_lineLayoutPath is UndeterminedPath. But maybe we can’t put the stronger assertion in because we still need to get at m_simpleLineLayout in the time window before we determine whether to use it or not.

You are right. I tightened the assert and now drop the simple line layout on path invalidation.
Comment 6 Antti Koivisto 2014-05-21 23:14:50 PDT
https://trac.webkit.org/r169189