/[blink]
Chromium logo

Revision 164405


Jump to revision: Previous Next
Author: inferno@chromium.org
Date: Wed Jan 1 00:45:39 2014 UTC (9 years, 4 months ago)
Changed paths: 4
Log Message:
Revert 164125 "ASSERTION FAILED: !object || object->isTable()"

Caused multiple use-after-free bugs. See bugs 330626, 331029.

> ASSERTION FAILED: !object || object->isTable()
> 
> The issue is caused by call sites of
> RenderBlock::addChildIgnoringAnonymousColumnBlocks
> that basically bypass the RenderTable::addChild logic causing
> all sorts of mayhem. The fix I decided on is to fix the previous
> RenderBlock function as it's the safest approach to the current
> madness.
> 
> This change adds an extra ASSERT into RenderObjectChildList to
> catch further problem earlier.
> 
> BUG=309421
> 
> Review URL: https://codereview.chromium.org/111873005

TBR=jchaffraix@chromium.org

Review URL: https://codereview.chromium.org/104593014

Changed paths

Path Details
Directorytrunk/LayoutTests/fast/table/bad-table-insert-anonymous-multi-column-expected.txt deleted
Directorytrunk/LayoutTests/fast/table/bad-table-insert-anonymous-multi-column.html deleted
Directorytrunk/Source/core/rendering/RenderBlock.cpp modified , text changed
Directorytrunk/Source/core/rendering/RenderObjectChildList.cpp modified , text changed

Powered by ViewVC 1.1.26 ViewVC Help