LayoutTests:
Reviewed by Maciej.
Test for <rdar://problem/5388936>
Crash while setting display:none for a table cell with selection
* fast/table/destroy-cell-with-selection-crash-expected.txt: Added.
* fast/table/destroy-cell-with-selection-crash.html: Added.
WebCore:
Reviewed by Maciej.
Fix <rdar://problem/5388936>
Crash while setting display:none for a table cell with selection
Super class destroy() could (through some selection code in removeChild()) trigger section recalc
in middle of RenderTableCell::destroy(), cleaning section dirty bit. This would later crash in
layout since cell grid would still have refence to the dead cell.
Ensure table sections are dirty when leaving destroy method.
I can't figure out tests for row and section changes but they look like
they could crash in similar way as cell.
* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::destroy):
* rendering/RenderTableRow.cpp:
(WebCore::RenderTableRow::destroy):
* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::destroy):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@25106 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index 6ed94c5..b00b184 100644
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -72,12 +72,14 @@
void RenderTableSection::destroy()
{
+ RenderTable* recalcTable = table();
+
+ RenderContainer::destroy();
+
// recalc cell info because RenderTable has unguarded pointers
// stored that point to this RenderTableSection.
- if (table())
- table()->setNeedsSectionRecalc();
-
- RenderContainer::destroy();
+ if (recalcTable)
+ recalcTable->setNeedsSectionRecalc();
}
void RenderTableSection::setStyle(RenderStyle* newStyle)
