Merge 104121 - Source/WebCore: Crash in RenderRegion::getRegionRangeForBox.

Source/WebCore/rendering/RenderFlowThread.cpp

Index: Source/WebCore/rendering/RenderFlowThread.cpp
===================================================================
--- Source/WebCore/rendering/RenderFlowThread.cpp	(revision 105817)
+++ Source/WebCore/rendering/RenderFlowThread.cpp	(working copy)
@@ -209,7 +209,10 @@
 void RenderFlowThread::removeRegionFromThread(RenderRegion* renderRegion)
 {
     ASSERT(renderRegion);
+    deleteAllValues(m_regionRangeMap);
+	m_regionRangeMap.clear();
     m_regionList.remove(renderRegion);
+
     if (renderRegion->parentFlowThread()) {
         if (!renderRegion->isValid()) {
             renderRegion->parentFlowThread()->m_observerThreadsSet.remove(this);
@@ -499,7 +502,7 @@
 
 void RenderFlowThread::repaintRectangleInRegions(const LayoutRect& repaintRect, bool immediate)
 {
-    if (!shouldRepaint(repaintRect))
+    if (!shouldRepaint(repaintRect) || !hasValidRegionInfo())
         return;
 
     for (RenderRegionList::iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
@@ -593,7 +596,7 @@
 
 RenderRegion* RenderFlowThread::mapFromFlowToRegion(TransformState& transformState) const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
 
     LayoutRect boxRect = transformState.mappedQuad().enclosingBoundingBox();
@@ -674,7 +677,7 @@
 
 LayoutUnit RenderFlowThread::contentLogicalWidthOfFirstRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
@@ -688,7 +691,7 @@
 
 LayoutUnit RenderFlowThread::contentLogicalHeightOfFirstRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
@@ -702,7 +705,7 @@
  
 LayoutUnit RenderFlowThread::contentLogicalLeftOfFirstRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
@@ -716,7 +719,7 @@
 
 RenderRegion* RenderFlowThread::firstRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
@@ -729,7 +732,7 @@
 
 RenderRegion* RenderFlowThread::lastRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_reverse_iterator iter = m_regionList.rbegin(); iter != m_regionList.rend(); ++iter) {
         RenderRegion* region = *iter;
@@ -779,8 +782,10 @@
     RenderRegionRange* range = m_regionRangeMap.get(box);
     if (!range)
         return;
+
     startRegion = range->startRegion();
     endRegion = range->endRegion();
+    ASSERT(m_regionList.contains(startRegion) && m_regionList.contains(endRegion));
 }
     
 } // namespace WebCore