Merge 104121 - Source/WebCore: Crash in RenderRegion::getRegionRangeForBox.

Source/WebCore/rendering/RenderFlowThread.cpp

 /*
  * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 191 matching lines @@
     }
 
     renderRegion->setIsValid(true);
 
     invalidateRegions();
 }
 
 void RenderFlowThread::removeRegionFromThread(RenderRegion* renderRegion)
 {
     ASSERT(renderRegion);
+    clearRenderRegionRangeMap();
     m_regionList.remove(renderRegion);
+
     if (renderRegion->parentFlowThread()) {
         if (!renderRegion->isValid()) {
             renderRegion->parentFlowThread()->m_observerThreadsSet.remove(this);
             // No need to invalidate the regions rectangles. The removed region
             // was not taken into account. Just return here.
             return;
         }
         removeDependencyOnFlowThread(renderRegion->parentFlowThread());
     }
 
@@ skipping 269 matching lines @@
 bool RenderFlowThread::shouldRepaint(const LayoutRect& r) const
 {
     if (view()->printing() || r.isEmpty())
         return false;
 
     return true;
 }
 
 void RenderFlowThread::repaintRectangleInRegions(const LayoutRect& repaintRect, bool immediate)
 {
-    if (!shouldRepaint(repaintRect))
+    if (!shouldRepaint(repaintRect) || !hasValidRegionInfo())
         return;
 
     for (RenderRegionList::iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
         if (!region->isValid())
             continue;
 
         // We only have to issue a repaint in this region if the region rect intersects the repaint rect.
         LayoutRect flippedRegionRect(region->regionRect());
         LayoutRect flippedRegionOverflowRect(region->regionOverflowRect());
@@ skipping 73 matching lines @@
         // If IncludePageBoundary is set, the line exactly on the top edge of a
         // region will act as being part of the previous region.
         LayoutUnit regionHeight = isHorizontalWritingMode() ? region->regionRect().height() : region->regionRect().width();
         remainingHeight = layoutMod(remainingHeight, regionHeight);
     }
     return remainingHeight;
 }
 
 RenderRegion* RenderFlowThread::mapFromFlowToRegion(TransformState& transformState) const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
 
     LayoutRect boxRect = transformState.mappedQuad().enclosingBoundingBox();
     flipForWritingMode(boxRect);
 
     // FIXME: We need to refactor RenderObject::absoluteQuads to be able to split the quads across regions,
     // for now we just take the center of the mapped enclosing box and map it to a region.
     // Note: Using the center in order to avoid rounding errors.
 
     LayoutPoint center = boxRect.center();
@@ skipping 60 matching lines @@
 
         if (region == endRegion)
             break;
     }
 
     return false;
 }
 
 LayoutUnit RenderFlowThread::contentLogicalWidthOfFirstRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
         if (!region->isValid())
             continue;
         return isHorizontalWritingMode() ? region->contentWidth() : region->contentHeight();
     }
     ASSERT_NOT_REACHED();
     return 0;
 }
 
 LayoutUnit RenderFlowThread::contentLogicalHeightOfFirstRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
         if (!region->isValid())
             continue;
         return isHorizontalWritingMode() ? region->contentHeight() : region->contentWidth();
     }
     ASSERT_NOT_REACHED();
     return 0;
 }
  
 LayoutUnit RenderFlowThread::contentLogicalLeftOfFirstRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
         if (!region->isValid())
             continue;
         return isHorizontalWritingMode() ? region->regionRect().x() : region->regionRect().y();
     }
     ASSERT_NOT_REACHED();
     return 0;
 }
 
 RenderRegion* RenderFlowThread::firstRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_iterator iter = m_regionList.begin(); iter != m_regionList.end(); ++iter) {
         RenderRegion* region = *iter;
         if (!region->isValid())
             continue;
         return region;
     }
     return 0;
 }
 
 RenderRegion* RenderFlowThread::lastRegion() const
 {
-    if (!hasValidRegions())
+    if (!hasValidRegionInfo())
         return 0;
     for (RenderRegionList::const_reverse_iterator iter = m_regionList.rbegin(); iter != m_regionList.rend(); ++iter) {
         RenderRegion* region = *iter;
         if (!region->isValid())
             continue;
         return region;
     }
     return 0;
 }
 
@@ skipping 29 matching lines @@
     m_regionRangeMap.set(box, range);
 }
 
 void RenderFlowThread::getRegionRangeForBox(const RenderBox* box, RenderRegion*& startRegion, RenderRegion*& endRegion) const
 {
     startRegion = 0;
     endRegion = 0;
     RenderRegionRange* range = m_regionRangeMap.get(box);
     if (!range)
         return;
+
     startRegion = range->startRegion();
     endRegion = range->endRegion();
+    ASSERT(m_regionList.contains(startRegion) && m_regionList.contains(endRegion));
 }
     
 } // namespace WebCore