mirrors/netsurf
1
0
Fork 0
mirror of https://github.com/netsurf-browser/netsurf synced 2024-11-23 14:59:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #3433840: <img style="display: table" src="..."> will crash if the image fetch completes before initial layout.

Browse Source 
A number of things wrong here:
1) The BOX_TABLE generated for the img shouldn't ever have been associated with the object (it should have been associated with the implied BOX_TABLE_CELL)
2) The layout engine's decision to treat BOX_TABLE/BOX_INLINE_CONTAINER with associated objects differently from non-replaced TABLE/INLINE_CONTAINERs seems wrong (looking though SVN history, it appears that this was introduced as part of the very first frames implementation, since replaced (twice!))
3) Now we fetch objects in parallel with building the box tree, we're open to this kind of race condition.

svn path=/trunk/netsurf/; revision=13128
This commit is contained in:
John Mark Bell 2011-11-05 21:03:52 +00:00
parent 30c91aa4e7
commit 3776e49f02
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
render/layout.c
View File

@ -320,8 +320,7 @@ bool layout_block_context(struct box *block, int viewport_height,
* left and right margins to avoid any floats. */
lm = rm = 0;
if (box->type == BOX_BLOCK || box->object ||
box->flags & IFRAME) {
if (box->type == BOX_BLOCK || box->flags & IFRAME) {
if (!box->object && !(box->flags & IFRAME) &&
!(box->flags & REPLACE_DIM) &&
box->style &&