diff options
| author | John Mark Bell <jmb@netsurf-browser.org> | 2011-11-05 21:03:52 +0000 |
|---|---|---|
| committer | John Mark Bell <jmb@netsurf-browser.org> | 2011-11-05 21:03:52 +0000 |
| commit | 3776e49f02bab41706fde9561443478b05cab729 (patch) | |
| tree | 96a56cd1fab9b2ce560887da822b021b68f2d87c /render/layout.c | |
| parent | 30c91aa4e7939033c1798c93527d19b6e2c554b0 (diff) | |
| download | netsurf-3776e49f02bab41706fde9561443478b05cab729.tar.gz netsurf-3776e49f02bab41706fde9561443478b05cab729.tar.bz2 | |
Fix bug #3433840: <img style="display: table" src="..."> will crash if the image fetch completes before initial layout.
A number of things wrong here:
1) The BOX_TABLE generated for the img shouldn't ever have been associated with the object (it should have been associated with the implied BOX_TABLE_CELL)
2) The layout engine's decision to treat BOX_TABLE/BOX_INLINE_CONTAINER with associated objects differently from non-replaced TABLE/INLINE_CONTAINERs seems wrong (looking though SVN history, it appears that this was introduced as part of the very first frames implementation, since replaced (twice!))
3) Now we fetch objects in parallel with building the box tree, we're open to this kind of race condition.
svn path=/trunk/netsurf/; revision=13128
Diffstat (limited to 'render/layout.c')
| -rw-r--r-- | render/layout.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/render/layout.c b/render/layout.c index 13e85e2e6..c4dbcb0b7 100644 --- a/render/layout.c +++ b/render/layout.c @@ -320,8 +320,7 @@ bool layout_block_context(struct box *block, int viewport_height, * left and right margins to avoid any floats. */ lm = rm = 0; - if (box->type == BOX_BLOCK || box->object || - box->flags & IFRAME) { + if (box->type == BOX_BLOCK || box->flags & IFRAME) { if (!box->object && !(box->flags & IFRAME) && !(box->flags & REPLACE_DIM) && box->style && |