Title: [86862] branches/chromium/742
- Revision
- 86862
- Author
- [email protected]
- Date
- 2011-05-19 11:39:59 -0700 (Thu, 19 May 2011)
Log Message
Merge 86448
BUG=82546
Review URL: http://codereview.chromium.org/7050016
Modified Paths
Added Paths
Diff
Copied: branches/chromium/742/LayoutTests/fast/block/float/float-not-removed-crash-expected.txt (from rev 86448, trunk/LayoutTests/fast/block/float/float-not-removed-crash-expected.txt) (0 => 86862)
--- branches/chromium/742/LayoutTests/fast/block/float/float-not-removed-crash-expected.txt (rev 0)
+++ branches/chromium/742/LayoutTests/fast/block/float/float-not-removed-crash-expected.txt 2011-05-19 18:39:59 UTC (rev 86862)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/742/LayoutTests/fast/block/float/float-not-removed-crash.html (from rev 86448, trunk/LayoutTests/fast/block/float/float-not-removed-crash.html) (0 => 86862)
--- branches/chromium/742/LayoutTests/fast/block/float/float-not-removed-crash.html (rev 0)
+++ branches/chromium/742/LayoutTests/fast/block/float/float-not-removed-crash.html 2011-05-19 18:39:59 UTC (rev 86862)
@@ -0,0 +1,26 @@
+<html>
+ Test passes if it does not crash.
+ <body _onload_="runTest()">
+ <div style="display: -webkit-inline-box">
+ <span id="span1">
+ <span><blockquote></blockquote></span>
+ <span><p style="float: left;"></p></span>
+ </span>
+ <span id="span2" style="display: list-item"></span>
+ </div>
+ <script type="text/_javascript_">
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ function runTest() {
+ document.body.offsetTop;
+ span1 = document.getElementById('span1');
+ span2 = document.getElementById('span2');
+ tfoot = document.createElement('tfoot');
+ span2.appendChild(tfoot);
+ document.body.offsetTop;
+ span1.parentNode.removeChild(span1);
+ }
+ </script>
+ </body>
+</html>
\ No newline at end of file
Modified: branches/chromium/742/Source/WebCore/rendering/RenderBox.cpp (86861 => 86862)
--- branches/chromium/742/Source/WebCore/rendering/RenderBox.cpp 2011-05-19 18:39:14 UTC (rev 86861)
+++ branches/chromium/742/Source/WebCore/rendering/RenderBox.cpp 2011-05-19 18:39:59 UTC (rev 86862)
@@ -223,7 +223,7 @@
for (RenderObject* curr = parent(); curr && !curr->isRenderView(); curr = curr->parent()) {
if (curr->isRenderBlock()) {
RenderBlock* currBlock = toRenderBlock(curr);
- if (currBlock->containsFloat(this))
+ if (!parentBlock || currBlock->containsFloat(this))
parentBlock = currBlock;
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
