Title: [92941] branches/safari-534.51-branch
- Revision
- 92941
- Author
- [email protected]
- Date
- 2011-08-11 23:17:16 -0700 (Thu, 11 Aug 2011)
Log Message
Merge r92132.
Modified Paths
Added Paths
Diff
Modified: branches/safari-534.51-branch/LayoutTests/ChangeLog (92940 => 92941)
--- branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-08-12 06:14:06 UTC (rev 92940)
+++ branches/safari-534.51-branch/LayoutTests/ChangeLog 2011-08-12 06:17:16 UTC (rev 92941)
@@ -1,5 +1,21 @@
2011-08-11 Lucas Forschler <[email protected]>
+ Merged 92132
+
+ 2011-07-28 Abhishek Arya <[email protected]>
+
+ Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
+ https://bugs.webkit.org/show_bug.cgi?id=65137
+
+ ASSERTION FAILED: trailingSpaceMidpoint >= 0
+
+ Reviewed by Dave Hyatt.
+
+ * fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt: Added.
+ * fast/block/update-midpoints-for-trailing-boxes-crash.html: Added.
+
+2011-08-11 Lucas Forschler <[email protected]>
+
Merged 91965
2011-07-28 Anders Carlsson <[email protected]>
Copied: branches/safari-534.51-branch/LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt (from rev 92132, trunk/LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt) (0 => 92941)
--- branches/safari-534.51-branch/LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash-expected.txt 2011-08-12 06:17:16 UTC (rev 92941)
@@ -0,0 +1 @@
+PASS, does not crash
Copied: branches/safari-534.51-branch/LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash.html (from rev 92132, trunk/LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash.html) (0 => 92941)
--- branches/safari-534.51-branch/LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash.html (rev 0)
+++ branches/safari-534.51-branch/LayoutTests/fast/block/update-midpoints-for-trailing-boxes-crash.html 2011-08-12 06:17:16 UTC (rev 92941)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.a {
+ display: table-cell;
+ white-space: nowrap;
+}
+.b {
+ padding-left: 4px;
+ white-space: pre-wrap;
+}
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<div class='a'>
+<span class='b'>PASS,</span>
+<span>
+<span>does not crash</span>
+<span class='b'></span>
+</span>
+</div>
+</body>
+</html>
Modified: branches/safari-534.51-branch/Source/WebCore/ChangeLog (92940 => 92941)
--- branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-08-12 06:14:06 UTC (rev 92940)
+++ branches/safari-534.51-branch/Source/WebCore/ChangeLog 2011-08-12 06:17:16 UTC (rev 92941)
@@ -1,5 +1,23 @@
2011-08-11 Lucas Forschler <[email protected]>
+ Merged 92132
+
+ 2011-07-28 Abhishek Arya <[email protected]>
+
+ Regression(82144): Crash in TrailingObjects::updateMidpointsForTrailingBoxes
+ https://bugs.webkit.org/show_bug.cgi?id=65137
+
+ Fix the looping condition to prevent trailingSpaceMidpoint from becoming negative.
+
+ Reviewed by Dave Hyatt.
+
+ Test: fast/block/update-midpoints-for-trailing-boxes-crash.html
+
+ * rendering/RenderBlockLineLayout.cpp:
+ (WebCore::TrailingObjects::updateMidpointsForTrailingBoxes):
+
+2011-08-11 Lucas Forschler <[email protected]>
+
Merged 91965
2011-07-28 Anders Carlsson <[email protected]>
Modified: branches/safari-534.51-branch/Source/WebCore/rendering/RenderBlockLineLayout.cpp (92940 => 92941)
--- branches/safari-534.51-branch/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2011-08-12 06:14:06 UTC (rev 92940)
+++ branches/safari-534.51-branch/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2011-08-12 06:17:16 UTC (rev 92941)
@@ -1787,7 +1787,7 @@
if (lineMidpointState.numMidpoints % 2) {
// Find the trailing space object's midpoint.
int trailingSpaceMidpoint = lineMidpointState.numMidpoints - 1;
- for ( ; trailingSpaceMidpoint >= 0 && lineMidpointState.midpoints[trailingSpaceMidpoint].m_obj != m_whitespace; --trailingSpaceMidpoint) { }
+ for ( ; trailingSpaceMidpoint > 0 && lineMidpointState.midpoints[trailingSpaceMidpoint].m_obj != m_whitespace; --trailingSpaceMidpoint) { }
ASSERT(trailingSpaceMidpoint >= 0);
if (collapseFirstSpace == CollapseFirstSpace)
lineMidpointState.midpoints[trailingSpaceMidpoint].m_pos--;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
