Title: [92975] branches/chromium/835
- Revision
- 92975
- Author
- [email protected]
- Date
- 2011-08-12 11:06:44 -0700 (Fri, 12 Aug 2011)
Log Message
Merge 92798
BUG=91972
Review URL: http://codereview.chromium.org/7634029
Modified Paths
Added Paths
Diff
Copied: branches/chromium/835/LayoutTests/fast/block/float/float-originating-line-deleted-crash-expected.txt (from rev 92798, trunk/LayoutTests/fast/block/float/float-originating-line-deleted-crash-expected.txt) (0 => 92975)
--- branches/chromium/835/LayoutTests/fast/block/float/float-originating-line-deleted-crash-expected.txt (rev 0)
+++ branches/chromium/835/LayoutTests/fast/block/float/float-originating-line-deleted-crash-expected.txt 2011-08-12 18:06:44 UTC (rev 92975)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/835/LayoutTests/fast/block/float/float-originating-line-deleted-crash.html (from rev 92798, trunk/LayoutTests/fast/block/float/float-originating-line-deleted-crash.html) (0 => 92975)
--- branches/chromium/835/LayoutTests/fast/block/float/float-originating-line-deleted-crash.html (rev 0)
+++ branches/chromium/835/LayoutTests/fast/block/float/float-originating-line-deleted-crash.html 2011-08-12 18:06:44 UTC (rev 92975)
@@ -0,0 +1,26 @@
+<html>
+Test passes if it does not crash.
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+function runTest()
+{
+ child = document.getElementById('test');
+ child.parentNode.removeChild(child);
+
+ document.body.offsetTop;
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+setTimeout("runTest();", 0);
+</script>
+<style id='test'>
+ p { float: left; }
+</style>
+<table><span><p></p><p></p></span></table>
+</html>
\ No newline at end of file
Modified: branches/chromium/835/Source/WebCore/rendering/RenderBlock.cpp (92974 => 92975)
--- branches/chromium/835/Source/WebCore/rendering/RenderBlock.cpp 2011-08-12 17:51:08 UTC (rev 92974)
+++ branches/chromium/835/Source/WebCore/rendering/RenderBlock.cpp 2011-08-12 18:06:44 UTC (rev 92975)
@@ -3204,8 +3204,10 @@
logicalBottom = max(logicalBottom, logicalTop + 1);
}
if (r->m_originatingLine) {
- ASSERT(r->m_originatingLine->renderer() == this);
- r->m_originatingLine->markDirty();
+ if (!selfNeedsLayout()) {
+ ASSERT(r->m_originatingLine->renderer() == this);
+ r->m_originatingLine->markDirty();
+ }
#if !ASSERT_DISABLED
r->m_originatingLine = 0;
#endif
@@ -3679,7 +3681,7 @@
}
floatMap.remove(f->m_renderer);
- if (oldFloatingObject->m_originatingLine) {
+ if (oldFloatingObject->m_originatingLine && !selfNeedsLayout()) {
ASSERT(oldFloatingObject->m_originatingLine->renderer() == this);
oldFloatingObject->m_originatingLine->markDirty();
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
