Title: [97787] branches/chromium/874
- Revision
- 97787
- Author
- [email protected]
- Date
- 2011-10-18 13:44:31 -0700 (Tue, 18 Oct 2011)
Log Message
Merge 97786 - Crash in RenderDeprecatedFlexibleBox::layoutHorizontalBox
BUG=97786
Review URL: http://codereview.chromium.org/8346010
Modified Paths
Added Paths
Diff
Copied: branches/chromium/874/LayoutTests/fast/flexbox/layoutHorizontalBox-crash-expected.txt (from rev 97786, trunk/LayoutTests/fast/flexbox/layoutHorizontalBox-crash-expected.txt) (0 => 97787)
--- branches/chromium/874/LayoutTests/fast/flexbox/layoutHorizontalBox-crash-expected.txt (rev 0)
+++ branches/chromium/874/LayoutTests/fast/flexbox/layoutHorizontalBox-crash-expected.txt 2011-10-18 20:44:31 UTC (rev 97787)
@@ -0,0 +1,3 @@
+
+bug 70183: Crash in RenderDeprecatedFlexibleBox::layoutHorizontalBox
+If this test did not CRASH or show errors in valgrind, it has PASSED.
Copied: branches/chromium/874/LayoutTests/fast/flexbox/layoutHorizontalBox-crash.html (from rev 97786, trunk/LayoutTests/fast/flexbox/layoutHorizontalBox-crash.html) (0 => 97787)
--- branches/chromium/874/LayoutTests/fast/flexbox/layoutHorizontalBox-crash.html (rev 0)
+++ branches/chromium/874/LayoutTests/fast/flexbox/layoutHorizontalBox-crash.html 2011-10-18 20:44:31 UTC (rev 97787)
@@ -0,0 +1,25 @@
+<style>
+.c6:first-letter { visibility: hidden; }
+.c6:nth-last-child(2n+10000000000000000) { text-align: -webkit-center; width: 10px; }
+.c26:first-letter { visibility: inherit; overflow: scroll; float: left;</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest() {
+ var button = document.createElement('button');
+ button.setAttribute('class', 'c6');
+ document.documentElement.appendChild(button);
+ document.documentElement.appendChild(document.createElement('dfn'));
+ var figCaption = document.createElement('figcaption');
+ figCaption.setAttribute('class', 'c26');
+ document.documentElement.appendChild(document.createElement('var'));
+ document.documentElement.appendChild(document.createElement('summary'));
+ var text = document.createTextNode("bug 70183: Crash in RenderDeprecatedFlexibleBox::layoutHorizontalBox");
+ figCaption.appendChild(text);
+ button.appendChild(figCaption);
+ document.body.offsetTop;
+ document.documentElement.appendChild(document.createTextNode("If this test did not CRASH or show errors in valgrind, it has PASSED."));
+}
+window._onload_ = runTest;
+</script>
Modified: branches/chromium/874/Source/WebCore/rendering/RenderBlock.cpp (97786 => 97787)
--- branches/chromium/874/Source/WebCore/rendering/RenderBlock.cpp 2011-10-18 20:42:23 UTC (rev 97786)
+++ branches/chromium/874/Source/WebCore/rendering/RenderBlock.cpp 2011-10-18 20:44:31 UTC (rev 97787)
@@ -195,6 +195,9 @@
m_lineBoxes.deleteLineBoxes(renderArena());
+ if (UNLIKELY(gDelayedUpdateScrollInfoSet != 0))
+ gDelayedUpdateScrollInfoSet->remove(this);
+
RenderBox::willBeDestroyed();
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
