Modified: trunk/LayoutTests/ChangeLog (102262 => 102263)
--- trunk/LayoutTests/ChangeLog 2011-12-07 19:53:37 UTC (rev 102262)
+++ trunk/LayoutTests/ChangeLog 2011-12-07 20:01:27 UTC (rev 102263)
@@ -1,3 +1,15 @@
+2011-12-07 Ken Buchanan <[email protected]>
+
+ Crash from multicol spans with layers
+ https://bugs.webkit.org/show_bug.cgi?id=68030
+
+ Reviewed by David Hyatt.
+
+ New test for fix to crash on bug 68030.
+
+ * fast/multicol/span/removal-of-multicol-span-crash-expected.txt: Added
+ * fast/multicol/span/removal-of-multicol-span-crash.html: Added
+
2011-12-07 Alexey Proskuryakov <[email protected]>
Handling of !important in inline style sets is broken
Property changes on: trunk/LayoutTests/ChangeLog
___________________________________________________________________
Added: trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt (0 => 102263)
--- trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt 2011-12-07 20:01:27 UTC (rev 102263)
@@ -0,0 +1 @@
+PASS, if no exception or crash
Property changes on: trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt
___________________________________________________________________
Added: trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html (0 => 102263)
--- trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html 2011-12-07 20:01:27 UTC (rev 102263)
@@ -0,0 +1,24 @@
+<style>
+body { -webkit-column-width: 0; }
+#container { position: relative; }
+.hardware:last-of-type { -webkit-column-span: all; }
+</style>
+
+<script>
+ function clear() {
+ document.documentElement.removeChild(document.body);
+ document.documentElement.innerHTML='PASS, if no exception or crash';
+ if (window.layoutTestController) {
+ layoutTestController.notifyDone();
+ }
+ }
+ setTimeout("clear();", 0);
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+</script>
+<body>
+<div id="container">
+ <div class="hardware box">
+</body>
Property changes on: trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html
___________________________________________________________________
Modified: trunk/Source/WebCore/ChangeLog (102262 => 102263)
--- trunk/Source/WebCore/ChangeLog 2011-12-07 19:53:37 UTC (rev 102262)
+++ trunk/Source/WebCore/ChangeLog 2011-12-07 20:01:27 UTC (rev 102263)
@@ -1,3 +1,17 @@
+2011-12-07 Ken Buchanan <[email protected]>
+
+ Crash from multicol spans with layers
+ https://bugs.webkit.org/show_bug.cgi?id=68030
+
+ Reviewed by David Hyatt.
+
+ The layer tree diverges from the render tree when a span is being split
+ between columns. This patch causes the layer tree to be updated when necessary.
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::splitFlow)
+ (WebCore::RenderBlock::splitBlocks)
+
2011-12-07 Alexey Proskuryakov <[email protected]>
Handling of !important in inline style sets is broken
Property changes on: trunk/Source/WebCore/ChangeLog
___________________________________________________________________
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (102262 => 102263)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2011-12-07 19:53:37 UTC (rev 102262)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2011-12-07 20:01:27 UTC (rev 102263)
@@ -464,7 +464,7 @@
// them from |this| and place them in the clone.
if (!beforeChild && isAfterContent(lastChild()))
beforeChild = lastChild();
- moveChildrenTo(cloneBlock, beforeChild, 0);
+ moveChildrenTo(cloneBlock, beforeChild, 0, true);
// Hook |clone| up as the continuation of the middle block.
if (!cloneBlock->isAnonymousBlock())
@@ -506,8 +506,7 @@
// Now we need to take all of the children starting from the first child
// *after* currChild and append them all to the clone.
- RenderObject* afterContent = isAfterContent(cloneBlock->lastChild()) ? cloneBlock->lastChild() : 0;
- blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, afterContent);
+ blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, true);
// Keep walking up the chain.
currChild = curr;
@@ -519,7 +518,7 @@
// Now take all the children after currChild and remove them from the fromBlock
// and put them in the toBlock.
- fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0);
+ fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0, true);
}
void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
@@ -555,7 +554,7 @@
block->setChildrenInline(false);
if (madeNewBeforeBlock)
- block->moveChildrenTo(pre, boxFirst, 0);
+ block->moveChildrenTo(pre, boxFirst, 0, true);
splitBlocks(pre, post, newBlockBox, beforeChild, oldCont);
