Title: [104498] branches/safari-534.54-branch
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104497 => 104498)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-09 23:16:09 UTC (rev 104497)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-09 23:23:43 UTC (rev 104498)
@@ -1,5 +1,21 @@
2011-1-6 Lucas Forschler <[email protected]>
+ Merge 100677
+
+ 2011-11-17 Ken Buchanan <[email protected]>
+
+ Crash from positioned generated content under run-in
+ https://bugs.webkit.org/show_bug.cgi?id=70456
+
+ Reviewed by David Hyatt.
+
+ Layout test for crash condition.
+
+ * fast/css-generated-content/positioned-generated-content-under-run-in-crash-expected.html: Added
+ * fast/css-generated-content/positioned-generated-content-under-run-in-crash.html: Added
+
+2011-1-6 Lucas Forschler <[email protected]>
+
Merge 100630
2011-11-17 Ken Buchanan <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash-expected.txt (from rev 100677, trunk/LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash-expected.txt) (0 => 104498)
--- branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash-expected.txt 2012-01-09 23:23:43 UTC (rev 104498)
@@ -0,0 +1,2 @@
+PASS, if no exceptions or crash observed
+
Copied: branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash.html (from rev 100677, trunk/LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash.html) (0 => 104498)
--- branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/positioned-generated-content-under-run-in-crash.html 2012-01-09 23:23:43 UTC (rev 104498)
@@ -0,0 +1,22 @@
+<style>
+.testclass::before { position: absolute; content: ""; }
+.testclass { display: run-in; }
+</style>
+PASS, if no exceptions or crash observed
+<script>
+function runTest()
+{
+ test1 = document.createElement('div');
+ test1.setAttribute('class', 'testclass');
+ document.documentElement.appendChild(test1);
+ test2 = document.createElement('b');
+ test2.setAttribute('class', 'testclass');
+ document.documentElement.appendChild(test2);
+ test3 = document.createElement('div');
+ document.documentElement.appendChild(test3);
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+}
+window._onload_ = runTest;
+</script>
+
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104497 => 104498)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-09 23:16:09 UTC (rev 104497)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-09 23:23:43 UTC (rev 104498)
@@ -1,5 +1,24 @@
2011-1-6 Lucas Forschler <[email protected]>
+ Merge 100677
+
+ 2011-11-17 Ken Buchanan <[email protected]>
+
+ Crash from positioned generated content under run-in
+ https://bugs.webkit.org/show_bug.cgi?id=70456
+
+ Reviewed by David Hyatt.
+
+ Modified handling of run-in children to clear generated children
+ before removing the parent from the render tree. This caused problems
+ with absolute positioned children being not properly removed from the
+ positioned object list of the RenderView.
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::handleRunInChild):
+
+2011-1-6 Lucas Forschler <[email protected]>
+
Merge 100630
2011-11-17 Ken Buchanan <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp (104497 => 104498)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-01-09 23:16:09 UTC (rev 104497)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-01-09 23:23:43 UTC (rev 104498)
@@ -1557,6 +1557,16 @@
RenderBlock* currBlock = toRenderBlock(curr);
+ // First we destroy any :before/:after content. It will be regenerated by the new inline.
+ // Exception is if the run-in itself is generated.
+ if (child->style()->styleType() != BEFORE && child->style()->styleType() != AFTER) {
+ RenderObject* generatedContent;
+ if (child->getCachedPseudoStyle(BEFORE) && (generatedContent = child->beforePseudoElementRenderer()))
+ generatedContent->destroy();
+ if (child->getCachedPseudoStyle(AFTER) && (generatedContent = child->afterPseudoElementRenderer()))
+ generatedContent->destroy();
+ }
+
// Remove the old child.
children()->removeChildNode(this, blockRunIn);
@@ -1565,16 +1575,11 @@
RenderInline* inlineRunIn = new (renderArena()) RenderInline(runInNode ? runInNode : document());
inlineRunIn->setStyle(blockRunIn->style());
- bool runInIsGenerated = child->style()->styleType() == BEFORE || child->style()->styleType() == AFTER;
-
- // Move the nodes from the old child to the new child, but skip any :before/:after content. It has already
- // been regenerated by the new inline.
+ // Move the nodes from the old child to the new child
for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild;) {
RenderObject* nextSibling = runInChild->nextSibling();
- if (runInIsGenerated || (runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER)) {
- blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
- inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
- }
+ blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
+ inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
runInChild = nextSibling;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
