Title: [104512] branches/safari-534.54-branch
Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104511 => 104512)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-10 00:42:31 UTC (rev 104511)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-10 00:50:10 UTC (rev 104512)
@@ -1,3 +1,19 @@
+2011-1-9 Lucas Forschler <[email protected]>
+
+ Merge 101584
+
+ 2011-11-30 Ken Buchanan <[email protected]>
+
+ Crash from first letter text fragments having flows split
+ https://bugs.webkit.org/show_bug.cgi?id=72759
+
+ Reviewed by David Hyatt.
+
+ New test for fix to crash on bug 72759.
+
+ * fast/css/first-letter-inline-flow-split-crash-expected.txt: Added
+ * fast/css/first-letter-inline-flow-split-crash.html: Added
+
2011-1-6 Lucas Forschler <[email protected]>
Merge 101091
Copied: branches/safari-534.54-branch/LayoutTests/fast/css/first-letter-inline-flow-split-crash-expected.txt (from rev 101584, trunk/LayoutTests/fast/css/first-letter-inline-flow-split-crash-expected.txt) (0 => 104512)
--- branches/safari-534.54-branch/LayoutTests/fast/css/first-letter-inline-flow-split-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css/first-letter-inline-flow-split-crash-expected.txt 2012-01-10 00:50:10 UTC (rev 104512)
@@ -0,0 +1,2 @@
+PASS, if no exception or crash observed
+
Copied: branches/safari-534.54-branch/LayoutTests/fast/css/first-letter-inline-flow-split-crash.html (from rev 101584, trunk/LayoutTests/fast/css/first-letter-inline-flow-split-crash.html) (0 => 104512)
--- branches/safari-534.54-branch/LayoutTests/fast/css/first-letter-inline-flow-split-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css/first-letter-inline-flow-split-crash.html 2012-01-10 00:50:10 UTC (rev 104512)
@@ -0,0 +1,41 @@
+<style>
+.spanStyle { float: inherit; }
+.inlineFL::first-letter { visibility: visible; }
+.floatFL { float: right; }
+.floatFL::first-letter { position: absolute; content: 'A'; }
+</style>
+PASS, if no exception or crash observed
+<script>
+parentDiv = document.createElement('div');
+childSpan = document.createElement('span');
+childDiv = document.createElement('div');
+textNode = document.createTextNode('bcd');
+
+function removeTextNode() {
+ parentDiv.removeChild(textNode);
+ delete textNode;
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+function changeClass() {
+ parentDiv.setAttribute('class', 'inlineFL');
+ setTimeout("removeTextNode()", 10);
+}
+
+function runTest() {
+ parentDiv.setAttribute('class', 'floatFL');
+ document.documentElement.appendChild(parentDiv);
+ childSpan = document.createElement('span');
+ childSpan.setAttribute('class', 'spanStyle');
+ parentDiv.appendChild(childSpan);
+ parentDiv.appendChild(textNode);
+ childSpan.appendChild(childDiv);
+ setTimeout("changeClass()", 10);
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+}
+window._onload_ = runTest;
+</script>
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104511 => 104512)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-10 00:42:31 UTC (rev 104511)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-10 00:50:10 UTC (rev 104512)
@@ -1,3 +1,22 @@
+2011-1-9 Lucas Forschler <[email protected]>
+
+ Merge 101584
+
+ 2011-11-30 Ken Buchanan <[email protected]>
+
+ Crash from first letter text fragments having flows split
+ https://bugs.webkit.org/show_bug.cgi?id=72759
+
+ Reviewed by David Hyatt.
+
+ When an inline flow is split that contains a first letter block
+ and its remaining text, it can prevent the remaining text fragment
+ from getting updated if the first letter block is replaced. This
+ patch enables the text fragment to be found and updated properly.
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::updateFirstLetterBlock):
+
2011-1-6 Lucas Forschler <[email protected]>
Merge 101091
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp (104511 => 104512)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-01-10 00:42:31 UTC (rev 104511)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-01-10 00:50:10 UTC (rev 104512)
@@ -5427,6 +5427,26 @@
}
next = next->nextSibling();
}
+ if (!remainingText && firstLetterContainer->isAnonymousBlock()) {
+ // The remaining text fragment could have been wrapped in a different anonymous block since creation
+ RenderObject* nextChild;
+ next = firstLetterContainer->nextSibling();
+ while (next && !remainingText) {
+ if (next->isAnonymousBlock()) {
+ nextChild = next->firstChild();
+ while (nextChild) {
+ if (nextChild->isText() && toRenderText(nextChild)->isTextFragment()
+ && (toRenderTextFragment(nextChild)->firstLetter() == firstLetter)) {
+ remainingText = toRenderTextFragment(nextChild);
+ break;
+ }
+ nextChild = nextChild->nextSibling();
+ }
+ } else
+ break;
+ next = next->nextSibling();
+ }
+ }
if (remainingText) {
ASSERT(remainingText->isAnonymous() || remainingText->node()->renderer() == remainingText);
// Replace the old renderer with the new one.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
