Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104513 => 104514)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-10 00:55:41 UTC (rev 104513)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-10 01:00:23 UTC (rev 104514)
@@ -1,5 +1,21 @@
2011-1-9 Lucas Forschler <[email protected]>
+ Merge 102263
+
+ 2011-12-07 Ken Buchanan <[email protected]>
+
+ Crash from multicol spans with layers
+ https://bugs.webkit.org/show_bug.cgi?id=68030
+
+ Reviewed by David Hyatt.
+
+ New test for fix to crash on bug 68030.
+
+ * fast/multicol/span/removal-of-multicol-span-crash-expected.txt: Added
+ * fast/multicol/span/removal-of-multicol-span-crash.html: Added
+
+2011-1-9 Lucas Forschler <[email protected]>
+
Merge 101584
2011-11-30 Ken Buchanan <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt (from rev 102263, trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt) (0 => 104514)
--- branches/safari-534.54-branch/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt 2012-01-10 01:00:23 UTC (rev 104514)
@@ -0,0 +1 @@
+PASS, if no exception or crash
Copied: branches/safari-534.54-branch/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html (from rev 102263, trunk/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html) (0 => 104514)
--- branches/safari-534.54-branch/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html 2012-01-10 01:00:23 UTC (rev 104514)
@@ -0,0 +1,24 @@
+<style>
+body { -webkit-column-width: 0; }
+#container { position: relative; }
+.hardware:last-of-type { -webkit-column-span: all; }
+</style>
+
+<script>
+ function clear() {
+ document.documentElement.removeChild(document.body);
+ document.documentElement.innerHTML='PASS, if no exception or crash';
+ if (window.layoutTestController) {
+ layoutTestController.notifyDone();
+ }
+ }
+ setTimeout("clear();", 0);
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+</script>
+<body>
+<div id="container">
+ <div class="hardware box">
+</body>
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104513 => 104514)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-10 00:55:41 UTC (rev 104513)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-10 01:00:23 UTC (rev 104514)
@@ -1,5 +1,23 @@
2011-1-9 Lucas Forschler <[email protected]>
+ Merge 102263
+
+ 2011-12-07 Ken Buchanan <[email protected]>
+
+ Crash from multicol spans with layers
+ https://bugs.webkit.org/show_bug.cgi?id=68030
+
+ Reviewed by David Hyatt.
+
+ The layer tree diverges from the render tree when a span is being split
+ between columns. This patch causes the layer tree to be updated when necessary.
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::splitFlow)
+ (WebCore::RenderBlock::splitBlocks)
+
+2011-1-9 Lucas Forschler <[email protected]>
+
Merge 102016
2011-12-05 Steve Falkenburg <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp (104513 => 104514)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-01-10 00:55:41 UTC (rev 104513)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-01-10 01:00:23 UTC (rev 104514)
@@ -444,7 +444,7 @@
// them from |this| and place them in the clone.
if (!beforeChild && isAfterContent(lastChild()))
beforeChild = lastChild();
- moveChildrenTo(cloneBlock, beforeChild, 0);
+ moveChildrenTo(cloneBlock, beforeChild, 0, true);
// Hook |clone| up as the continuation of the middle block.
if (!cloneBlock->isAnonymousBlock())
@@ -486,8 +486,7 @@
// Now we need to take all of the children starting from the first child
// *after* currChild and append them all to the clone.
- RenderObject* afterContent = isAfterContent(cloneBlock->lastChild()) ? cloneBlock->lastChild() : 0;
- blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, afterContent);
+ blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, true);
// Keep walking up the chain.
currChild = curr;
@@ -499,7 +498,7 @@
// Now take all the children after currChild and remove them from the fromBlock
// and put them in the toBlock.
- fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0);
+ fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0, true);
}
void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
@@ -535,7 +534,7 @@
block->setChildrenInline(false);
if (madeNewBeforeBlock)
- block->moveChildrenTo(pre, boxFirst, 0);
+ block->moveChildrenTo(pre, boxFirst, 0, true);
splitBlocks(pre, post, newBlockBox, beforeChild, oldCont);
