Title: [105790] branches/chromium/963
- Revision
- 105790
- Author
- [email protected]
- Date
- 2012-01-24 13:12:05 -0800 (Tue, 24 Jan 2012)
Log Message
Merge 105750 - Crash when accessing removed parent in InlineTextBox.
BUG=105157
Review URL: https://chromiumcodereview.appspot.com/9160034
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/block/block-remove-child-delete-line-box-crash-expected.txt (from rev 105750, trunk/LayoutTests/fast/block/block-remove-child-delete-line-box-crash-expected.txt) (0 => 105790)
--- branches/chromium/963/LayoutTests/fast/block/block-remove-child-delete-line-box-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/block/block-remove-child-delete-line-box-crash-expected.txt 2012-01-24 21:12:05 UTC (rev 105790)
@@ -0,0 +1,5 @@
+BeforeText
+heading
+
+SpanTextAfterText
+ParaText
Copied: branches/chromium/963/LayoutTests/fast/block/block-remove-child-delete-line-box-crash.html (from rev 105750, trunk/LayoutTests/fast/block/block-remove-child-delete-line-box-crash.html) (0 => 105790)
--- branches/chromium/963/LayoutTests/fast/block/block-remove-child-delete-line-box-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/block/block-remove-child-delete-line-box-crash.html 2012-01-24 21:12:05 UTC (rev 105790)
@@ -0,0 +1,23 @@
+<html>
+<style>
+div { -webkit-column-count:2; }
+h1 { -webkit-column-span: all; }
+</style>
+<body>
+<summary>
+<div id="div1">
+BeforeText<span id="span1">SpanText</span>AfterText
+<p>ParaText</p>
+</div>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+document.body.offsetTop;
+var h1 = document.createElement('h1');
+h1.appendChild(document.createTextNode('heading'));
+div1.insertBefore(h1, span1);
+</script>
+</summary>
+</body>
+</html>
\ No newline at end of file
Modified: branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp (105789 => 105790)
--- branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-01-24 21:09:28 UTC (rev 105789)
+++ branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-01-24 21:12:05 UTC (rev 105790)
@@ -1085,7 +1085,7 @@
if (!firstChild() && !documentBeingDestroyed()) {
// If this was our last child be sure to clear out our line boxes.
if (childrenInline())
- lineBoxes()->deleteLineBoxes(renderArena());
+ deleteLineBoxTree();
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
