Title: [107325] branches/chromium/963
- Revision
- 107325
- Author
- [email protected]
- Date
- 2012-02-09 17:36:54 -0800 (Thu, 09 Feb 2012)
Log Message
Merge 106968
BUG=112847
Review URL: https://chromiumcodereview.appspot.com/9375039
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/multicol/span/split-inline-wrong-post-block-crash-expected.txt (from rev 106968, trunk/LayoutTests/fast/multicol/span/split-inline-wrong-post-block-crash-expected.txt) (0 => 107325)
--- branches/chromium/963/LayoutTests/fast/multicol/span/split-inline-wrong-post-block-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/span/split-inline-wrong-post-block-crash-expected.txt 2012-02-10 01:36:54 UTC (rev 107325)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/963/LayoutTests/fast/multicol/span/split-inline-wrong-post-block-crash.html (from rev 106968, trunk/LayoutTests/fast/multicol/span/split-inline-wrong-post-block-crash.html) (0 => 107325)
--- branches/chromium/963/LayoutTests/fast/multicol/span/split-inline-wrong-post-block-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/span/split-inline-wrong-post-block-crash.html 2012-02-10 01:36:54 UTC (rev 107325)
@@ -0,0 +1,27 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest() {
+ var container = document.createElement('div');
+ container.style['-webkit-column-count'] = 1;
+ document.body.appendChild(container);
+ var test1 = document.createElement('div');
+ test1.style['-webkit-column-span'] = 'all';
+ container.appendChild(test1);
+ var test2 = document.createElement('span');
+ container.appendChild(test2);
+ test2.appendChild(document.createElement('div'));
+ var test3 = document.createElement('div');
+ test3.style.display = 'table-column';
+ container.appendChild(test3);
+ container.appendChild(document.createElement('div'));
+}
+</script>
+</head>
+<body _onload_="runTest()">
+Test passes if it does not crash.
+</body>
+</html>
Modified: branches/chromium/963/Source/WebCore/rendering/RenderInline.cpp (107324 => 107325)
--- branches/chromium/963/Source/WebCore/rendering/RenderInline.cpp 2012-02-10 01:24:14 UTC (rev 107324)
+++ branches/chromium/963/Source/WebCore/rendering/RenderInline.cpp 2012-02-10 01:36:54 UTC (rev 107325)
@@ -385,7 +385,7 @@
madeNewBeforeBlock = true;
}
- RenderBlock* post = block->createAnonymousBlock();
+ RenderBlock* post = block->createAnonymousBlockWithSameTypeAs(pre);
RenderObject* boxFirst = madeNewBeforeBlock ? block->firstChild() : pre->nextSibling();
if (madeNewBeforeBlock)
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
