Diff
Copied: branches/chromium/963/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt (from rev 106150, trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt) (0 => 107333)
--- branches/chromium/963/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt 2012-02-10 01:57:26 UTC (rev 107333)
@@ -0,0 +1 @@
+PASS if no crash or assert
Copied: branches/chromium/963/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html (from rev 106150, trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html) (0 => 107333)
--- branches/chromium/963/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html 2012-02-10 01:57:26 UTC (rev 107333)
@@ -0,0 +1,34 @@
+<style>
+.inlineFL::first-letter { overflow: visible; }
+.absolutePosition { position: absolute; }
+.floatFL:first-letter { float: right; }
+</style>
+<script>
+function recreateFirstLetterBlock() {
+ document.getElementById("parent").setAttribute('class', 'inlineFL');
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+function removeDiv() {
+ // This causes the parent to only have inline (and floating) children
+ document.getElementById("parent").removeChild(document.getElementById("child"));
+ setTimeout("recreateFirstLetterBlock();", 10);
+}
+
+function changeDivStyle() {
+ document.getElementById("child").setAttribute('class', 'inlineFL');
+ setTimeout("removeDiv();", 10);
+}
+function startTest() {
+ setTimeout("changeDivStyle();", 10);
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+}
+window._onload_ = startTest;
+</script>
+<div id="parent" class="floatFL">
+ <div id="child" class="absolutePosition"></div>
+ PASS if no crash or assert
+</div>
Copied: branches/chromium/963/LayoutTests/fast/css-generated-content/positioned-div-with-floating-after-content-crash-expected.txt (from rev 106150, trunk/LayoutTests/fast/css-generated-content/positioned-div-with-floating-after-content-crash-expected.txt) (0 => 107333)
--- branches/chromium/963/LayoutTests/fast/css-generated-content/positioned-div-with-floating-after-content-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css-generated-content/positioned-div-with-floating-after-content-crash-expected.txt 2012-02-10 01:57:26 UTC (rev 107333)
@@ -0,0 +1,6 @@
+
+
+--------
+Frame: 'frame'
+--------
+PASS, if no exception or crash
Copied: branches/chromium/963/LayoutTests/fast/css-generated-content/positioned-div-with-floating-after-content-crash.html (from rev 106150, trunk/LayoutTests/fast/css-generated-content/positioned-div-with-floating-after-content-crash.html) (0 => 107333)
--- branches/chromium/963/LayoutTests/fast/css-generated-content/positioned-div-with-floating-after-content-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css-generated-content/positioned-div-with-floating-after-content-crash.html 2012-02-10 01:57:26 UTC (rev 107333)
@@ -0,0 +1,11 @@
+<script>
+function runTest() {
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ layoutTestController.dumpChildFramesAsText();
+ }
+}
+window._onload_ = runTest;
+</script>
+<iframe id="frame" src=""
Copied: branches/chromium/963/LayoutTests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame1.html (from rev 106150, trunk/LayoutTests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame1.html) (0 => 107333)
--- branches/chromium/963/LayoutTests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame1.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame1.html 2012-02-10 01:57:26 UTC (rev 107333)
@@ -0,0 +1,31 @@
+<style>
+.c1 { display: table; }
+.c1::after { position: fixed; content: counter(section); }
+.c2 { display: table-caption; float: left; }
+</style>
+<script>
+var node = document.createElement('q');
+
+function changeQClass() {
+ node.setAttribute('class', 'c1');
+ setTimeout("appendQ();", 10);
+}
+
+function appendQ() {
+ document.getElementById('positionedDiv').appendChild(node);
+ setTimeout("navigateAway();");
+}
+
+function navigateAway() {
+ // Bug only manifests on document destruction
+ window.location="positioned-div-with-floating-after-content-crash-frame2.html";
+}
+
+function runTest() {
+ setTimeout("changeQClass();", 10);
+}
+window._onload_ = runTest;
+</script>
+<div class="c2"><textarea></textarea></div>
+<div id="positionedDiv" class="c1">FAIL</div>
+<div class="c2"></div>
Copied: branches/chromium/963/LayoutTests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame2.html (from rev 106150, trunk/LayoutTests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame2.html) (0 => 107333)
--- branches/chromium/963/LayoutTests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame2.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css-generated-content/resources/positioned-div-with-floating-after-content-crash-frame2.html 2012-02-10 01:57:26 UTC (rev 107333)
@@ -0,0 +1,8 @@
+<script>
+function finishTest() {
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+window._onload_ = finishTest;
+</script>
+PASS, if no exception or crash
Modified: branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp (107332 => 107333)
--- branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-02-10 01:54:43 UTC (rev 107332)
+++ branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-02-10 01:57:26 UTC (rev 107333)
@@ -1019,6 +1019,18 @@
&& prev->isAnonymousColumnSpanBlock() == next->isAnonymousColumnSpanBlock();
}
+void RenderBlock::collapseAnonymousBoxChild(RenderBlock* parent, RenderObject* child)
+{
+ parent->setNeedsLayoutAndPrefWidthsRecalc();
+ parent->setChildrenInline(child->childrenInline());
+ RenderBlock* anonBlock = toRenderBlock(parent->children()->removeChildNode(parent, child, child->hasLayer()));
+ anonBlock->moveAllChildrenTo(parent, child->hasLayer());
+ // Delete the now-empty block's lines and nuke it.
+ if (!parent->documentBeingDestroyed())
+ anonBlock->deleteLineBoxTree();
+ anonBlock->destroy();
+}
+
void RenderBlock::removeChild(RenderObject* oldChild)
{
// If this child is a block, and if our previous and next siblings are
@@ -1075,13 +1087,17 @@
// The removal has knocked us down to containing only a single anonymous
// box. We can go ahead and pull the content right back up into our
// box.
- setNeedsLayoutAndPrefWidthsRecalc();
- setChildrenInline(child->childrenInline());
- RenderBlock* anonBlock = toRenderBlock(children()->removeChildNode(this, child, child->hasLayer()));
- anonBlock->moveAllChildrenTo(this, child->hasLayer());
- // Delete the now-empty block's lines and nuke it.
- anonBlock->deleteLineBoxTree();
- anonBlock->destroy();
+ collapseAnonymousBoxChild(this, child);
+ } else if ((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) {
+ // It's possible that the removal has knocked us down to a single anonymous
+ // block with pseudo-style element siblings (e.g. first-letter). If these
+ // are floating, then we need to pull the content up also.
+ RenderBlock* anonBlock = toRenderBlock((prev && prev->isAnonymousBlock()) ? prev : next);
+ if ((anonBlock->previousSibling() || anonBlock->nextSibling())
+ && (!anonBlock->previousSibling() || (anonBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonBlock->previousSibling()->isFloating()))
+ && (!anonBlock->nextSibling() || (anonBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonBlock->nextSibling()->isFloating()))) {
+ collapseAnonymousBoxChild(this, anonBlock);
+ }
}
if (!firstChild() && !documentBeingDestroyed()) {
Modified: branches/chromium/963/Source/WebCore/rendering/RenderBlock.h (107332 => 107333)
--- branches/chromium/963/Source/WebCore/rendering/RenderBlock.h 2012-02-10 01:54:43 UTC (rev 107332)
+++ branches/chromium/963/Source/WebCore/rendering/RenderBlock.h 2012-02-10 01:57:26 UTC (rev 107333)
@@ -449,6 +449,8 @@
void makeChildrenNonInline(RenderObject* insertionPoint = 0);
virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
+ static void collapseAnonymousBoxChild(RenderBlock* parent, RenderObject* child);
+
virtual void dirtyLinesFromChangedChild(RenderObject* child) { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
