Title: [107336] branches/chromium/1025
- Revision
- 107336
- Author
- [email protected]
- Date
- 2012-02-09 18:13:08 -0800 (Thu, 09 Feb 2012)
Log Message
Merge 106744
BUG=104317
Review URL: https://chromiumcodereview.appspot.com/9374042
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash-expected.txt (from rev 106744, trunk/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash-expected.txt) (0 => 107336)
--- branches/chromium/1025/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash-expected.txt 2012-02-10 02:13:08 UTC (rev 107336)
@@ -0,0 +1 @@
+PASS if no exception or crash
Copied: branches/chromium/1025/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash.html (from rev 106744, trunk/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash.html) (0 => 107336)
--- branches/chromium/1025/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash.html 2012-02-10 02:13:08 UTC (rev 107336)
@@ -0,0 +1,18 @@
+<style>
+.c1::after { float: left; content: open-quote; }
+.c1:first-letter { display: table-column; }
+.c1[class~="c1"] { display: -webkit-inline-box; }
+</style>
+<script>
+var parentDiv = document.createElement('div');
+var childDiv = document.createElement('div');
+
+parentDiv.setAttribute('class', 'c1');
+document.documentElement.appendChild(parentDiv);
+parentDiv.appendChild(childDiv);
+parentDiv.appendChild(document.createTextNode('PASS if no exception or crash'));
+document.documentElement.offsetHeight; // forces a layout
+parentDiv.removeChild(childDiv);
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp (107335 => 107336)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-02-10 02:10:13 UTC (rev 107335)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-02-10 02:13:08 UTC (rev 107336)
@@ -1024,8 +1024,9 @@
{
parent->setNeedsLayoutAndPrefWidthsRecalc();
parent->setChildrenInline(child->childrenInline());
+ RenderObject* nextSibling = child->nextSibling();
RenderBlock* anonBlock = toRenderBlock(parent->children()->removeChildNode(parent, child, child->hasLayer()));
- anonBlock->moveAllChildrenTo(parent, child->hasLayer());
+ anonBlock->moveAllChildrenTo(parent, nextSibling, child->hasLayer());
// Delete the now-empty block's lines and nuke it.
if (!parent->documentBeingDestroyed())
anonBlock->deleteLineBoxTree();
@@ -1089,7 +1090,7 @@
// box. We can go ahead and pull the content right back up into our
// box.
collapseAnonymousBoxChild(this, child);
- } else if ((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) {
+ } else if (((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) && !isFlexibleBoxIncludingDeprecated()) {
// It's possible that the removal has knocked us down to a single anonymous
// block with pseudo-style element siblings (e.g. first-letter). If these
// are floating, then we need to pull the content up also.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
