Diff
Copied: branches/chromium/1025/LayoutTests/fast/multicol/span/clone-before-after-content-crash-expected.txt (from rev 107613, trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash-expected.txt) (0 => 109381)
--- branches/chromium/1025/LayoutTests/fast/multicol/span/clone-before-after-content-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/multicol/span/clone-before-after-content-crash-expected.txt 2012-03-01 19:40:43 UTC (rev 109381)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/1025/LayoutTests/fast/multicol/span/clone-before-after-content-crash.html (from rev 107613, trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash.html) (0 => 109381)
--- branches/chromium/1025/LayoutTests/fast/multicol/span/clone-before-after-content-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/multicol/span/clone-before-after-content-crash.html 2012-03-01 19:40:43 UTC (rev 109381)
@@ -0,0 +1,34 @@
+<html>
+ <head>
+ <style>
+ #test1 { -webkit-column-count: 1; }
+ #test2 { display: block; }
+ #test3::after { display: block; content: "A"; }
+ #test4 { -webkit-column-span: all; }
+ </style>
+ <script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ function runTest(){
+ test1 = document.createElement('div');
+ test1.setAttribute('id', 'test1');
+ document.body.appendChild(test1);
+ test2 = document.createElement('div');
+ test2.setAttribute('id', 'test2');
+ test1.appendChild(test2);
+ test3 = document.createElement('div');
+ test3.setAttribute('id', 'test3');
+ test2.appendChild(test3);
+ test4 = document.createElement('span');
+ test4.setAttribute('id', 'test4');
+ test3.appendChild(test4);
+ document.body.offsetTop;
+ test4.style.display='block';
+ }
+ window._onload_ = runTest
+ </script>
+ </head>
+ <body>
+ Test passes if it does not crash.
+ </body>
+</html>
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp (109380 => 109381)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 19:38:39 UTC (rev 109380)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 19:40:43 UTC (rev 109381)
@@ -447,15 +447,19 @@
RenderBlock* RenderBlock::clone() const
{
RenderBlock* cloneBlock;
- if (isAnonymousBlock())
+ if (isAnonymousBlock()) {
cloneBlock = createAnonymousBlock();
+ cloneBlock->setChildrenInline(childrenInline());
+ }
else {
cloneBlock = new (renderArena()) RenderBlock(node());
cloneBlock->setStyle(style());
- if (!childrenInline() && cloneBlock->firstChild() && cloneBlock->firstChild()->isInline())
- cloneBlock->makeChildrenNonInline();
+
+ // This takes care of setting the right value of childrenInline in case
+ // generated content is added to cloneBlock and 'this' does not have
+ // generated content added yet.
+ cloneBlock->setChildrenInline(cloneBlock->firstChild() ? cloneBlock->firstChild()->isInline() : childrenInline());
}
- cloneBlock->setChildrenInline(childrenInline());
return cloneBlock;
}
@@ -494,7 +498,7 @@
cloneBlock = blockCurr->clone();
// Insert our child clone as the first child.
- cloneBlock->children()->appendChildNode(cloneBlock, cloneChild);
+ cloneBlock->addChildIgnoringContinuation(cloneChild, 0);
// Hook the clone up as a continuation of |curr|. Note we do encounter
// anonymous blocks possibly as we walk up the block chain. When we split an
@@ -885,21 +889,31 @@
return rootBox;
}
-void RenderBlock::moveChildTo(RenderBlock* to, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
+void RenderBlock::moveChildTo(RenderBlock* toBlock, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
{
ASSERT(this == child->parent());
- ASSERT(!beforeChild || to == beforeChild->parent());
- to->children()->insertChildNode(to, children()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
+ ASSERT(!beforeChild || toBlock == beforeChild->parent());
+ if (fullRemoveInsert) {
+ // Takes care of adding the new child correctly if toBlock and fromBlock
+ // have different kind of children (block vs inline).
+ toBlock->addChildIgnoringContinuation(children()->removeChildNode(this, child), beforeChild);
+ } else
+ toBlock->children()->insertChildNode(toBlock, children()->removeChildNode(this, child, false), beforeChild, false);
}
-void RenderBlock::moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
+void RenderBlock::moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
{
- ASSERT(!beforeChild || to == beforeChild->parent());
+ ASSERT(!beforeChild || toBlock == beforeChild->parent());
RenderObject* nextChild = startChild;
while (nextChild && nextChild != endChild) {
RenderObject* child = nextChild;
nextChild = child->nextSibling();
- to->children()->insertChildNode(to, children()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
+ if (fullRemoveInsert) {
+ // Takes care of adding the new child correctly if toBlock and fromBlock
+ // have different kind of children (block vs inline).
+ toBlock->addChildIgnoringContinuation(children()->removeChildNode(this, child), beforeChild);
+ } else
+ toBlock->children()->insertChildNode(toBlock, children()->removeChildNode(this, child, false), beforeChild, false);
if (child == endChild)
return;
}
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.h (109380 => 109381)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.h 2012-03-01 19:38:39 UTC (rev 109380)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.h 2012-03-01 19:40:43 UTC (rev 109381)
@@ -354,22 +354,22 @@
{
return moveChildTo(to, child, 0, fullRemoveInsert);
}
- void moveChildTo(RenderBlock* to, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
- void moveAllChildrenTo(RenderBlock* to, bool fullRemoveInsert = false)
+ void moveChildTo(RenderBlock* toBlock, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
+ void moveAllChildrenTo(RenderBlock* toBlock, bool fullRemoveInsert = false)
{
- return moveAllChildrenTo(to, 0, fullRemoveInsert);
+ return moveAllChildrenTo(toBlock, 0, fullRemoveInsert);
}
- void moveAllChildrenTo(RenderBlock* to, RenderObject* beforeChild, bool fullRemoveInsert = false)
+ void moveAllChildrenTo(RenderBlock* toBlock, RenderObject* beforeChild, bool fullRemoveInsert = false)
{
- return moveChildrenTo(to, firstChild(), 0, beforeChild, fullRemoveInsert);
+ return moveChildrenTo(toBlock, firstChild(), 0, beforeChild, fullRemoveInsert);
}
// Move all of the kids from |startChild| up to but excluding |endChild|. 0 can be passed as the endChild to denote
// that all the kids from |startChild| onwards should be added.
- void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
+ void moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
{
- return moveChildrenTo(to, startChild, endChild, 0, fullRemoveInsert);
+ return moveChildrenTo(toBlock, startChild, endChild, 0, fullRemoveInsert);
}
- void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
+ void moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
LayoutUnit maxPositiveMarginBefore() const { return m_rareData ? m_rareData->m_margins.positiveMarginBefore() : RenderBlockRareData::positiveMarginBeforeDefault(this); }
LayoutUnit maxNegativeMarginBefore() const { return m_rareData ? m_rareData->m_margins.negativeMarginBefore() : RenderBlockRareData::negativeMarginBeforeDefault(this); }
