Title: [109399] branches/chromium/963
- Revision
- 109399
- Author
- [email protected]
- Date
- 2012-03-01 12:49:14 -0800 (Thu, 01 Mar 2012)
Log Message
Merge 107987
BUG=113799
Review URL: https://chromiumcodereview.appspot.com/9569026
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/multicol/span/table-multi-column-crash-expected.txt (from rev 107987, trunk/LayoutTests/fast/multicol/span/table-multi-column-crash-expected.txt) (0 => 109399)
--- branches/chromium/963/LayoutTests/fast/multicol/span/table-multi-column-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/span/table-multi-column-crash-expected.txt 2012-03-01 20:49:14 UTC (rev 109399)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/963/LayoutTests/fast/multicol/span/table-multi-column-crash.html (from rev 107987, trunk/LayoutTests/fast/multicol/span/table-multi-column-crash.html) (0 => 109399)
--- branches/chromium/963/LayoutTests/fast/multicol/span/table-multi-column-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/span/table-multi-column-crash.html 2012-03-01 20:49:14 UTC (rev 109399)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<body>
+Test passes if it does not crash.
+<style>
+.table_span { -webkit-column-span: all;}
+.table_container { -webkit-column-count: 2; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+document.body.offsetTop;
+table_span = document.createElement('table');
+table_span.setAttribute('class', 'table_span');
+table_container = document.createElement('table');
+table_container.setAttribute('class', 'table_container');
+table_caption = document.createElement('caption');
+table_caption.appendChild(table_span);
+table_container.appendChild(table_caption);
+document.body.appendChild(table_container);
+document.body.offsetTop;
+
+table_caption.parentNode.removeChild(table_caption);
+</script>
+</body>
+</html>
Modified: branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp (109398 => 109399)
--- branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 20:45:26 UTC (rev 109398)
+++ branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 20:49:14 UTC (rev 109399)
@@ -428,6 +428,12 @@
if (!curr->isRenderBlock() || curr->isFloatingOrPositioned() || curr->isTableCell() || curr->isRoot() || curr->isRenderView() || curr->hasOverflowClip()
|| curr->isInlineBlockOrInlineTable())
return 0;
+
+ // FIXME: Table manages its own table parts, most of which are RenderBoxes.
+ // Multi-column code cannot handle splitting the flow in table. Disabling it
+ // to prevent crashes.
+ if (curr->isTable())
+ return 0;
RenderBlock* currBlock = toRenderBlock(curr);
if (!currBlock->createsAnonymousWrapper())
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
