Title: [109414] branches/chromium/963
- Revision
- 109414
- Author
- [email protected]
- Date
- 2012-03-01 13:50:18 -0800 (Thu, 01 Mar 2012)
Log Message
Merge 108194
BUG=114924
Review URL: https://chromiumcodereview.appspot.com/9568037
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/table/table-split-inside-table-expected.txt (from rev 108194, trunk/LayoutTests/fast/table/table-split-inside-table-expected.txt) (0 => 109414)
--- branches/chromium/963/LayoutTests/fast/table/table-split-inside-table-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/table/table-split-inside-table-expected.txt 2012-03-01 21:50:18 UTC (rev 109414)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/963/LayoutTests/fast/table/table-split-inside-table.html (from rev 108194, trunk/LayoutTests/fast/table/table-split-inside-table.html) (0 => 109414)
--- branches/chromium/963/LayoutTests/fast/table/table-split-inside-table.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/table/table-split-inside-table.html 2012-03-01 21:50:18 UTC (rev 109414)
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+#test1 { -webkit-column-count: 2; }
+#test4 { -webkit-column-span: all; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+window._onload_ = function() {
+ test1 = document.createElement('div');
+ test1.setAttribute('id', 'test1');
+ document.body.appendChild(test1);
+ test2 = document.createElement('div');
+ test3 = document.createElement('div');
+ test1.appendChild(test2);
+ test1.appendChild(test3);
+ test4 = document.createElement('div');
+ test4.setAttribute('id', 'test4');
+ test1.appendChild(test4);
+ test4.style.display = 'table-footer-group';
+ document.body.offsetTop
+ test3.style.display = 'table-row';
+ document.body.offsetTop;
+ test3.style.display = 'table-column-group';
+ document.body.offsetTop;
+ test3.style.display = 'table-row';
+ document.body.offsetTop;
+ test2.style.display = 'inline';
+}
+</script>
+</head>
+<body>
+Test passes if it does not crash.
+</body>
+</html>
Modified: branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp (109413 => 109414)
--- branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 21:46:30 UTC (rev 109413)
+++ branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 21:50:18 UTC (rev 109414)
@@ -653,8 +653,10 @@
{
ASSERT(beforeChild->isTablePart());
- while (beforeChild->parent() != this && !beforeChild->isTable()) {
+ while (beforeChild->parent() != this) {
RenderObject* tablePartToSplit = beforeChild->parent();
+ if (!tablePartToSplit->isTablePart() && !tablePartToSplit->isTable())
+ break;
if (tablePartToSplit->firstChild() != beforeChild) {
// Get our table container.
RenderObject* curr = tablePartToSplit;
@@ -662,7 +664,7 @@
curr = curr->parent();
RenderTable* table = toRenderTable(curr);
- // Create an anonymous table container next to our table container.
+ // Create an anonymous table container next to our table container.
RenderBlock* parentBlock = toRenderBlock(table->parent());
RenderTable* postTable = parentBlock->createAnonymousTable();
parentBlock->children()->insertChildNode(parentBlock, postTable, table->nextSibling());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
