[webkit-changes] [109416] branches/chromium/1025

Thu, 01 Mar 2012 13:52:10 -0800

Title: [109416] branches/chromium/1025
Revision
109416
Author
[email protected]
Date
2012-03-01 13:52:01 -0800 (Thu, 01 Mar 2012)

Log Message

Merge 108194
BUG=114924
Review URL: https://chromiumcodereview.appspot.com/9562027


Modified Paths




Added Paths

Diff

Copied: branches/chromium/1025/LayoutTests/fast/table/table-split-inside-table-expected.txt (from rev 108194, trunk/LayoutTests/fast/table/table-split-inside-table-expected.txt) (0 => 109416)


--- branches/chromium/1025/LayoutTests/fast/table/table-split-inside-table-expected.txt	                        (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/table/table-split-inside-table-expected.txt	2012-03-01 21:52:01 UTC (rev 109416)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+

Copied: branches/chromium/1025/LayoutTests/fast/table/table-split-inside-table.html (from rev 108194, trunk/LayoutTests/fast/table/table-split-inside-table.html) (0 => 109416)


--- branches/chromium/1025/LayoutTests/fast/table/table-split-inside-table.html	                        (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/table/table-split-inside-table.html	2012-03-01 21:52:01 UTC (rev 109416)
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+#test1 { -webkit-column-count: 2; }
+#test4 { -webkit-column-span: all; }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+window._onload_ = function() {
+	test1 = document.createElement('div');
+	test1.setAttribute('id', 'test1');
+	document.body.appendChild(test1); 
+	test2 = document.createElement('div');
+	test3 = document.createElement('div');
+	test1.appendChild(test2);
+	test1.appendChild(test3);
+	test4 = document.createElement('div'); 
+	test4.setAttribute('id', 'test4');
+	test1.appendChild(test4);
+	test4.style.display = 'table-footer-group';
+	document.body.offsetTop
+	test3.style.display = 'table-row';
+	document.body.offsetTop;
+	test3.style.display = 'table-column-group';
+	document.body.offsetTop;
+	test3.style.display = 'table-row';
+	document.body.offsetTop;
+	test2.style.display = 'inline';
+}
+</script>
+</head>
+<body>
+Test passes if it does not crash.
+</body>
+</html>

Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp (109415 => 109416)


--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp	2012-03-01 21:51:26 UTC (rev 109415)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp	2012-03-01 21:52:01 UTC (rev 109416)
@@ -659,8 +659,10 @@
 {
     ASSERT(beforeChild->isTablePart());
 
-    while (beforeChild->parent() != this && !beforeChild->isTable()) {
+    while (beforeChild->parent() != this) {
         RenderObject* tablePartToSplit = beforeChild->parent();
+        if (!tablePartToSplit->isTablePart() && !tablePartToSplit->isTable())
+            break;
         if (tablePartToSplit->firstChild() != beforeChild) {
             // Get our table container.
             RenderObject* curr = tablePartToSplit;
@@ -668,7 +670,7 @@
                 curr = curr->parent();
             RenderTable* table = toRenderTable(curr);
 
-            // Create an anonymous table container next to our table container. 
+            // Create an anonymous table container next to our table container.
             RenderBlock* parentBlock = toRenderBlock(table->parent());
             RenderTable* postTable = parentBlock->createAnonymousTable();
             parentBlock->children()->insertChildNode(parentBlock, postTable, table->nextSibling());

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to