Title: [109425] branches/chromium/963
- Revision
- 109425
- Author
- [email protected]
- Date
- 2012-03-01 14:28:11 -0800 (Thu, 01 Mar 2012)
Log Message
Merge 108875
BUG=113800
Review URL: https://chromiumcodereview.appspot.com/9569036
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash-expected.txt (from rev 108875, trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash-expected.txt) (0 => 109425)
--- branches/chromium/963/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash-expected.txt 2012-03-01 22:28:11 UTC (rev 109425)
@@ -0,0 +1,3 @@
+Test passes if it does not crash.
+
+
Copied: branches/chromium/963/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash.html (from rev 108875, trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash.html) (0 => 109425)
--- branches/chromium/963/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash.html 2012-03-01 22:28:11 UTC (rev 109425)
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<body>
+Test passes if it does not crash.
+<style>
+.caption1 { -webkit-column-width: 1px; }
+.div1 { position: absolute; }
+.keygen1:nth-last-child(even) { display: block; -webkit-column-span: all; }
+.flexbox1 { display: -webkit-flexbox; padding-right: 10px; -webkit-transform: rotate3d(0, 1, 0, 90deg); }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest() {
+ caption1 = document.createElement('caption');
+ caption1.setAttribute('class', 'caption1');
+ div1 = document.createElement('div');
+ div1.setAttribute('class', 'div1');
+ flexbox1 = document.createElement('div');
+ flexbox1.setAttribute('class', 'flexbox1');
+ keygen1 = document.createElement('keygen');
+ keygen1.setAttribute('class', 'keygen1');
+
+ div2 = document.createElement('div');
+ div3 = document.createElement('div');
+
+ flexbox1.appendChild(keygen1);
+ flexbox1.appendChild(div1);
+ flexbox1.appendChild(div3);
+ caption1.appendChild(flexbox1);
+ document.body.appendChild(caption1);
+ document.body.offsetTop;
+ flexbox1.appendChild(div2);
+ document.body.offsetTop;
+ flexbox1.removeChild(div1);
+}
+window._onload_ = runTest;
+</script>
+</body>
+</html>
Modified: branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp (109424 => 109425)
--- branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 22:24:52 UTC (rev 109424)
+++ branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 22:28:11 UTC (rev 109425)
@@ -485,6 +485,14 @@
if (beforeChild && childrenInline())
deleteLineBoxTree();
+ // We have to remove the descendant child from our positioned objects list
+ // before we do the split and move some of the children to cloneBlock. Since
+ // we are doing layout anyway, it is easier to blow away the entire list, than
+ // traversing down the subtree looking for positioned childs and then remove them
+ // from our positioned objects list.
+ if (beforeChild)
+ removePositionedObjects(0);
+
// Now take all of the children from beforeChild to the end and remove
// them from |this| and place them in the clone.
moveChildrenTo(cloneBlock, beforeChild, 0, true);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
