Title: [109427] branches/chromium/963
- Revision
- 109427
- Author
- [email protected]
- Date
- 2012-03-01 14:39:34 -0800 (Thu, 01 Mar 2012)
Log Message
Merge 109011
BUG=114144
Review URL: https://chromiumcodereview.appspot.com/9566033
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/css/positioned-in-relative-position-inline-crash-expected.txt (from rev 109011, trunk/LayoutTests/fast/css/positioned-in-relative-position-inline-crash-expected.txt) (0 => 109427)
--- branches/chromium/963/LayoutTests/fast/css/positioned-in-relative-position-inline-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css/positioned-in-relative-position-inline-crash-expected.txt 2012-03-01 22:39:34 UTC (rev 109427)
@@ -0,0 +1,3 @@
+PASS, if no exception or crash in debug
+div1
+2
Copied: branches/chromium/963/LayoutTests/fast/css/positioned-in-relative-position-inline-crash.html (from rev 109011, trunk/LayoutTests/fast/css/positioned-in-relative-position-inline-crash.html) (0 => 109427)
--- branches/chromium/963/LayoutTests/fast/css/positioned-in-relative-position-inline-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css/positioned-in-relative-position-inline-crash.html 2012-03-01 22:39:34 UTC (rev 109427)
@@ -0,0 +1,37 @@
+<html>
+<style type="text/css">
+.inlineContainer {
+ position: relative;
+ display: inline;
+}
+#positioned {
+ position: absolute;
+ top: 100px;
+}
+</style>
+<script type="text/_javascript_">
+if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+}
+
+function dumpTest() {
+ if (window.layoutTestController) {
+ layoutTestController.notifyDone();
+ }
+}
+function runTest() {
+ document.getElementById('positioned').innerHTML = '2';
+ document.getElementById('positioned').style.color = 'red';
+ setTimeout('dumpTest()', 10);
+}
+setTimeout('runTest()', 0);
+</script>
+<body>
+PASS, if no exception or crash in debug
+ <div class='inlineContainer'>
+ <div>div1</div>
+ <div id='positioned'>div2</div>
+ </div>
+</body>
+</html>
Modified: branches/chromium/963/Source/WebCore/rendering/RenderObject.cpp (109426 => 109427)
--- branches/chromium/963/Source/WebCore/rendering/RenderObject.cpp 2012-03-01 22:30:47 UTC (rev 109426)
+++ branches/chromium/963/Source/WebCore/rendering/RenderObject.cpp 2012-03-01 22:39:34 UTC (rev 109427)
@@ -650,8 +650,9 @@
if (!container && !object->isRenderView())
return;
if (!last->isText() && (last->style()->position() == FixedPosition || last->style()->position() == AbsolutePosition)) {
- bool willSkipRelativelyPositionedInlines = !object->isRenderBlock();
- while (object && !object->isRenderBlock()) // Skip relatively positioned inlines and get to the enclosing RenderBlock.
+ bool willSkipRelativelyPositionedInlines = !object->isRenderBlock() || object->isAnonymousBlock();
+ // Skip relatively positioned inlines and anonymous blocks to get to the enclosing RenderBlock.
+ while (object && (!object->isRenderBlock() || object->isAnonymousBlock()))
object = object->container();
if (!object || object->m_posChildNeedsLayout)
return;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
