Title: [109432] branches/chromium/963
- Revision
- 109432
- Author
- [email protected]
- Date
- 2012-03-01 14:47:41 -0800 (Thu, 01 Mar 2012)
Log Message
Merge 109124
BUG=116027
Review URL: https://chromiumcodereview.appspot.com/9573003
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash-expected.txt (from rev 109124, trunk/LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash-expected.txt) (0 => 109432)
--- branches/chromium/963/LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash-expected.txt 2012-03-01 22:47:41 UTC (rev 109432)
@@ -0,0 +1 @@
+PASS if no crash or assert in debug
Copied: branches/chromium/963/LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash.html (from rev 109124, trunk/LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash.html) (0 => 109432)
--- branches/chromium/963/LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/css-generated-content/floating-before-content-with-list-marker-crash.html 2012-03-01 22:47:41 UTC (rev 109432)
@@ -0,0 +1,19 @@
+<style>
+.floatingBefore::before { overflow: visible; float: left; content: open-quote; }
+</style>
+<script>
+tbodyElement = document.createElement('tbody');
+listItemElement = document.createElement('li');
+listItemElement.setAttribute('class', 'floatingBefore');
+document.documentElement.appendChild(listItemElement);
+headerElement = document.createElement('header');
+listItemElement.appendChild(headerElement);
+listItemElement.appendChild(document.createElement('sub'));
+document.documentElement.offsetHeight;
+tbodyElement.appendChild(headerElement);
+
+document.documentElement.appendChild(document.createTextNode('PASS if no crash or assert in debug'));
+
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
Modified: branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp (109431 => 109432)
--- branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 22:42:44 UTC (rev 109431)
+++ branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-03-01 22:47:41 UTC (rev 109432)
@@ -1210,8 +1210,8 @@
// are floating, then we need to pull the content up also.
RenderBlock* anonBlock = toRenderBlock((prev && prev->isAnonymousBlock()) ? prev : next);
if ((anonBlock->previousSibling() || anonBlock->nextSibling())
- && (!anonBlock->previousSibling() || (anonBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonBlock->previousSibling()->isFloating()))
- && (!anonBlock->nextSibling() || (anonBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonBlock->nextSibling()->isFloating()))) {
+ && (!anonBlock->previousSibling() || (anonBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonBlock->previousSibling()->isFloating() && !anonBlock->previousSibling()->previousSibling()))
+ && (!anonBlock->nextSibling() || (anonBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonBlock->nextSibling()->isFloating() && !anonBlock->nextSibling()->nextSibling()))) {
collapseAnonymousBoxChild(this, anonBlock);
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
