Copied: branches/chromium/1025/LayoutTests/fast/multicol/anonymous-block-split-crash-expected.txt (from rev 110324, trunk/LayoutTests/fast/multicol/anonymous-block-split-crash-expected.txt) (0 => 110461)
--- branches/chromium/1025/LayoutTests/fast/multicol/anonymous-block-split-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/multicol/anonymous-block-split-crash-expected.txt 2012-03-12 19:52:26 UTC (rev 110461)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/1025/LayoutTests/fast/multicol/anonymous-block-split-crash.html (from rev 110324, trunk/LayoutTests/fast/multicol/anonymous-block-split-crash.html) (0 => 110461)
--- branches/chromium/1025/LayoutTests/fast/multicol/anonymous-block-split-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/multicol/anonymous-block-split-crash.html 2012-03-12 19:52:26 UTC (rev 110461)
@@ -0,0 +1,43 @@
+<html>
+<head>
+<style>
+#test0 { -webkit-column-count: 2; }
+#test1::after { display: block; content: ''; }
+#test2:nth-last-child(2n) { content: ''; }
+#test2 { -webkit-column-span: all; }
+#test4 { float: right; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+_onload_ = function() {
+ test0 = document.createElement('div');
+ test0.setAttribute('id', 'test0');
+ document.body.appendChild(test0);
+ test1 = document.createElement('div');
+ test1.setAttribute('id', 'test1');
+ test0.appendChild(test1);
+ test2 = document.createElement('div');
+ test2.setAttribute('id', 'test2');
+ test1.appendChild(test2);
+ test3 = document.createElement('span');
+ test1.appendChild(test3);
+ test3.appendChild(document.createTextNode('A'));
+ test4 = document.createElement('table');
+ test4.setAttribute('id', 'test4');
+ test1.appendChild(test4);
+ test0.style.display = 'run-in';
+ test4.style.display = 'table-column';
+ document.body.offsetTop;
+ document.designMode = 'on';
+ document.execCommand('selectall');
+ document.execCommand('inserttext', '');
+ document.body.offsetTop;
+ document.body.innerHTML = "PASS";
+}
+</script>
+</head>
+<body>
+</body>
+</html>
\ No newline at end of file
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp (110460 => 110461)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-03-12 19:50:34 UTC (rev 110460)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-03-12 19:52:26 UTC (rev 110461)
@@ -521,6 +521,7 @@
// Once we hit the anonymous columns block we're done.
RenderBoxModelObject* curr = toRenderBoxModelObject(parent());
RenderBoxModelObject* currChild = this;
+ RenderObject* currChildNextSibling = currChild->nextSibling();
while (curr && curr != fromBlock) {
ASSERT(curr->isRenderBlock());
@@ -547,15 +548,20 @@
// Someone may have indirectly caused a <q> to split. When this happens, the :after content
// has to move into the inline continuation. Call updateBeforeAfterContent to ensure that the inline's :after
// content gets properly destroyed.
+ bool isLastChild = (currChildNextSibling == blockCurr->lastChild());
if (document()->usesBeforeAfterRules())
blockCurr->children()->updateBeforeAfterContent(blockCurr, AFTER);
+ if (isLastChild && currChildNextSibling != blockCurr->lastChild())
+ currChildNextSibling = 0; // We destroyed the last child, so now we need to update
+ // the value of currChildNextSibling.
// Now we need to take all of the children starting from the first child
// *after* currChild and append them all to the clone.
- blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, true);
+ blockCurr->moveChildrenTo(cloneBlock, currChildNextSibling, 0, true);
// Keep walking up the chain.
currChild = curr;
+ currChildNextSibling = currChild->nextSibling();
curr = toRenderBoxModelObject(curr->parent());
}
@@ -564,7 +570,7 @@
// Now take all the children after currChild and remove them from the fromBlock
// and put them in the toBlock.
- fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0, true);
+ fromBlock->moveChildrenTo(toBlock, currChildNextSibling, 0, true);
}
void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
