Title: [112465] branches/chromium/1025
- Revision
- 112465
- Author
- [email protected]
- Date
- 2012-03-28 16:00:31 -0700 (Wed, 28 Mar 2012)
Log Message
Merge 111263
BUG=117698
Review URL: https://chromiumcodereview.appspot.com/9887002
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/runin/run-in-layer-not-removed-crash-expected.txt (from rev 111263, trunk/LayoutTests/fast/runin/run-in-layer-not-removed-crash-expected.txt) (0 => 112465)
--- branches/chromium/1025/LayoutTests/fast/runin/run-in-layer-not-removed-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/runin/run-in-layer-not-removed-crash-expected.txt 2012-03-28 23:00:31 UTC (rev 112465)
@@ -0,0 +1,3 @@
+Webkit Bug 81265: Crash due to layer tree information not updated when moving run-in children.
+Test passes if it does not crash.
+
Copied: branches/chromium/1025/LayoutTests/fast/runin/run-in-layer-not-removed-crash.html (from rev 111263, trunk/LayoutTests/fast/runin/run-in-layer-not-removed-crash.html) (0 => 112465)
--- branches/chromium/1025/LayoutTests/fast/runin/run-in-layer-not-removed-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/runin/run-in-layer-not-removed-crash.html 2012-03-28 23:00:31 UTC (rev 112465)
@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<html>
+<body>
+Webkit Bug 81265: Crash due to layer tree information not updated when moving run-in children.<br />
+Test passes if it does not crash.
+<style>
+#test0 {
+ -webkit-perspective: 1;
+}
+#test1:nth-last-child(3n) {
+ -webkit-box-reflect: right;
+ display: run-in;
+}
+#test2 {
+ display: inline-table;
+}
+#test2:first-child {
+ -webkit-box-reflect: below;
+}
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+_onload_ = function()
+{
+ test0 = document.createElement('div');
+ test0.setAttribute('id','test0');
+ document.body.appendChild(test0);
+ test1 = document.createElement('b');
+ test1.setAttribute('id','test1');
+ document.body.appendChild(test1);
+ test2 = document.createElement('div');
+ test2.setAttribute('id','test2');
+ test1.appendChild(test2);
+ test3 = document.createElement('div');
+ document.body.appendChild(test3);
+ document.body.insertBefore(document.createElement('div'), test3);
+ document.designMode = 'on';
+ document.execCommand('selectall');
+ document.execCommand('removeFormat');
+}
+</script>
+</body>
+</html>
+
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp (112464 => 112465)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-03-28 22:56:23 UTC (rev 112464)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-03-28 23:00:31 UTC (rev 112465)
@@ -1805,7 +1805,7 @@
// Move the nodes from the old child to the new child
for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild;) {
RenderObject* nextSibling = runInChild->nextSibling();
- blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false);
+ blockRunIn->children()->removeChildNode(blockRunIn, runInChild);
inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content.
runInChild = nextSibling;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
