Title: [112605] branches/chromium/1025
- Revision
- 112605
- Author
- [email protected]
- Date
- 2012-03-29 16:37:19 -0700 (Thu, 29 Mar 2012)
Log Message
Merge 111899
BUG=117728
Review URL: https://chromiumcodereview.appspot.com/9930007
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/editing/selection/clear-selection-crash-expected.txt (from rev 111899, trunk/LayoutTests/editing/selection/clear-selection-crash-expected.txt) (0 => 112605)
--- branches/chromium/1025/LayoutTests/editing/selection/clear-selection-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/editing/selection/clear-selection-crash-expected.txt 2012-03-29 23:37:19 UTC (rev 112605)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Copied: branches/chromium/1025/LayoutTests/editing/selection/clear-selection-crash.html (from rev 111899, trunk/LayoutTests/editing/selection/clear-selection-crash.html) (0 => 112605)
--- branches/chromium/1025/LayoutTests/editing/selection/clear-selection-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/editing/selection/clear-selection-crash.html 2012-03-29 23:37:19 UTC (rev 112605)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: -webkit-inline-box">
+ <div id="start" style="display: -webkit-inline-box">
+ <i>
+ <div style="display: run-in; height: 1px"></div>
+ <span id="span1" style="width: 1px">A</span>
+ </i>
+ </div>
+ <i>B</i>
+</div>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+document.body.offsetTop;
+document.designMode = 'on';
+document.execCommand('selectall');
+document.body.offsetTop;
+span1.style.display = 'block';
+
+document.body.offsetTop;
+document.body.innerHTML = "PASS. WebKit didn't crash.";
+</script>
+</body>
+</html>
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderObject.cpp (112604 => 112605)
--- branches/chromium/1025/Source/WebCore/rendering/RenderObject.cpp 2012-03-29 23:29:55 UTC (rev 112604)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderObject.cpp 2012-03-29 23:37:19 UTC (rev 112605)
@@ -2788,6 +2788,9 @@
bool RenderObject::canUpdateSelectionOnRootLineBoxes()
{
+ if (needsLayout())
+ return false;
+
RenderBlock* containingBlock = this->containingBlock();
return containingBlock ? !containingBlock->needsLayout() : true;
}
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderSelectionInfo.h (112604 => 112605)
--- branches/chromium/1025/Source/WebCore/rendering/RenderSelectionInfo.h 2012-03-29 23:29:55 UTC (rev 112604)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderSelectionInfo.h 2012-03-29 23:37:19 UTC (rev 112605)
@@ -62,7 +62,7 @@
public:
RenderSelectionInfo(RenderObject* o, bool clipToVisibleContent)
: RenderSelectionInfoBase(o)
- , m_rect(o->needsLayout() ? LayoutRect() : o->selectionRectForRepaint(m_repaintContainer, clipToVisibleContent))
+ , m_rect(o->canUpdateSelectionOnRootLineBoxes() ? o->selectionRectForRepaint(m_repaintContainer, clipToVisibleContent) : LayoutRect())
{
}
@@ -83,7 +83,7 @@
public:
RenderBlockSelectionInfo(RenderBlock* b)
: RenderSelectionInfoBase(b)
- , m_rects(b->needsLayout() ? GapRects() : block()->selectionGapRectsForRepaint(m_repaintContainer))
+ , m_rects(b->canUpdateSelectionOnRootLineBoxes() ? block()->selectionGapRectsForRepaint(m_repaintContainer) : GapRects())
{
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
