[webkit-changes] [114854] branches/chromium/1084

Sat, 21 Apr 2012 17:01:55 -0700

Title: [114854] branches/chromium/1084

Diff

Copied: branches/chromium/1084/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash-expected.txt (from rev 112935, trunk/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash-expected.txt) (0 => 114854)


--- branches/chromium/1084/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash-expected.txt	                        (rev 0)
+++ branches/chromium/1084/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash-expected.txt	2012-04-22 00:01:20 UTC (rev 114854)
@@ -0,0 +1,3 @@
+Test passes if it does not crash.
+PASS
+

Copied: branches/chromium/1084/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash.html (from rev 112935, trunk/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash.html) (0 => 114854)


--- branches/chromium/1084/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash.html	                        (rev 0)
+++ branches/chromium/1084/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash.html	2012-04-22 00:01:20 UTC (rev 114854)
@@ -0,0 +1,54 @@
+<html>
+Test passes if it does not crash.
+<style>
+.div2 { float: none; width: 100px; }
+.div2:nth-last-child(odd) { float: right; }
+.span1 { float: right; height: 100px; }
+.td1 { height: 100px; }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest() {
+span1 = document.createElement('span');
+span1.setAttribute('class', 'span1');
+document.documentElement.appendChild(span1);
+
+div2 = document.createElement('div');
+div2.setAttribute('class', 'div2');
+document.documentElement.appendChild(div2);
+
+document.documentElement.appendChild(document.createElement('div'));
+
+div3 = document.createElement('div');
+document.documentElement.appendChild(div3);
+
+document.documentElement.appendChild(document.createElement('span'));
+document.documentElement.appendChild(document.createElement('span'));
+document.documentElement.appendChild(document.createElement('span'));
+
+span2 = document.createElement('span');
+document.documentElement.appendChild(span2);
+
+document.documentElement.appendChild(document.createElement('div'));
+
+document.body.offsetTop;
+div1 = document.createElement('div');
+td1 = document.createElement('td');
+td1.appendChild(document.createTextNode('PASS'));
+td1.setAttribute('class', 'td1');
+div1.appendChild(td1);
+div2.appendChild(div1);
+
+document.body.offsetTop;
+document.body.appendChild(div3);
+
+document.body.offsetTop;
+span2.appendChild(span1);
+document.createElement("span").appendChild(span2);
+}
+
+window._onload_ = runTest;
+</script>
+</html>

Modified: branches/chromium/1084/Source/WebCore/rendering/RenderBlock.cpp (114853 => 114854)


--- branches/chromium/1084/Source/WebCore/rendering/RenderBlock.cpp	2012-04-21 23:59:59 UTC (rev 114853)
+++ branches/chromium/1084/Source/WebCore/rendering/RenderBlock.cpp	2012-04-22 00:01:20 UTC (rev 114854)
@@ -4128,6 +4128,17 @@
     // Clear our positioned floats boolean.
     m_hasPositionedFloats = false;
 
+    HashSet<RenderBox*> oldIntrudingFloatSet;
+    if (!childrenInline() && m_floatingObjects) {
+        const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+        FloatingObjectSetIterator end = floatingObjectSet.end();
+        for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+            FloatingObject* floatingObject = *it;
+            if (!floatingObject->isDescendant())
+                oldIntrudingFloatSet.add(floatingObject->m_renderer);
+        }
+    }
+
     // Inline blocks are covered by the isReplaced() check in the avoidFloats method.
     if (avoidsFloats() || isRoot() || isRenderView() || isFloatingOrPositioned() || isTableCell()) {
         if (m_floatingObjects) {
@@ -4136,6 +4147,8 @@
         }
         if (layoutPass == PositionedFloatLayoutPass)
             addPositionedFloats();
+        if (!oldIntrudingFloatSet.isEmpty())
+            markAllDescendantsWithFloatsForLayout();
         return;
     }
 
@@ -4246,6 +4259,15 @@
         deleteAllValues(floatMap);
 
         markLinesDirtyInBlockRange(changeLogicalTop, changeLogicalBottom);
+    } else if (!oldIntrudingFloatSet.isEmpty()) {
+        // If there are previously intruding floats that no longer intrude, then children with floats
+        // should also get layout because they might need their floating object lists cleared.
+        const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+        FloatingObjectSetIterator end = floatingObjectSet.end();
+        for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it)
+            oldIntrudingFloatSet.remove((*it)->m_renderer);
+        if (!oldIntrudingFloatSet.isEmpty())
+            markAllDescendantsWithFloatsForLayout();
     }
 }
 

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to