Title: [114947] branches/chromium/1084
- Revision
- 114947
- Author
- cev...@google.com
- Date
- 2012-04-23 14:30:38 -0700 (Mon, 23 Apr 2012)
Log Message
Merge 112973
BUG=121206
Review URL: https://chromiumcodereview.appspot.com/10201001
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1084/LayoutTests/fast/runin/select-runin-expected.txt (from rev 112973, trunk/LayoutTests/fast/runin/select-runin-expected.txt) (0 => 114947)
--- branches/chromium/1084/LayoutTests/fast/runin/select-runin-expected.txt (rev 0)
+++ branches/chromium/1084/LayoutTests/fast/runin/select-runin-expected.txt 2012-04-23 21:30:38 UTC (rev 114947)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/1084/LayoutTests/fast/runin/select-runin.html (from rev 112973, trunk/LayoutTests/fast/runin/select-runin.html) (0 => 114947)
--- branches/chromium/1084/LayoutTests/fast/runin/select-runin.html (rev 0)
+++ branches/chromium/1084/LayoutTests/fast/runin/select-runin.html 2012-04-23 21:30:38 UTC (rev 114947)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<select multiple="multiple" id="select" style="-webkit-appearance: none; display: run-in;">
+<option></option>
+</select>
+<div></div>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+document.body.offsetTop;
+document.execCommand("SelectAll");
+var select = document.getElementById("select");
+select.removeChild(select.firstChild);
+</script>
+</html>
Modified: branches/chromium/1084/Source/WebCore/rendering/RenderBlock.cpp (114946 => 114947)
--- branches/chromium/1084/Source/WebCore/rendering/RenderBlock.cpp 2012-04-23 21:28:28 UTC (rev 114946)
+++ branches/chromium/1084/Source/WebCore/rendering/RenderBlock.cpp 2012-04-23 21:30:38 UTC (rev 114947)
@@ -1851,14 +1851,22 @@
// block.
if (!child->isRunIn() || !child->childrenInline())
return false;
+
// FIXME: We don't handle non-block elements with run-in for now.
if (!child->isRenderBlock())
- return false;
+ return false;
+
// Run-in child shouldn't intrude into the sibling block if it is part of a
// continuation chain. In that case, treat it as a normal block.
if (child->isElementContinuation() || child->virtualContinuation())
return false;
+ // Check if this node is allowed to run-in. E.g. <select> expects its renderer to
+ // be a RenderListBox or RenderMenuList, and hence cannot be a RenderInline run-in.
+ Node* runInNode = child->node();
+ if (runInNode && runInNode->hasTagName(selectTag))
+ return false;
+
RenderBlock* blockRunIn = toRenderBlock(child);
RenderObject* curr = blockRunIn->nextSibling();
if (!curr || !curr->isRenderBlock() || !curr->childrenInline() || curr->isRunIn() || curr->isAnonymous() || curr->isFloatingOrPositioned())
@@ -1880,7 +1888,6 @@
children()->removeChildNode(this, blockRunIn);
// Create an inline.
- Node* runInNode = blockRunIn->node();
RenderInline* inlineRunIn = new (renderArena()) RenderInline(runInNode ? runInNode : document());
inlineRunIn->setStyle(blockRunIn->style());
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
