Title: [118029] branches/chromium/1132
- Revision
- 118029
- Author
- [email protected]
- Date
- 2012-05-22 12:54:36 -0700 (Tue, 22 May 2012)
Log Message
Merge 116325
BUG=126406
Review URL: https://chromiumcodereview.appspot.com/10399133
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash-expected.txt (from rev 116325, trunk/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash-expected.txt) (0 => 118029)
--- branches/chromium/1132/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash-expected.txt 2012-05-22 19:54:36 UTC (rev 118029)
@@ -0,0 +1,2 @@
+WebKit Bug 85759 - Crash in RenderBlock::updateFirstLetterStyle.
+PASS if test does not crash.
Copied: branches/chromium/1132/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash.html (from rev 116325, trunk/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash.html) (0 => 118029)
--- branches/chromium/1132/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash.html 2012-05-22 19:54:36 UTC (rev 118029)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<style>
+.absolutePosition { position: fixed; }
+.float:before { float: right; content: ''; }
+.float:first-letter { float: right; }
+.inline::first-letter { content: ''; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function startTest() {
+ document.body.offsetTop;
+ var parent = document.getElementById("parent");
+ var child = document.getElementById("child");
+ child.setAttribute('class', 'inline');
+ document.body.offsetTop;
+ parent.removeChild(child);
+ document.body.offsetTop;
+ parent.setAttribute('class', 'inline');
+}
+window._onload_ = startTest;
+</script>
+WebKit Bug 85759 - Crash in RenderBlock::updateFirstLetterStyle.
+<div class="float" id="parent">
+<div class="absolutePosition" id="child"></div>
+PASS if test does not crash.
+</div>
+</html>
Modified: branches/chromium/1132/Source/WebCore/rendering/RenderBlock.cpp (118028 => 118029)
--- branches/chromium/1132/Source/WebCore/rendering/RenderBlock.cpp 2012-05-22 19:53:10 UTC (rev 118028)
+++ branches/chromium/1132/Source/WebCore/rendering/RenderBlock.cpp 2012-05-22 19:54:36 UTC (rev 118029)
@@ -5938,6 +5938,9 @@
remainingText->setFirstLetter(newFirstLetter);
toRenderBoxModelObject(newFirstLetter)->setFirstLetterRemainingText(remainingText);
}
+ // To prevent removal of single anonymous block in RenderBlock::removeChild and causing
+ // |nextSibling| to go stale, we remove the old first letter using removeChildNode first.
+ firstLetterContainer->virtualChildren()->removeChildNode(firstLetterContainer, firstLetter);
firstLetter->destroy();
firstLetter = newFirstLetter;
firstLetterContainer->addChild(firstLetter, nextSibling);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
