[webkit-changes] [118057] branches/chromium/1132

Tue, 22 May 2012 14:29:01 -0700

Title: [118057] branches/chromium/1132

Diff

Copied: branches/chromium/1132/LayoutTests/fast/block/positioning/positioned-object-under-split-block-parent-crash-expected.txt (from rev 116357, trunk/LayoutTests/fast/block/positioning/positioned-object-under-split-block-parent-crash-expected.txt) (0 => 118057)


--- branches/chromium/1132/LayoutTests/fast/block/positioning/positioned-object-under-split-block-parent-crash-expected.txt	                        (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/block/positioning/positioned-object-under-split-block-parent-crash-expected.txt	2012-05-22 21:29:02 UTC (rev 118057)
@@ -0,0 +1,2 @@
+PASS if no assert or crash in debug
+

Copied: branches/chromium/1132/LayoutTests/fast/block/positioning/positioned-object-under-split-block-parent-crash.html (from rev 116357, trunk/LayoutTests/fast/block/positioning/positioned-object-under-split-block-parent-crash.html) (0 => 118057)


--- branches/chromium/1132/LayoutTests/fast/block/positioning/positioned-object-under-split-block-parent-crash.html	                        (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/block/positioning/positioned-object-under-split-block-parent-crash.html	2012-05-22 21:29:02 UTC (rev 118057)
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+<style>
+.colContainer { -webkit-column-count: 0; }
+.absolutePosition { position: absolute; }
+.colSpanAll { -webkit-column-span: all; }
+.transformed { -webkit-transform: rotate(45deg); }
+.hidden { display:none; }
+.normal { display:block;}
+</style>
+<script>
+
+window._onload_ = function() {
+    columnContainerBlock = document.createElement('div');
+    columnContainerBlock.setAttribute('class', 'colContainer');
+    document.documentElement.appendChild(columnContainerBlock);
+
+    splitBlockParent = document.createElement('div');
+    splitBlockParent.setAttribute('class', 'transformed');
+    columnContainerBlock.appendChild(splitBlockParent);
+
+    splitFlowDt = document.createElement('dt');
+    splitBlockParent.appendChild(splitFlowDt);
+
+    positionedDiv = document.createElement('div');
+    positionedDiv.setAttribute('class', 'absolutePosition');
+    splitBlockParent.appendChild(positionedDiv);
+
+    columnSpan = document.createElement('col');
+    columnSpan.setAttribute('class', 'colSpanAll');
+    splitFlowDt.appendChild(columnSpan); // Inserting the col inside the dt causes it to get split.
+    document.documentElement.offsetHeight;
+
+    splitFlowDt.setAttribute('class', 'hidden'); // This removes the split dt and the col from the render tree.
+    document.documentElement.offsetHeight;
+
+    splitFlowDt.setAttribute('class', 'normal'); // Re-adding the dt causes the flow to split again.
+    document.documentElement.offsetHeight;
+
+    splitBlockParent.removeChild(positionedDiv); // Remove the positioned object from the tree.
+    document.documentElement.offsetHeight;
+
+    splitBlockParent.removeChild(splitFlowDt); // Ensure the node with the bad positioned object list gets layout.
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+}
+</script>
+<body>
+PASS if no assert or crash in debug
+</body>
+</html>

Modified: branches/chromium/1132/Source/WebCore/rendering/RenderBlock.cpp (118056 => 118057)


--- branches/chromium/1132/Source/WebCore/rendering/RenderBlock.cpp	2012-05-22 21:27:45 UTC (rev 118056)
+++ branches/chromium/1132/Source/WebCore/rendering/RenderBlock.cpp	2012-05-22 21:29:02 UTC (rev 118057)
@@ -634,6 +634,13 @@
             currChildNextSibling = 0; // We destroyed the last child, so now we need to update
                                       // the value of currChildNextSibling.
 
+        // It is possible that positioned objects under blockCurr are going to be moved to cloneBlock.
+        // Since we are doing layout anyway, it is easier to blow away the entire list, than
+        // traversing down the subtree looking for positioned children and then remove them
+        // from our positioned objects list.
+        if (currChildNextSibling)
+            blockCurr->removePositionedObjects(0);
+
         // Now we need to take all of the children starting from the first child
         // *after* currChild and append them all to the clone.
         blockCurr->moveChildrenTo(cloneBlock, currChildNextSibling, 0, true);

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to