Title: [122122] branches/chromium/1132
- Revision
- 122122
- Author
- [email protected]
- Date
- 2012-07-09 11:50:50 -0700 (Mon, 09 Jul 2012)
Log Message
Merge 120801
BUG=129898
Review URL: https://chromiumcodereview.appspot.com/10770002
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash-expected.txt (from rev 120801, trunk/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash-expected.txt) (0 => 122122)
--- branches/chromium/1132/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash-expected.txt 2012-07-09 18:50:50 UTC (rev 122122)
@@ -0,0 +1 @@
+PASS: reparenting a counter node subtree that contains resets does not cause a crash.
Copied: branches/chromium/1132/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash.html (from rev 120801, trunk/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash.html) (0 => 122122)
--- branches/chromium/1132/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/css/counters/counter-reset-subtree-insert-crash.html 2012-07-09 18:50:50 UTC (rev 122122)
@@ -0,0 +1,71 @@
+<style>
+#el0::after {
+ content: counter(c);
+ counter-increment: c;
+}
+
+#el1 {
+ content: counter(c);
+ counter-increment: c;
+}
+
+#el2 {
+ content: counter(c);
+ counter-increment: c;
+}
+
+#el2::after {
+ content: counter(c);
+}
+
+#el3 {
+ position: absolute;
+}
+
+#el3::before {
+ content: counter(c);
+ counter-reset: c;
+}
+
+#el3:after {
+ content: counter(c);
+ counter-reset: c;
+}
+
+#el4 {
+ counter-increment: c;
+}
+
+#el5 {
+ content: counter(c);
+ counter-increment: c;
+}
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+window._onload_ = function() {
+ rules = [
+ "#el2::after { counter-increment: c; } ",
+ "xyz { } "
+ ];
+ stylesheet = document.styleSheets[0];
+ document.body.offsetTop;
+ stylesheet.insertRule(rules[0], stylesheet.length);
+ document.body.offsetTop;
+ stylesheet.insertRule(rules[1], stylesheet.length)
+ document.body.innerHTML = "PASS: reparenting a counter node subtree that contains resets does not cause a crash.";
+}
+</script>
+
+<body>
+ <span id="el0">
+ <div id="el1"></div>
+ <div id="el2">
+ <div id="el3"></div>
+ <span id="el4"></span>
+ </div>
+ <div id="el5"></div>
+ </span>
+</body>
Modified: branches/chromium/1132/Source/WebCore/rendering/CounterNode.cpp (122121 => 122122)
--- branches/chromium/1132/Source/WebCore/rendering/CounterNode.cpp 2012-07-09 18:48:06 UTC (rev 122121)
+++ branches/chromium/1132/Source/WebCore/rendering/CounterNode.cpp 2012-07-09 18:50:50 UTC (rev 122122)
@@ -261,25 +261,22 @@
newChild->m_parent = this;
newChild->m_previousSibling = refChild;
- if (!newChild->m_firstChild || newChild->m_hasResetType) {
+ if (next) {
+ ASSERT(next->m_previousSibling == refChild);
+ next->m_previousSibling = newChild;
newChild->m_nextSibling = next;
- if (next) {
- ASSERT(next->m_previousSibling == refChild);
- next->m_previousSibling = newChild;
- } else {
- ASSERT(m_lastChild == refChild);
- m_lastChild = newChild;
- }
+ } else {
+ ASSERT(m_lastChild == refChild);
+ m_lastChild = newChild;
+ }
+ if (!newChild->m_firstChild || newChild->m_hasResetType) {
newChild->m_countInParent = newChild->computeCountInParent();
newChild->resetThisAndDescendantsRenderers();
if (next)
next->recount();
return;
}
- // If the new child is the last in the sibling list we must set the parent's lastChild.
- if (!newChild->m_nextSibling)
- m_lastChild = newChild;
// The code below handles the case when a formerly root increment counter is loosing its root position
// and therefore its children become next siblings.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
