Title: [126671] branches/chromium/1229
- Revision
- 126671
- Author
- [email protected]
- Date
- 2012-08-24 18:29:40 -0700 (Fri, 24 Aug 2012)
Log Message
Merge 125472
BUG=142395
Review URL: https://chromiumcodereview.appspot.com/10883044
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1229/LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash-expected.txt (from rev 125472, trunk/LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash-expected.txt) (0 => 126671)
--- branches/chromium/1229/LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash-expected.txt (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash-expected.txt 2012-08-25 01:29:40 UTC (rev 126671)
@@ -0,0 +1 @@
+ PASS. WebKit didn't crash.
Copied: branches/chromium/1229/LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash.html (from rev 125472, trunk/LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash.html) (0 => 126671)
--- branches/chromium/1229/LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash.html (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/replaced/render-inline-cast-to-render-box-crash.html 2012-08-25 01:29:40 UTC (rev 126671)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+<style>
+span {
+ position: relative;
+ height:100px;
+}
+img {
+ position: absolute;
+ height: 50%;
+}
+</style>
+<body>
+<span>
+ <img />
+</span>
+PASS. WebKit didn't crash.
+</body>
+</html>
Modified: branches/chromium/1229/Source/WebCore/rendering/RenderBox.cpp (126670 => 126671)
--- branches/chromium/1229/Source/WebCore/rendering/RenderBox.cpp 2012-08-25 01:25:33 UTC (rev 126670)
+++ branches/chromium/1229/Source/WebCore/rendering/RenderBox.cpp 2012-08-25 01:29:40 UTC (rev 126671)
@@ -2262,7 +2262,7 @@
}
}
availableHeight = computeContentBoxLogicalHeight(valueForLength(logicalHeight, availableHeight));
- if (cb->style()->logicalHeight().isFixed())
+ if (cb->isBox() && cb->style()->logicalHeight().isFixed())
availableHeight = max<LayoutUnit>(0, availableHeight - toRenderBox(cb)->scrollbarLogicalHeight());
return availableHeight;
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
