Title: [127634] branches/chromium/1229
- Revision
- 127634
- Author
- [email protected]
- Date
- 2012-09-05 12:41:48 -0700 (Wed, 05 Sep 2012)
Log Message
Merge 126063
BUG=140484
Review URL: https://chromiumcodereview.appspot.com/10928003
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1229/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt (from rev 126063, trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt) (0 => 127634)
--- branches/chromium/1229/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt 2012-09-05 19:41:48 UTC (rev 127634)
@@ -0,0 +1 @@
+PASS if no crash or assert in debug
Copied: branches/chromium/1229/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html (from rev 126063, trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html) (0 => 127634)
--- branches/chromium/1229/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html (rev 0)
+++ branches/chromium/1229/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html 2012-09-05 19:41:48 UTC (rev 127634)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<multicol id=multicolElem style="margin: 0em 61692em 21850.5357359em 47804em; "></multicol><emph><a id=anchorElem><bdo id=tCF30></a><tdx>a b c</tdx><media><span id=spanElem></media><fig style='right: 5174624300.52mm; float:right;'></fig><dt><body style='border: 2270.47629379in dashed cadetblue; '><summary id=summaryElem></body>
+
+<script>
+window._onload_ = function() {
+ document.body.offsetTop;
+ multicolElem.style.display = "table"
+ summaryElem.appendChild(anchorElem);
+ tCF30.appendChild(spanElem);
+ document.body.offsetTop;
+ multicolElem.parentNode.removeChild(multicolElem);
+ document.body.offsetTop;
+ document.body.innerHTML = 'PASS if no crash or assert in debug';
+ if (window.testRunner)
+ testRunner.dumpAsText();
+}
+</script>
+</html>
Modified: branches/chromium/1229/Source/WebCore/rendering/RenderLineBoxList.cpp (127633 => 127634)
--- branches/chromium/1229/Source/WebCore/rendering/RenderLineBoxList.cpp 2012-09-05 19:37:24 UTC (rev 127633)
+++ branches/chromium/1229/Source/WebCore/rendering/RenderLineBoxList.cpp 2012-09-05 19:41:48 UTC (rev 127634)
@@ -321,7 +321,7 @@
if (!firstBox) {
// For an empty inline, go ahead and propagate the check up to our parent, unless the parent
// is already dirty.
- if (container->isInline() && !container->parent()->ancestorLineBoxDirty()) {
+ if (container->isInline() && !container->ancestorLineBoxDirty()) {
container->parent()->dirtyLinesFromChangedChild(container);
container->setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
}
@@ -361,7 +361,7 @@
// we won't find a previous sibling, but firstBox can be pointing to a following sibling.
// This isn't good enough, since we won't locate the root line box that encloses the removed
// <br>. We have to just over-invalidate a bit and go up to our parent.
- if (!inlineContainer->parent()->ancestorLineBoxDirty()) {
+ if (!inlineContainer->ancestorLineBoxDirty()) {
inlineContainer->parent()->dirtyLinesFromChangedChild(inlineContainer);
inlineContainer->setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
