Title: [136253] trunk
- Revision
- 136253
- Author
- [email protected]
- Date
- 2012-11-30 10:14:48 -0800 (Fri, 30 Nov 2012)
Log Message
Crash due to intruding float not removed after writing mode changed.
https://bugs.webkit.org/show_bug.cgi?id=100149
Reviewed by Levi Weintraub.
Source/WebCore:
When RenderView writing mode changes, make sure to mark all descendants
with floats for layout.
Test: fast/block/float/intruding-float-not-removed-writing-mode.xhtml
* rendering/RenderBox.cpp:
(WebCore::RenderBox::styleDidChange):
LayoutTests:
* fast/block/float/intruding-float-not-removed-writing-mode-expected.txt: Added.
* fast/block/float/intruding-float-not-removed-writing-mode.xhtml: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (136252 => 136253)
--- trunk/LayoutTests/ChangeLog 2012-11-30 17:57:39 UTC (rev 136252)
+++ trunk/LayoutTests/ChangeLog 2012-11-30 18:14:48 UTC (rev 136253)
@@ -1,3 +1,13 @@
+2012-11-30 Abhishek Arya <[email protected]>
+
+ Crash due to intruding float not removed after writing mode changed.
+ https://bugs.webkit.org/show_bug.cgi?id=100149
+
+ Reviewed by Levi Weintraub.
+
+ * fast/block/float/intruding-float-not-removed-writing-mode-expected.txt: Added.
+ * fast/block/float/intruding-float-not-removed-writing-mode.xhtml: Added.
+
2012-11-30 Florin Malita <[email protected]>
SVG pattern data deleted while in use
Added: trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt (0 => 136253)
--- trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt 2012-11-30 18:14:48 UTC (rev 136253)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Added: trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml (0 => 136253)
--- trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml (rev 0)
+++ trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml 2012-11-30 18:14:48 UTC (rev 136253)
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+Test passes if it does not crash.
+<head id="head1" style="-webkit-writing-mode: horizontal-bt;"></head>
+<i id="i1"><button id="button1"></button></i>
+<td id="td1"><body id="body2"></body></td>
+<i id="i2"></i>
+<style>
+.class1 { float: left; }
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var docElement = document.documentElement;
+
+function crash() {
+ head1 = document.getElementById("head1");
+ i1 = document.getElementById("i1");
+ td1 = document.getElementById("td1");
+ i2 = document.getElementById("i2");
+ body2 = document.getElementById("body2");
+ button1 = document.getElementById("button1");
+
+ // Makes it float and then intrude into anonymous block parent of i2.
+ button1.classList.toggle("class1");
+
+ // Moving td1, moves its body child. Body child inherits writing mode(bt) from head.
+ // And updating body's writing mode updates docElement's writing mode.
+ head1.appendChild(td1);
+
+ docElement.offsetTop;
+
+ head1.style.display = "list-item";
+
+ docElement.offsetTop;
+
+ button1.classList.toggle("class1");
+}
+document.addEventListener("DOMContentLoaded", crash, false);
+</script>
+</html>
Property changes on: trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (136252 => 136253)
--- trunk/Source/WebCore/ChangeLog 2012-11-30 17:57:39 UTC (rev 136252)
+++ trunk/Source/WebCore/ChangeLog 2012-11-30 18:14:48 UTC (rev 136253)
@@ -1,3 +1,18 @@
+2012-11-30 Abhishek Arya <[email protected]>
+
+ Crash due to intruding float not removed after writing mode changed.
+ https://bugs.webkit.org/show_bug.cgi?id=100149
+
+ Reviewed by Levi Weintraub.
+
+ When RenderView writing mode changes, make sure to mark all descendants
+ with floats for layout.
+
+ Test: fast/block/float/intruding-float-not-removed-writing-mode.xhtml
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::styleDidChange):
+
2012-11-30 Florin Malita <[email protected]>
SVG pattern data deleted while in use
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (136252 => 136253)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2012-11-30 17:57:39 UTC (rev 136252)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2012-11-30 18:14:48 UTC (rev 136253)
@@ -263,6 +263,7 @@
if (viewStyle->writingMode() != newStyle->writingMode() && (isRootRenderer || !document()->writingModeSetOnDocumentElement())) {
viewStyle->setWritingMode(newStyle->writingMode());
viewRenderer->setHorizontalWritingMode(newStyle->isHorizontalWritingMode());
+ viewRenderer->markAllDescendantsWithFloatsForLayout();
if (isBodyRenderer) {
document()->documentElement()->renderer()->style()->setWritingMode(newStyle->writingMode());
document()->documentElement()->renderer()->setHorizontalWritingMode(newStyle->isHorizontalWritingMode());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
