Title: [136567] branches/chromium/1312
- Revision
- 136567
- Author
- [email protected]
- Date
- 2012-12-04 14:11:38 -0800 (Tue, 04 Dec 2012)
Log Message
Merge 136253
BUG=153592
Review URL: https://codereview.chromium.org/11428168
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1312/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt (from rev 136253, trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt) (0 => 136567)
--- branches/chromium/1312/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt 2012-12-04 22:11:38 UTC (rev 136567)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/1312/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml (from rev 136253, trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml) (0 => 136567)
--- branches/chromium/1312/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml (rev 0)
+++ branches/chromium/1312/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml 2012-12-04 22:11:38 UTC (rev 136567)
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+Test passes if it does not crash.
+<head id="head1" style="-webkit-writing-mode: horizontal-bt;"></head>
+<i id="i1"><button id="button1"></button></i>
+<td id="td1"><body id="body2"></body></td>
+<i id="i2"></i>
+<style>
+.class1 { float: left; }
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var docElement = document.documentElement;
+
+function crash() {
+ head1 = document.getElementById("head1");
+ i1 = document.getElementById("i1");
+ td1 = document.getElementById("td1");
+ i2 = document.getElementById("i2");
+ body2 = document.getElementById("body2");
+ button1 = document.getElementById("button1");
+
+ // Makes it float and then intrude into anonymous block parent of i2.
+ button1.classList.toggle("class1");
+
+ // Moving td1, moves its body child. Body child inherits writing mode(bt) from head.
+ // And updating body's writing mode updates docElement's writing mode.
+ head1.appendChild(td1);
+
+ docElement.offsetTop;
+
+ head1.style.display = "list-item";
+
+ docElement.offsetTop;
+
+ button1.classList.toggle("class1");
+}
+document.addEventListener("DOMContentLoaded", crash, false);
+</script>
+</html>
Modified: branches/chromium/1312/Source/WebCore/rendering/RenderBox.cpp (136566 => 136567)
--- branches/chromium/1312/Source/WebCore/rendering/RenderBox.cpp 2012-12-04 22:05:45 UTC (rev 136566)
+++ branches/chromium/1312/Source/WebCore/rendering/RenderBox.cpp 2012-12-04 22:11:38 UTC (rev 136567)
@@ -258,6 +258,7 @@
if (viewStyle->writingMode() != newStyle->writingMode() && (isRootRenderer || !document()->writingModeSetOnDocumentElement())) {
viewStyle->setWritingMode(newStyle->writingMode());
viewRenderer->setHorizontalWritingMode(newStyle->isHorizontalWritingMode());
+ viewRenderer->markAllDescendantsWithFloatsForLayout();
if (isBodyRenderer) {
document()->documentElement()->renderer()->style()->setWritingMode(newStyle->writingMode());
document()->documentElement()->renderer()->setHorizontalWritingMode(newStyle->isHorizontalWritingMode());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
