Title: [139390] branches/chromium/1364
- Revision
- 139390
- Author
- cev...@google.com
- Date
- 2013-01-10 17:42:55 -0800 (Thu, 10 Jan 2013)
Log Message
Merge 138974
BUG=166336
Review URL: https://codereview.chromium.org/11847002
Modified Paths
Removed Paths
Diff
Deleted: branches/chromium/1364/LayoutTests/mathml/mo-stretch-crash-expected.txt (139389 => 139390)
--- branches/chromium/1364/LayoutTests/mathml/mo-stretch-crash-expected.txt 2013-01-11 01:30:13 UTC (rev 139389)
+++ branches/chromium/1364/LayoutTests/mathml/mo-stretch-crash-expected.txt 2013-01-11 01:42:55 UTC (rev 139390)
@@ -1,2 +0,0 @@
-This test passes if it does not crash.
-
Deleted: branches/chromium/1364/LayoutTests/mathml/mo-stretch-crash.html (139389 => 139390)
--- branches/chromium/1364/LayoutTests/mathml/mo-stretch-crash.html 2013-01-11 01:30:13 UTC (rev 139389)
+++ branches/chromium/1364/LayoutTests/mathml/mo-stretch-crash.html 2013-01-11 01:42:55 UTC (rev 139390)
@@ -1,30 +0,0 @@
-<!DOCTYPE html>
-<q id=quote></q>
-<dd id=dd>
-<body id=body>
- <style>
- dd, q, mfenced, div {
- width: 7px;
- overflow-y: auto;
- padding-left: 100%;
- }
- </style>
- <script>
- if (window.testRunner)
- testRunner.dumpAsText();
-
- body.contentEditable = "true";
- function crash() {
- mfenced = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mfenced");
- div = document.createElement("div");
- mfenced.appendChild(div);
- dd.appendChild(mfenced);
- body.style.display = "-webkit-flex";
- div.appendChild(quote);
- }
- window.addEventListener("load", crash, false);
- </script>
-
-This test passes if it does not crash.
-</body>
-</dd>
Modified: branches/chromium/1364/Source/WebCore/rendering/RenderBlock.cpp (139389 => 139390)
--- branches/chromium/1364/Source/WebCore/rendering/RenderBlock.cpp 2013-01-11 01:30:13 UTC (rev 139389)
+++ branches/chromium/1364/Source/WebCore/rendering/RenderBlock.cpp 2013-01-11 01:42:55 UTC (rev 139390)
@@ -1290,8 +1290,8 @@
void RenderBlock::startDelayUpdateScrollInfo()
{
- if (!gDelayedUpdateScrollInfoSet) {
- ASSERT(!gDelayUpdateScrollInfo);
+ if (gDelayUpdateScrollInfo == 0) {
+ ASSERT(!gDelayedUpdateScrollInfoSet);
gDelayedUpdateScrollInfoSet = new DelayedUpdateScrollInfoSet;
}
ASSERT(gDelayedUpdateScrollInfoSet);
@@ -1305,22 +1305,15 @@
if (gDelayUpdateScrollInfo == 0) {
ASSERT(gDelayedUpdateScrollInfoSet);
- Vector<RenderBlock*> infoSet;
- while (gDelayedUpdateScrollInfoSet && gDelayedUpdateScrollInfoSet->size()) {
- copyToVector(*gDelayedUpdateScrollInfoSet, infoSet);
- for (Vector<RenderBlock*>::iterator it = infoSet.begin(); it != infoSet.end(); ++it) {
- RenderBlock* block = *it;
- // |block| may have been destroyed at this point, but then it will have been removed from gDelayedUpdateScrollInfoSet.
- if (gDelayedUpdateScrollInfoSet && gDelayedUpdateScrollInfoSet->contains(block)) {
- gDelayedUpdateScrollInfoSet->remove(block);
- if (block->hasOverflowClip())
- block->layer()->updateScrollInfoAfterLayout();
- }
+ OwnPtr<DelayedUpdateScrollInfoSet> infoSet(adoptPtr(gDelayedUpdateScrollInfoSet));
+ gDelayedUpdateScrollInfoSet = 0;
+
+ for (DelayedUpdateScrollInfoSet::iterator it = infoSet->begin(); it != infoSet->end(); ++it) {
+ RenderBlock* block = *it;
+ if (block->hasOverflowClip()) {
+ block->layer()->updateScrollInfoAfterLayout();
}
}
- delete gDelayedUpdateScrollInfoSet;
- gDelayedUpdateScrollInfoSet = 0;
- ASSERT(!gDelayUpdateScrollInfo);
}
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
