Title: [140225] trunk
- Revision
- 140225
- Author
- [email protected]
- Date
- 2013-01-18 17:42:16 -0800 (Fri, 18 Jan 2013)
Log Message
Unreviewed, rolling out r140206.
http://trac.webkit.org/changeset/140206
https://bugs.webkit.org/show_bug.cgi?id=107346
Caused crash on wordpress.com (Requested by smfr on #webkit).
Patch by Sheriff Bot <[email protected]> on 2013-01-18
Source/WebCore:
* rendering/RenderBox.cpp:
(WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
LayoutTests:
* fast/block/float/overhanging-float-not-removed-crash-expected.txt: Removed.
* fast/block/float/overhanging-float-not-removed-crash.html: Removed.
Modified Paths
Removed Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (140224 => 140225)
--- trunk/LayoutTests/ChangeLog 2013-01-19 01:37:17 UTC (rev 140224)
+++ trunk/LayoutTests/ChangeLog 2013-01-19 01:42:16 UTC (rev 140225)
@@ -1,3 +1,14 @@
+2013-01-18 Sheriff Bot <[email protected]>
+
+ Unreviewed, rolling out r140206.
+ http://trac.webkit.org/changeset/140206
+ https://bugs.webkit.org/show_bug.cgi?id=107346
+
+ Caused crash on wordpress.com (Requested by smfr on #webkit).
+
+ * fast/block/float/overhanging-float-not-removed-crash-expected.txt: Removed.
+ * fast/block/float/overhanging-float-not-removed-crash.html: Removed.
+
2013-01-18 Simon Fraser <[email protected]>
Allow fixed background layers to be moved by the ScrollingCoordinator
Deleted: trunk/LayoutTests/fast/block/float/overhanging-float-not-removed-crash-expected.txt (140224 => 140225)
--- trunk/LayoutTests/fast/block/float/overhanging-float-not-removed-crash-expected.txt 2013-01-19 01:37:17 UTC (rev 140224)
+++ trunk/LayoutTests/fast/block/float/overhanging-float-not-removed-crash-expected.txt 2013-01-19 01:42:16 UTC (rev 140225)
@@ -1,2 +0,0 @@
-Bug 107226. Heap-use-after-free in WebCore::RenderObject::isDescendantOf.
-PASS. WebKit didn't crash
Deleted: trunk/LayoutTests/fast/block/float/overhanging-float-not-removed-crash.html (140224 => 140225)
--- trunk/LayoutTests/fast/block/float/overhanging-float-not-removed-crash.html 2013-01-19 01:37:17 UTC (rev 140224)
+++ trunk/LayoutTests/fast/block/float/overhanging-float-not-removed-crash.html 2013-01-19 01:42:16 UTC (rev 140225)
@@ -1,33 +0,0 @@
-<!DOCTYPE html>
-<html>
-<noembed id=test4></noembed>
-<h6 id=test3>
-<h3 id=test7></h3>
-<span id=tCF36>
-<math>
-<and>
-<equivalent>
-<csc id=test5 style="float: left; "> X6DDguzp|m_v c;</csc>
-<otherwise id=test1>
-</equivalent>
-</and>
-<cartesianproduct id=test2>#L }|2pqynn</cartesianproduct>
-<factorial></factorial>
-<product id=test6>.
-</math>
-</span>
-</h6>
-<script>
-if (window.testRunner)
- testRunner.dumpAsText();
-
-document.documentElement.offsetTop;
-test1.appendChild(test2);
-test2.appendChild(test3);
-document.documentElement.offsetTop;
-test4.appendChild(test5);
-test6.appendChild(test7);
-document.documentElement.offsetTop;
-document.documentElement.innerHTML = "Bug 107226. Heap-use-after-free in WebCore::RenderObject::isDescendantOf.<br />PASS. WebKit didn't crash";
-</script>
-</html>
Modified: trunk/Source/WebCore/ChangeLog (140224 => 140225)
--- trunk/Source/WebCore/ChangeLog 2013-01-19 01:37:17 UTC (rev 140224)
+++ trunk/Source/WebCore/ChangeLog 2013-01-19 01:42:16 UTC (rev 140225)
@@ -1,3 +1,14 @@
+2013-01-18 Sheriff Bot <[email protected]>
+
+ Unreviewed, rolling out r140206.
+ http://trac.webkit.org/changeset/140206
+ https://bugs.webkit.org/show_bug.cgi?id=107346
+
+ Caused crash on wordpress.com (Requested by smfr on #webkit).
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+
2013-01-18 Simon Fraser <[email protected]>
Allow fixed background layers to be moved by the ScrollingCoordinator
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (140224 => 140225)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2013-01-19 01:37:17 UTC (rev 140224)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2013-01-19 01:42:16 UTC (rev 140225)
@@ -179,12 +179,6 @@
}
if (parentBlock) {
- // Need to skip anonymous blocks in our ancestor chain since our overhanging floats
- // can be in the next siblings of enclosing block.
- while (parentBlock && parentBlock->isAnonymousBlock())
- parentBlock = parentBlock->containingBlock();
- ASSERT(parentBlock);
-
RenderObject* parent = parentBlock->parent();
if (parent && parent->isFlexibleBoxIncludingDeprecated())
parentBlock = toRenderBlock(parent);
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
