Title: [145583] branches/safari-536.30-branch
- Revision
- 145583
- Author
- [email protected]
- Date
- 2013-03-12 14:19:05 -0700 (Tue, 12 Mar 2013)
Log Message
Merged r126063. <rdar://problem/13334852>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145582 => 145583)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-12 21:11:06 UTC (rev 145582)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-12 21:19:05 UTC (rev 145583)
@@ -1,5 +1,20 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r126063
+
+ 2012-08-20 Ken Buchanan <[email protected]>
+ Line boxes not being dirtied correctly during inline removal
+ https://bugs.webkit.org/show_bug.cgi?id=93156
+
+ Reviewed by David Hyatt.
+
+ Test exercising crashing condition for bug 93156.
+
+ * fast/block/line-layout/double-line-break-obj-removal-crash.html: Added
+ * fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt: Added
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r123145
2012-07-19 Erik Arvidsson <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt (from rev 126063, trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt) (0 => 145583)
--- branches/safari-536.30-branch/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt 2013-03-12 21:19:05 UTC (rev 145583)
@@ -0,0 +1 @@
+PASS if no crash or assert in debug
Copied: branches/safari-536.30-branch/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html (from rev 126063, trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html) (0 => 145583)
--- branches/safari-536.30-branch/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html 2013-03-12 21:19:05 UTC (rev 145583)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<multicol id=multicolElem style="margin: 0em 61692em 21850.5357359em 47804em; "></multicol><emph><a id=anchorElem><bdo id=tCF30></a><tdx>a b c</tdx><media><span id=spanElem></media><fig style='right: 5174624300.52mm; float:right;'></fig><dt><body style='border: 2270.47629379in dashed cadetblue; '><summary id=summaryElem></body>
+
+<script>
+window._onload_ = function() {
+ document.body.offsetTop;
+ multicolElem.style.display = "table"
+ summaryElem.appendChild(anchorElem);
+ tCF30.appendChild(spanElem);
+ document.body.offsetTop;
+ multicolElem.parentNode.removeChild(multicolElem);
+ document.body.offsetTop;
+ document.body.innerHTML = 'PASS if no crash or assert in debug';
+ if (window.testRunner)
+ testRunner.dumpAsText();
+}
+</script>
+</html>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145582 => 145583)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-12 21:11:06 UTC (rev 145582)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-12 21:19:05 UTC (rev 145583)
@@ -1,5 +1,27 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r126063
+
+ 2012-08-20 Ken Buchanan <[email protected]>
+ Line boxes not being dirtied correctly during inline removal
+ https://bugs.webkit.org/show_bug.cgi?id=93156
+
+ Reviewed by David Hyatt.
+
+ When two inline objects were being removed from different lineboxes
+ in an ancestral RenderBlock, the way the RenderBlock was being marked
+ prevented the second linebox from being marked dirty. This causes
+ it to not get layout in the subsequent layout pass.
+
+ This patch causes only the descendants corresponding to actual changed
+ lineboxes to have their ancestorLineBoxDirty bit set, rather than
+ the RenderBlock that contains the lineboxes themselves.
+
+ * rendering/RenderLineBoxList.cpp:
+ (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r124229
2012-07-31 Antti Koivisto <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderLineBoxList.cpp (145582 => 145583)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderLineBoxList.cpp 2013-03-12 21:11:06 UTC (rev 145582)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderLineBoxList.cpp 2013-03-12 21:19:05 UTC (rev 145583)
@@ -321,7 +321,7 @@
if (!firstBox) {
// For an empty inline, go ahead and propagate the check up to our parent, unless the parent
// is already dirty.
- if (container->isInline() && !container->parent()->ancestorLineBoxDirty()) {
+ if (container->isInline() && !container->ancestorLineBoxDirty()) {
container->parent()->dirtyLinesFromChangedChild(container);
container->setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
}
@@ -361,7 +361,7 @@
// we won't find a previous sibling, but firstBox can be pointing to a following sibling.
// This isn't good enough, since we won't locate the root line box that encloses the removed
// <br>. We have to just over-invalidate a bit and go up to our parent.
- if (!inlineContainer->parent()->ancestorLineBoxDirty()) {
+ if (!inlineContainer->ancestorLineBoxDirty()) {
inlineContainer->parent()->dirtyLinesFromChangedChild(inlineContainer);
inlineContainer->setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
