[webkit-changes] [145634] branches/safari-536.30-branch

Tue, 12 Mar 2013 17:34:10 -0700

Title: [145634] branches/safari-536.30-branch

Diff

Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145633 => 145634)


--- branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-13 00:29:22 UTC (rev 145633)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-03-13 00:36:07 UTC (rev 145634)
@@ -1,5 +1,19 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r136253
+
+    2012-11-30  Abhishek Arya  <[email protected]>
+
+            Crash due to intruding float not removed after writing mode changed.
+            https://bugs.webkit.org/show_bug.cgi?id=100149
+
+            Reviewed by Levi Weintraub.
+
+            * fast/block/float/intruding-float-not-removed-writing-mode-expected.txt: Added.
+            * fast/block/float/intruding-float-not-removed-writing-mode.xhtml: Added.
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r136074
 
     2012-11-28  Kenichi Ishibashi  <[email protected]>

Copied: branches/safari-536.30-branch/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt (from rev 136253, trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt) (0 => 145634)


--- branches/safari-536.30-branch/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode-expected.txt	2013-03-13 00:36:07 UTC (rev 145634)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+

Copied: branches/safari-536.30-branch/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml (from rev 136253, trunk/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml) (0 => 145634)


--- branches/safari-536.30-branch/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml	2013-03-13 00:36:07 UTC (rev 145634)
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+Test passes if it does not crash.
+<head id="head1" style="-webkit-writing-mode: horizontal-bt;"></head>
+<i id="i1"><button id="button1"></button></i>
+<td id="td1"><body id="body2"></body></td>
+<i id="i2"></i>
+<style>
+.class1 { float: left; }
+</style>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+var docElement = document.documentElement;
+
+function crash() {
+    head1 = document.getElementById("head1");
+    i1 = document.getElementById("i1");
+    td1 = document.getElementById("td1");
+    i2 = document.getElementById("i2");
+    body2 = document.getElementById("body2");
+    button1 = document.getElementById("button1");
+
+    // Makes it float and then intrude into anonymous block parent of i2.
+    button1.classList.toggle("class1");
+
+    // Moving td1, moves its body child. Body child inherits writing mode(bt) from head.
+    // And updating body's writing mode updates docElement's writing mode.
+    head1.appendChild(td1);
+
+    docElement.offsetTop;
+
+    head1.style.display = "list-item";
+
+    docElement.offsetTop;
+
+    button1.classList.toggle("class1");
+}
+document.addEventListener("DOMContentLoaded", crash, false);
+</script>
+</html>

Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145633 => 145634)


--- branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-13 00:29:22 UTC (rev 145633)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-03-13 00:36:07 UTC (rev 145634)
@@ -1,5 +1,24 @@
 2013-03-12  Lucas Forschler  <[email protected]>
 
+        Merge r136253
+
+    2012-11-30  Abhishek Arya  <[email protected]>
+
+            Crash due to intruding float not removed after writing mode changed.
+            https://bugs.webkit.org/show_bug.cgi?id=100149
+
+            Reviewed by Levi Weintraub.
+
+            When RenderView writing mode changes, make sure to mark all descendants
+            with floats for layout.
+
+            Test: fast/block/float/intruding-float-not-removed-writing-mode.xhtml
+
+            * rendering/RenderBox.cpp:
+            (WebCore::RenderBox::styleDidChange):
+
+2013-03-12  Lucas Forschler  <[email protected]>
+
         Merge r136074
 
     2012-11-28  Kenichi Ishibashi  <[email protected]>

Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.cpp (145633 => 145634)


--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.cpp	2013-03-13 00:29:22 UTC (rev 145633)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.cpp	2013-03-13 00:36:07 UTC (rev 145634)
@@ -394,6 +394,7 @@
         if (viewStyle->writingMode() != newStyle->writingMode() && (isRootRenderer || !document()->writingModeSetOnDocumentElement())) {
             viewStyle->setWritingMode(newStyle->writingMode());
             viewRenderer->setHorizontalWritingMode(newStyle->isHorizontalWritingMode());
+            viewRenderer->markAllDescendantsWithFloatsForLayout();
             if (isBodyRenderer) {
                 document()->documentElement()->renderer()->style()->setWritingMode(newStyle->writingMode());
                 document()->documentElement()->renderer()->setHorizontalWritingMode(newStyle->isHorizontalWritingMode());

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to