Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145642 => 145643)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:51:48 UTC (rev 145642)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:53:53 UTC (rev 145643)
@@ -1,5 +1,19 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r138850
+
+ 2013-01-04 Abhishek Arya <[email protected]>
+
+ Crash in WebCore::RenderBlock::willBeDestroyed
+ https://bugs.webkit.org/show_bug.cgi?id=103455
+
+ Reviewed by Eric Seidel.
+
+ * fast/multicol/continuation-crash-expected.txt: Added.
+ * fast/multicol/continuation-crash.html: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r138316
2012-12-20 Stephen Chenney <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/fast/multicol/continuation-crash-expected.txt (from rev 138850, trunk/LayoutTests/fast/multicol/continuation-crash-expected.txt) (0 => 145643)
--- branches/safari-536.30-branch/LayoutTests/fast/multicol/continuation-crash-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/multicol/continuation-crash-expected.txt 2013-03-13 00:53:53 UTC (rev 145643)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/safari-536.30-branch/LayoutTests/fast/multicol/continuation-crash.html (from rev 138850, trunk/LayoutTests/fast/multicol/continuation-crash.html) (0 => 145643)
--- branches/safari-536.30-branch/LayoutTests/fast/multicol/continuation-crash.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/multicol/continuation-crash.html 2013-03-13 00:53:53 UTC (rev 145643)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<style>
+.column-layout { -webkit-column-count: 1; }
+.column-span-all { -webkit-column-span: all; }
+.after-content:after { display: block; content: "" }
+</style>
+<div class="column-layout">
+ <span class="after-content">
+ <div></div>
+ </span>
+ <div class="column-span-all"></div>
+</div>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</html>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145642 => 145643)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:51:48 UTC (rev 145642)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:53:53 UTC (rev 145643)
@@ -1,5 +1,40 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r138850
+
+ 2013-01-04 Abhishek Arya <[email protected]>
+
+ Crash in WebCore::RenderBlock::willBeDestroyed
+ https://bugs.webkit.org/show_bug.cgi?id=103455
+
+ Reviewed by Eric Seidel.
+
+ It is not required to set beforeChild to :after child since DOM is
+ now pseudo element aware. See trac.webkit.org/changeset/137336. We
+ were incorrectly placing the inline continuation before the :after
+ content.
+
+ Test: fast/multicol/continuation-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): remove beforeChild
+ setting to afterPseudoElementRenderer.
+ * rendering/RenderRuby.cpp:
+ (WebCore::RenderRubyAsInline::addChild): add missing beforeChild argument.
+ setting to afterPseudoElementRenderer.
+ (WebCore::RenderRubyAsBlock::addChild): add missing beforeChild argument.
+ * rendering/RenderTable.cpp:
+ (WebCore::RenderTable::addChild): remove beforeChild
+ setting to afterPseudoElementRenderer.
+ * rendering/RenderTableRow.cpp:
+ (WebCore::RenderTableRow::addChild): remove beforeChild
+ setting to afterPseudoElementRenderer.
+ * rendering/RenderTableSection.cpp:
+ (WebCore::RenderTableSection::addChild): remove beforeChild
+ setting to afterPseudoElementRenderer.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r138812
2013-01-04 John Mellor <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.cpp (145642 => 145643)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.cpp 2013-03-13 00:51:48 UTC (rev 145642)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.cpp 2013-03-13 00:53:53 UTC (rev 145643)
@@ -799,10 +799,6 @@
void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild, RenderObject* beforeChild)
{
- // Make sure we don't append things after :after-generated content if we have it.
- if (!beforeChild)
- beforeChild = afterPseudoElementRenderer();
-
if (beforeChild && beforeChild->parent() != this) {
RenderObject* beforeChildContainer = beforeChild->parent();
while (beforeChildContainer->parent() != this)
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderRuby.cpp (145642 => 145643)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderRuby.cpp 2013-03-13 00:51:48 UTC (rev 145642)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderRuby.cpp 2013-03-13 00:53:53 UTC (rev 145643)
@@ -183,7 +183,7 @@
RenderRubyRun* lastRun = lastRubyRun(this);
if (!lastRun || lastRun->hasRubyText()) {
lastRun = RenderRubyRun::staticCreateRubyRun(this);
- RenderInline::addChild(lastRun);
+ RenderInline::addChild(lastRun, beforeChild);
}
lastRun->addChild(child);
}
@@ -290,7 +290,7 @@
RenderRubyRun* lastRun = lastRubyRun(this);
if (!lastRun || lastRun->hasRubyText()) {
lastRun = RenderRubyRun::staticCreateRubyRun(this);
- RenderBlock::addChild(lastRun);
+ RenderBlock::addChild(lastRun, beforeChild);
}
lastRun->addChild(child);
}
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderTable.cpp (145642 => 145643)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderTable.cpp 2013-03-13 00:51:48 UTC (rev 145642)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderTable.cpp 2013-03-13 00:53:53 UTC (rev 145643)
@@ -110,10 +110,6 @@
void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
{
- // Make sure we don't append things after :after-generated content if we have it.
- if (!beforeChild)
- beforeChild = afterPseudoElementRenderer();
-
bool wrapInAnonymousSection = !child->isPositioned();
if (child->isTableCaption()) {
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderTableRow.cpp (145642 => 145643)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderTableRow.cpp 2013-03-13 00:51:48 UTC (rev 145642)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderTableRow.cpp 2013-03-13 00:53:53 UTC (rev 145643)
@@ -85,10 +85,6 @@
void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
{
- // Make sure we don't append things after :after-generated content if we have it.
- if (!beforeChild)
- beforeChild = afterPseudoElementRenderer();
-
if (!child->isTableCell()) {
RenderObject* last = beforeChild;
if (!last)
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderTableSection.cpp (145642 => 145643)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderTableSection.cpp 2013-03-13 00:51:48 UTC (rev 145642)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderTableSection.cpp 2013-03-13 00:53:53 UTC (rev 145643)
@@ -125,10 +125,6 @@
void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild)
{
- // Make sure we don't append things after :after-generated content if we have it.
- if (!beforeChild)
- beforeChild = afterPseudoElementRenderer();
-
if (!child->isTableRow()) {
RenderObject* last = beforeChild;
if (!last)
