[webkit-changes] [148454] branches/safari-536.30-branch

Mon, 15 Apr 2013 11:25:58 -0700

Title: [148454] branches/safari-536.30-branch

Diff

Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (148453 => 148454)


--- branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-04-15 18:23:37 UTC (rev 148453)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog	2013-04-15 18:27:47 UTC (rev 148454)
@@ -1,5 +1,19 @@
 2013-04-15  Roger Fong  <[email protected]>
 
+        Merge r142816.
+
+    2013-02-13  Abhishek Arya  <[email protected]>
+
+            ASSERTION FAILED: !object || object->isBox(), Bad cast in RenderBox::computeLogicalHeight
+            https://bugs.webkit.org/show_bug.cgi?id=107748
+
+            Reviewed by Levi Weintraub.
+
+            * fast/block/body-inline-block-crash-expected.txt: Added.
+            * fast/block/body-inline-block-crash.html: Added.
+
+2013-04-15  Roger Fong  <[email protected]>
+
         Merge r142922.
 
     2013-02-14  Abhishek Arya  <[email protected]>

Added: branches/safari-536.30-branch/LayoutTests/fast/block/body-inline-block-crash-expected.txt (0 => 148454)


--- branches/safari-536.30-branch/LayoutTests/fast/block/body-inline-block-crash-expected.txt	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/block/body-inline-block-crash-expected.txt	2013-04-15 18:27:47 UTC (rev 148454)
@@ -0,0 +1 @@
+Test passes if it does not crash.

Added: branches/safari-536.30-branch/LayoutTests/fast/block/body-inline-block-crash.html (0 => 148454)


--- branches/safari-536.30-branch/LayoutTests/fast/block/body-inline-block-crash.html	                        (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/block/body-inline-block-crash.html	2013-04-15 18:27:47 UTC (rev 148454)
@@ -0,0 +1,16 @@
+<html>
+Test passes if it does not crash.
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+function crash() {
+    body1 = document.createElement("body");
+    i1 = document.createElement("i");
+    document.documentElement.appendChild(i1);
+    i1.appendChild(body1);
+    body1.style.display = "inline-block";
+}
+document.addEventListener("DOMContentLoaded", crash, false);
+</script>
+</html>

Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (148453 => 148454)


--- branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-04-15 18:23:37 UTC (rev 148453)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog	2013-04-15 18:27:47 UTC (rev 148454)
@@ -1,5 +1,27 @@
 2013-04-15  Roger Fong  <[email protected]>
 
+        Merge r142816.
+
+    2013-02-13  Abhishek Arya  <[email protected]>
+
+            ASSERTION FAILED: !object || object->isBox(), Bad cast in RenderBox::computeLogicalHeight
+            https://bugs.webkit.org/show_bug.cgi?id=107748
+
+            Reviewed by Levi Weintraub.
+
+            Make sure that body renderer is not an inline-block display
+            when determining that it stretches to viewport or when paginated
+            content needs base height.
+
+            Test: fast/block/body-inline-block-crash.html
+
+            * rendering/RenderBox.cpp:
+            (WebCore::RenderBox::computeLogicalHeight):
+            * rendering/RenderBox.h:
+            (WebCore::RenderBox::stretchesToViewport):
+
+2013-04-15  Roger Fong  <[email protected]>
+
         Merge r142922.
 
     2013-02-14  Abhishek Arya  <[email protected]>

Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.cpp (148453 => 148454)


--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.cpp	2013-04-15 18:23:37 UTC (rev 148453)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.cpp	2013-04-15 18:27:47 UTC (rev 148454)
@@ -2143,7 +2143,7 @@
     // height since we don't set a height in RenderView when we're printing. So without this quirk, the 
     // height has nothing to be a percentage of, and it ends up being 0. That is bad.
     bool paginatedContentNeedsBaseHeight = document()->printing() && h.isPercent()
-        && (isRoot() || (isBody() && document()->documentElement()->renderer()->style()->logicalHeight().isPercent()));
+        && (isRoot() || (isBody() && document()->documentElement()->renderer()->style()->logicalHeight().isPercent())) && !isInline();
     if (stretchesToViewport() || paginatedContentNeedsBaseHeight) {
         // FIXME: Finish accounting for block flow here.
         // https://bugs.webkit.org/show_bug.cgi?id=46603

Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.h (148453 => 148454)


--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.h	2013-04-15 18:23:37 UTC (rev 148453)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderBox.h	2013-04-15 18:27:47 UTC (rev 148454)
@@ -327,7 +327,7 @@
 
     bool stretchesToViewport() const
     {
-        return document()->inQuirksMode() && style()->logicalHeight().isAuto() && !isFloatingOrPositioned() && (isRoot() || isBody());
+        return document()->inQuirksMode() && style()->logicalHeight().isAuto() && !isPositioned() && (isRoot() || isBody()) && !document()->shouldDisplaySeamlesslyWithParent() && !isInline();
     }
 
     virtual IntSize intrinsicSize() const { return IntSize(); }

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to