Title: [169160] trunk
- Revision
- 169160
- Author
- [email protected]
- Date
- 2014-05-21 08:31:20 -0700 (Wed, 21 May 2014)
Log Message
REGRESSION (r168046): Invalid layout in WebCore::RenderBox::containingBlockLogicalWidthForPositioned
https://bugs.webkit.org/show_bug.cgi?id=132933
Reviewed by Darin Adler.
Source/WebCore:
Invalid layout is performed when calling containingBlockLogicalWidthForPositioned for a RenderTableSection object.
Test: fast/multicol/newmulticol/table-section-crash.html
* rendering/RenderBox.cpp:
(WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
LayoutTests:
Added test for crash caused by invalid layout for RenderTableSection.
* fast/multicol/newmulticol/table-section-crash-expected.txt: Added.
* fast/multicol/newmulticol/table-section-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (169159 => 169160)
--- trunk/LayoutTests/ChangeLog 2014-05-21 14:56:52 UTC (rev 169159)
+++ trunk/LayoutTests/ChangeLog 2014-05-21 15:31:20 UTC (rev 169160)
@@ -1,3 +1,15 @@
+2014-05-21 Radu Stavila <[email protected]>
+
+ REGRESSION (r168046): Invalid layout in WebCore::RenderBox::containingBlockLogicalWidthForPositioned
+ https://bugs.webkit.org/show_bug.cgi?id=132933
+
+ Reviewed by Darin Adler.
+
+ Added test for crash caused by invalid layout for RenderTableSection.
+
+ * fast/multicol/newmulticol/table-section-crash-expected.txt: Added.
+ * fast/multicol/newmulticol/table-section-crash.html: Added.
+
2014-05-21 Eva Balazsfalvi <[email protected]>
REGRESSION(r169092 and r169102): Skip failing JSC tests on ARM64 properly
Added: trunk/LayoutTests/fast/multicol/newmulticol/table-section-crash-expected.txt (0 => 169160)
--- trunk/LayoutTests/fast/multicol/newmulticol/table-section-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/newmulticol/table-section-crash-expected.txt 2014-05-21 15:31:20 UTC (rev 169160)
@@ -0,0 +1 @@
+
Added: trunk/LayoutTests/fast/multicol/newmulticol/table-section-crash.html (0 => 169160)
--- trunk/LayoutTests/fast/multicol/newmulticol/table-section-crash.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/newmulticol/table-section-crash.html 2014-05-21 15:31:20 UTC (rev 169160)
@@ -0,0 +1,39 @@
+<!-- This test passes if it doesn't crash - https://bugs.webkit.org/show_bug.cgi?id=132933 -->
+
+<body style="width: 800px; height: 600px">
+ <table>
+ <td id="td">
+ <table>
+ <tr id="td">
+</body>
+
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ var head = document.getElementsByTagName("head")[0];
+ var style = document.createElement("style");
+ var rule = document.createTextNode("* { visibility: hidden; } #td { position: absolute;");
+ style.appendChild(rule);
+ head.appendChild(style);
+ style = document.createElement("style");
+ style.innerHTML = "* { \n\
+ position: -webkit-sticky;\n\
+ -webkit-animation-direction: alternate-reverse;";
+
+ head.appendChild(style);
+ style = document.createElement("style");
+ style.innerHTML = "#td { \n\
+ -webkit-animation-name: name3; \n\
+ -webkit-animation-duration: 9s; \n\
+ } \n\
+ @-webkit-keyframes name3 { \n\
+ from { \n\
+ } \n\
+ to { \n\
+ -webkit-column-count: 4294967167;";
+
+ head.appendChild(style);
+
+ //head.removeChild(style);
+</script>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (169159 => 169160)
--- trunk/Source/WebCore/ChangeLog 2014-05-21 14:56:52 UTC (rev 169159)
+++ trunk/Source/WebCore/ChangeLog 2014-05-21 15:31:20 UTC (rev 169160)
@@ -1,3 +1,17 @@
+2014-05-21 Radu Stavila <[email protected]>
+
+ REGRESSION (r168046): Invalid layout in WebCore::RenderBox::containingBlockLogicalWidthForPositioned
+ https://bugs.webkit.org/show_bug.cgi?id=132933
+
+ Reviewed by Darin Adler.
+
+ Invalid layout is performed when calling containingBlockLogicalWidthForPositioned for a RenderTableSection object.
+
+ Test: fast/multicol/newmulticol/table-section-crash.html
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
+
2014-05-21 Simon Pena <[email protected]>
[EFL] Ensure EGLOffScreenContext::initialize calls platformMakeCurrent on the surface
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (169159 => 169160)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2014-05-21 14:56:52 UTC (rev 169159)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2014-05-21 15:31:20 UTC (rev 169160)
@@ -3073,6 +3073,9 @@
if (isFixedPosition && containingBlock->isRenderNamedFlowThread())
return containingBlock->view().clientLogicalWidth();
+ if (!containingBlock->isRenderBlock())
+ return toRenderBox(*containingBlock).clientLogicalWidth();
+
const RenderBlock* cb = toRenderBlock(containingBlock);
RenderBoxRegionInfo* boxInfo = 0;
if (!region) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
