Title: [176732] branches/safari-600.3-branch
- Revision
- 176732
- Author
- [email protected]
- Date
- 2014-12-03 11:55:42 -0800 (Wed, 03 Dec 2014)
Log Message
Merged r176295. rdar://problems/19122588
Modified Paths
Added Paths
Diff
Modified: branches/safari-600.3-branch/LayoutTests/ChangeLog (176731 => 176732)
--- branches/safari-600.3-branch/LayoutTests/ChangeLog 2014-12-03 19:51:28 UTC (rev 176731)
+++ branches/safari-600.3-branch/LayoutTests/ChangeLog 2014-12-03 19:55:42 UTC (rev 176732)
@@ -1,3 +1,18 @@
+2014-12-03 Dana Burkart <[email protected]>
+
+ Merge r176295. <rdar://problem/19122588>
+
+ 2014-11-18 David Hyatt <[email protected]>
+
+ REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+ https://bugs.webkit.org/show_bug.cgi?id=137590
+
+ Reviewed by Dean Jackson.
+
+ * fast/block/selection-block-gap-crash-expected.txt: Added.
+ * fast/block/selection-block-gap-crash.html: Added.
+
+
2014-11-05 Simon Fraser <[email protected]>
Avoid backing store for opacity:0 descendant layers
Added: branches/safari-600.3-branch/LayoutTests/fast/block/selection-block-gap-crash-expected.txt (0 => 176732)
--- branches/safari-600.3-branch/LayoutTests/fast/block/selection-block-gap-crash-expected.txt (rev 0)
+++ branches/safari-600.3-branch/LayoutTests/fast/block/selection-block-gap-crash-expected.txt 2014-12-03 19:55:42 UTC (rev 176732)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: branches/safari-600.3-branch/LayoutTests/fast/block/selection-block-gap-crash.html (0 => 176732)
--- branches/safari-600.3-branch/LayoutTests/fast/block/selection-block-gap-crash.html (rev 0)
+++ branches/safari-600.3-branch/LayoutTests/fast/block/selection-block-gap-crash.html 2014-12-03 19:55:42 UTC (rev 176732)
@@ -0,0 +1,11 @@
+This test passes if it doesn't crash.
+<div role="img" id="div"></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText()
+var elem = document.getElementById("div"); var parent = elem.parentNode;
+new_elem = document.createElement("frameset");
+new_elem.setAttribute("role", "img");
+parent.insertBefore(new_elem, elem);
+document.execCommand("SelectAll");
+</script>
Modified: branches/safari-600.3-branch/Source/WebCore/ChangeLog (176731 => 176732)
--- branches/safari-600.3-branch/Source/WebCore/ChangeLog 2014-12-03 19:51:28 UTC (rev 176731)
+++ branches/safari-600.3-branch/Source/WebCore/ChangeLog 2014-12-03 19:55:42 UTC (rev 176732)
@@ -1,5 +1,23 @@
2014-12-03 Dana Burkart <[email protected]>
+ Merge r176295. <rdar://problem/19122588>
+
+ 2014-11-18 David Hyatt <[email protected]>
+
+ REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+ https://bugs.webkit.org/show_bug.cgi?id=137590
+
+ Reviewed by Dean Jackson.
+
+ Added fast/block/selection-block-gaps-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::blockSelectionGaps):
+ Check that we really are a RenderBlock before recurring.
+
+
+2014-12-03 Dana Burkart <[email protected]>
+
Merge r175974. <rdar://problem/19122595>
2014-11-11 David Kilzer <[email protected]>
Modified: branches/safari-600.3-branch/Source/WebCore/rendering/RenderBlock.cpp (176731 => 176732)
--- branches/safari-600.3-branch/Source/WebCore/rendering/RenderBlock.cpp 2014-12-03 19:51:28 UTC (rev 176731)
+++ branches/safari-600.3-branch/Source/WebCore/rendering/RenderBlock.cpp 2014-12-03 19:55:42 UTC (rev 176732)
@@ -2039,7 +2039,7 @@
lastLogicalTop = blockDirectionOffset(rootBlock, offsetFromRootBlock) + curr->logicalBottom();
lastLogicalLeft = logicalLeftSelectionOffset(rootBlock, curr->logicalBottom(), cache);
lastLogicalRight = logicalRightSelectionOffset(rootBlock, curr->logicalBottom(), cache);
- } else if (childState != SelectionNone) {
+ } else if (childState != SelectionNone && is<RenderBlock>(*curr)) {
// We must be a block that has some selected object inside it. Go ahead and recur.
result.unite(toRenderBlock(curr)->selectionGaps(rootBlock, rootBlockPhysicalPosition, LayoutSize(offsetFromRootBlock.width() + curr->x(), offsetFromRootBlock.height() + curr->y()),
lastLogicalTop, lastLogicalLeft, lastLogicalRight, childCache, paintInfo));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
