Title: [176750] trunk
- Revision
- 176750
- Author
- [email protected]
- Date
- 2014-12-03 12:53:49 -0800 (Wed, 03 Dec 2014)
Log Message
ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
https://bugs.webkit.org/show_bug.cgi?id=139188
rdar://problem/18502182
Reviewed by David Hyatt.
This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
(descendant's parent is expected to be a RenderBlockFlow)
Source/WebCore:
Test: fast/multicol/svg-content-as-column-spanner-crash.html
* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):
LayoutTests:
* fast/multicol/svg-content-as-column-spanner-crash-expected.txt: Added.
* fast/multicol/svg-content-as-column-spanner-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (176749 => 176750)
--- trunk/LayoutTests/ChangeLog 2014-12-03 20:42:22 UTC (rev 176749)
+++ trunk/LayoutTests/ChangeLog 2014-12-03 20:53:49 UTC (rev 176750)
@@ -1,3 +1,18 @@
+2014-12-03 Zalan Bujtas <[email protected]>
+
+ ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
+ https://bugs.webkit.org/show_bug.cgi?id=139188
+ rdar://problem/18502182
+
+ Reviewed by David Hyatt.
+
+ This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
+ with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
+ (descendant's parent is expected to be a RenderBlockFlow)
+
+ * fast/multicol/svg-content-as-column-spanner-crash-expected.txt: Added.
+ * fast/multicol/svg-content-as-column-spanner-crash.html: Added.
+
2014-12-03 Joanmarie Diggs <[email protected]>
AX: [ATK] Inline text elements with accessible object attributes and/or event handlers are not exposed
Added: trunk/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash-expected.txt (0 => 176750)
--- trunk/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash-expected.txt 2014-12-03 20:53:49 UTC (rev 176750)
@@ -0,0 +1,2 @@
+PASS if no crash.
+
Added: trunk/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash.html (0 => 176750)
--- trunk/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash.html 2014-12-03 20:53:49 UTC (rev 176750)
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 200">
+ <g>
+ <text id="text">PASS if no crash.</text>
+ </g>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ document.getElementById("text").setAttribute("style","-webkit-column-span:all;");
+ document.documentElement.setAttribute("style","-webkit-mask-origin:content;overflow:-webkit-paged-y;");
+ </script>
+</svg>
Modified: trunk/Source/WebCore/ChangeLog (176749 => 176750)
--- trunk/Source/WebCore/ChangeLog 2014-12-03 20:42:22 UTC (rev 176749)
+++ trunk/Source/WebCore/ChangeLog 2014-12-03 20:53:49 UTC (rev 176750)
@@ -1,3 +1,20 @@
+2014-12-03 Zalan Bujtas <[email protected]>
+
+ ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
+ https://bugs.webkit.org/show_bug.cgi?id=139188
+ rdar://problem/18502182
+
+ Reviewed by David Hyatt.
+
+ This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
+ with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
+ (descendant's parent is expected to be a RenderBlockFlow)
+
+ Test: fast/multicol/svg-content-as-column-spanner-crash.html
+
+ * rendering/RenderMultiColumnFlowThread.cpp:
+ (WebCore::isValidColumnSpanner):
+
2014-12-03 [email protected] <[email protected]>
[TexMap] Redundant method in GraphicsLayerTextureMapper.
Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (176749 => 176750)
--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2014-12-03 20:42:22 UTC (rev 176749)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2014-12-03 20:53:49 UTC (rev 176750)
@@ -249,7 +249,7 @@
if (style.columnSpan() != ColumnSpanAll || !is<RenderBox>(*descendant) || descendant->isFloatingOrOutOfFlowPositioned())
return false;
- RenderBlock* container = descendant->containingBlock();
+ RenderElement* container = descendant->parent();
if (!is<RenderBlockFlow>(*container) || container->childrenInline()) {
// Needs to be block-level.
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
