Title: [179643] branches/safari-600.1.4.15-branch
- Revision
- 179643
- Author
- [email protected]
- Date
- 2015-02-04 15:29:30 -0800 (Wed, 04 Feb 2015)
Log Message
Merged r175641. rdar://problem/19718883
Modified Paths
Diff
Modified: branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog (179642 => 179643)
--- branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog 2015-02-04 23:28:17 UTC (rev 179642)
+++ branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog 2015-02-04 23:29:30 UTC (rev 179643)
@@ -1,5 +1,20 @@
2015-02-04 Lucas Forschler <[email protected]>
+ Merge r175641
+
+ 2014-11-04 David Hyatt <[email protected]>
+
+ Descendant ends up in wrong flow thread with nested columns and spans.
+ https://bugs.webkit.org/show_bug.cgi?id=137273
+
+ Reviewed by Simon Fraser.
+
+ Unskipped the two problematic span tests.
+
+ * TestExpectations:
+
+2015-02-04 Lucas Forschler <[email protected]>
+
Merge r174085
2014-09-29 David Hyatt <[email protected]>
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog (179642 => 179643)
--- branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog 2015-02-04 23:28:17 UTC (rev 179642)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog 2015-02-04 23:29:30 UTC (rev 179643)
@@ -1,5 +1,32 @@
2015-02-04 Lucas Forschler <[email protected]>
+ Merge r175641
+
+ 2014-11-04 David Hyatt <[email protected]>
+
+ Descendant ends up in wrong flow thread with nested columns and spans.
+ https://bugs.webkit.org/show_bug.cgi?id=137273
+
+ Reviewed by Simon Fraser.
+
+ Unskipped the two problematic span tests.
+
+ * rendering/RenderMultiColumnFlowThread.cpp:
+ (WebCore::isValidColumnSpanner):
+ Remove the guard and comment and added the assertion back in.
+
+ (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
+ Changed to no longer use handleSpannerRemoval. Because the spanner was removed from the flow thread's map,
+ handleSpannerRemoval was a no-op. So instead I just removed the placeholder by hand.
+
+ The second fix was to stop destroying the placeholder. Since the placeholder can just have been inserted, you
+ can't delete it, since otherwise code further up the stack will access the deleted object. For now, we just
+ leak the placeholder.
+
+ The third fix is to make sure the subtreeRoot is properly updated to be the new placeholder.
+
+2015-02-04 Lucas Forschler <[email protected]>
+
Merge r174085
2014-09-29 David Hyatt <[email protected]>
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (179642 => 179643)
--- branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2015-02-04 23:28:17 UTC (rev 179642)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2015-02-04 23:29:30 UTC (rev 179643)
@@ -385,9 +385,10 @@
// We have to nuke the placeholder, since the ancestor already lost the mapping to it when
// we shifted the placeholder down into this flow thread.
- ancestorBlock->multiColumnFlowThread()->handleSpannerRemoval(spanner);
- placeholder->destroy();
-
+ if (subtreeRoot == descendant)
+ subtreeRoot = spanner;
+ placeholder->parent()->removeChild(*placeholder);
+
// Now we process the spanner.
descendant = processPossibleSpannerDescendant(subtreeRoot, spanner);
continue;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
