Title: [179656] branches/safari-600.5-branch
- Revision
- 179656
- Author
- [email protected]
- Date
- 2015-02-04 18:36:16 -0800 (Wed, 04 Feb 2015)
Log Message
Merge r176750. rdar://problem/19617755
Modified Paths
Added Paths
Diff
Modified: branches/safari-600.5-branch/LayoutTests/ChangeLog (179655 => 179656)
--- branches/safari-600.5-branch/LayoutTests/ChangeLog 2015-02-05 02:36:12 UTC (rev 179655)
+++ branches/safari-600.5-branch/LayoutTests/ChangeLog 2015-02-05 02:36:16 UTC (rev 179656)
@@ -1,5 +1,24 @@
2015-02-04 Matthew Hanson <[email protected]>
+ Merge r176750. rdar://problem/19617755
+
+ 2014-12-03 Zalan Bujtas <[email protected]>
+
+ ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
+ https://bugs.webkit.org/show_bug.cgi?id=139188
+ rdar://problem/18502182
+
+ Reviewed by David Hyatt.
+
+ This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
+ with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
+ (descendant's parent is expected to be a RenderBlockFlow)
+
+ * fast/multicol/svg-content-as-column-spanner-crash-expected.txt: Added.
+ * fast/multicol/svg-content-as-column-spanner-crash.html: Added.
+
+2015-02-04 Matthew Hanson <[email protected]>
+
Merge r175236. rdar://problem/19451378
2014-10-24 David Hyatt <[email protected]>
Added: branches/safari-600.5-branch/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash-expected.txt (0 => 179656)
--- branches/safari-600.5-branch/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash-expected.txt (rev 0)
+++ branches/safari-600.5-branch/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash-expected.txt 2015-02-05 02:36:16 UTC (rev 179656)
@@ -0,0 +1,2 @@
+PASS if no crash.
+
Added: branches/safari-600.5-branch/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash.html (0 => 179656)
--- branches/safari-600.5-branch/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash.html (rev 0)
+++ branches/safari-600.5-branch/LayoutTests/fast/multicol/svg-content-as-column-spanner-crash.html 2015-02-05 02:36:16 UTC (rev 179656)
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 200">
+ <g>
+ <text id="text">PASS if no crash.</text>
+ </g>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ document.getElementById("text").setAttribute("style","-webkit-column-span:all;");
+ document.documentElement.setAttribute("style","-webkit-mask-origin:content;overflow:-webkit-paged-y;");
+ </script>
+</svg>
Modified: branches/safari-600.5-branch/Source/WebCore/ChangeLog (179655 => 179656)
--- branches/safari-600.5-branch/Source/WebCore/ChangeLog 2015-02-05 02:36:12 UTC (rev 179655)
+++ branches/safari-600.5-branch/Source/WebCore/ChangeLog 2015-02-05 02:36:16 UTC (rev 179656)
@@ -1,5 +1,26 @@
2015-02-04 Matthew Hanson <[email protected]>
+ Merge r176750. rdar://problem/19617755
+
+ 2014-12-03 Zalan Bujtas <[email protected]>
+
+ ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
+ https://bugs.webkit.org/show_bug.cgi?id=139188
+ rdar://problem/18502182
+
+ Reviewed by David Hyatt.
+
+ This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
+ with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
+ (descendant's parent is expected to be a RenderBlockFlow)
+
+ Test: fast/multicol/svg-content-as-column-spanner-crash.html
+
+ * rendering/RenderMultiColumnFlowThread.cpp:
+ (WebCore::isValidColumnSpanner):
+
+2015-02-04 Matthew Hanson <[email protected]>
+
Merge r175236. rdar://problem/19451378
2014-10-24 David Hyatt <[email protected]>
Modified: branches/safari-600.5-branch/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (179655 => 179656)
--- branches/safari-600.5-branch/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2015-02-05 02:36:12 UTC (rev 179655)
+++ branches/safari-600.5-branch/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2015-02-05 02:36:16 UTC (rev 179656)
@@ -252,7 +252,7 @@
if (style.columnSpan() != ColumnSpanAll || !descendant->isBox() || descendant->isFloatingOrOutOfFlowPositioned())
return false;
- RenderBlock* container = descendant->containingBlock();
+ RenderElement* container = descendant->parent();
if (!container->isRenderBlockFlow() || container->childrenInline()) {
// Needs to be block-level.
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
