Title: [99030] branches/chromium/912
- Revision
- 99030
- Author
- cev...@google.com
- Date
- 2011-11-01 19:08:13 -0700 (Tue, 01 Nov 2011)
Log Message
Merge 98763
BUG=99597
Review URL: http://codereview.chromium.org/8423033
Modified Paths
Added Paths
Property Changed
Diff
Copied: branches/chromium/912/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt (from rev 98763, trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt) (0 => 99030)
--- branches/chromium/912/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt (rev 0)
+++ branches/chromium/912/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash-expected.txt 2011-11-02 02:08:13 UTC (rev 99030)
@@ -0,0 +1,2 @@
+PASS, if the script does not cause a crash or ASSERT failure
+
Copied: branches/chromium/912/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html (from rev 98763, trunk/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html) (0 => 99030)
--- branches/chromium/912/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html (rev 0)
+++ branches/chromium/912/LayoutTests/fast/css-generated-content/inline-splitting-with-after-float-crash.html 2011-11-02 02:08:13 UTC (rev 99030)
@@ -0,0 +1,27 @@
+<style>
+ .c2:after { float: left; content: "A"; }
+</style>
+PASS, if the script does not cause a crash or ASSERT failure
+<script>
+ function endTest(childSpan) {
+ childSpan.appendChild(divToInsert);
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+ function startTest() {
+ quoteNode = document.createElement('q');
+ document.documentElement.appendChild(quoteNode);
+ divToInsert = document.createElement('div');
+ parentSpan = document.createElement('span');
+ parentSpan.setAttribute('class', 'c2');
+ childSpan = document.createElement('span');
+ parentSpan.appendChild(childSpan);
+ document.documentElement.appendChild(parentSpan);
+ setTimeout('endTest(childSpan);', 50);
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+ }
+ window._onload_ = startTest;
+</script>
Modified: branches/chromium/912/Source/WebCore/rendering/RenderBlock.cpp (99029 => 99030)
--- branches/chromium/912/Source/WebCore/rendering/RenderBlock.cpp 2011-11-02 02:05:05 UTC (rev 99029)
+++ branches/chromium/912/Source/WebCore/rendering/RenderBlock.cpp 2011-11-02 02:08:13 UTC (rev 99030)
@@ -838,6 +838,15 @@
void RenderBlock::deleteLineBoxTree()
{
+ if (containsFloats()) {
+ // Clear references to originating lines, since the lines are being deleted
+ const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+ FloatingObjectSetIterator end = floatingObjectSet.end();
+ for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+ ASSERT(!((*it)->m_originatingLine) || (*it)->m_originatingLine->renderer() == this);
+ (*it)->m_originatingLine = 0;
+ }
+ }
m_lineBoxes.deleteLineBoxTree(renderArena());
}
Property changes on: branches/chromium/912/Source/WebCore/rendering/RenderBlock.cpp
___________________________________________________________________
Added: svn:executable
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
