Title: [105792] branches/chromium/963
- Revision
- 105792
- Author
- [email protected]
- Date
- 2012-01-24 13:18:50 -0800 (Tue, 24 Jan 2012)
Log Message
Merge 105769 - Crash when rendering -webkit-column-span.
BUG=105459
Review URL: https://chromiumcodereview.appspot.com/9129034
Modified Paths
Added Paths
Diff
Copied: branches/chromium/963/LayoutTests/fast/multicol/clone-block-children-inline-mismatch-crash-expected.txt (from rev 105769, trunk/LayoutTests/fast/multicol/clone-block-children-inline-mismatch-crash-expected.txt) (0 => 105792)
--- branches/chromium/963/LayoutTests/fast/multicol/clone-block-children-inline-mismatch-crash-expected.txt (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/clone-block-children-inline-mismatch-crash-expected.txt 2012-01-24 21:18:50 UTC (rev 105792)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/chromium/963/LayoutTests/fast/multicol/clone-block-children-inline-mismatch-crash.html (from rev 105769, trunk/LayoutTests/fast/multicol/clone-block-children-inline-mismatch-crash.html) (0 => 105792)
--- branches/chromium/963/LayoutTests/fast/multicol/clone-block-children-inline-mismatch-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/clone-block-children-inline-mismatch-crash.html 2012-01-24 21:18:50 UTC (rev 105792)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<style>
+#div1 { -webkit-column-count: 2; }
+#q1 { display: block; }
+#q1::before { display: table-row; }
+#div2 { -webkit-column-span: all; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest()
+{
+ div1 = document.createElement('div');
+ div1.setAttribute('id', 'div1');
+ document.body.appendChild(div1);
+ q1 = document.createElement('q');
+ q1.setAttribute('id', 'q1');
+ div1.appendChild(q1);
+ div2 = document.createElement('div');
+ div2.setAttribute('id', 'div2');
+ q1.appendChild(div2);
+}
+
+window._onload_ = runTest;
+</script>
+</html>
\ No newline at end of file
Copied: branches/chromium/963/LayoutTests/fast/multicol/span/generated-child-split-flow-crash.html (from rev 105769, trunk/LayoutTests/fast/multicol/span/generated-child-split-flow-crash.html) (0 => 105792)
--- branches/chromium/963/LayoutTests/fast/multicol/span/generated-child-split-flow-crash.html (rev 0)
+++ branches/chromium/963/LayoutTests/fast/multicol/span/generated-child-split-flow-crash.html 2012-01-24 21:18:50 UTC (rev 105792)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html style="font-family: ahem; -webkit-font-smoothing: none;">
+<style>
+ #div1 {
+ -webkit-column-count: 2;
+ }
+ #span1:after
+ {
+ display: block;
+ content: counter(c);
+ color: green;
+ -webkit-column-span: all;
+ }
+</style>
+<div id="div1">
+A<span id="span1" style="color: blue">B</span>C
+</div>
+<script>
+function runTest()
+{
+ span1 = document.getElementById('span1');
+ span1.style.display = 'block';
+ document.body.offsetTop;
+ document.body.style.zoom = 2;
+}
+
+window._onload_ = runTest;
+</script>
+</html>
\ No newline at end of file
Modified: branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp (105791 => 105792)
--- branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-01-24 21:18:36 UTC (rev 105791)
+++ branches/chromium/963/Source/WebCore/rendering/RenderBlock.cpp 2012-01-24 21:18:50 UTC (rev 105792)
@@ -446,6 +446,8 @@
else {
cloneBlock = new (renderArena()) RenderBlock(node());
cloneBlock->setStyle(style());
+ if (!childrenInline() && cloneBlock->firstChild() && cloneBlock->firstChild()->isInline())
+ cloneBlock->makeChildrenNonInline();
}
cloneBlock->setChildrenInline(childrenInline());
return cloneBlock;
@@ -659,8 +661,8 @@
// cross the streams and have to cope with both types of continuations mixed together).
// This function currently supports (1) and (2).
RenderBlock* columnsBlockAncestor = 0;
- if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isFloatingOrPositioned()
- && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
+ if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isBeforeOrAfterContent()
+ && !newChild->isFloatingOrPositioned() && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
if (style()->specifiesColumns())
columnsBlockAncestor = this;
else if (!isInline() && parent() && parent()->isRenderBlock()) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
