Title: [118037] branches/chromium/1132
- Revision
- 118037
- Author
- [email protected]
- Date
- 2012-05-22 13:21:58 -0700 (Tue, 22 May 2012)
Log Message
Merge 116551
BUG=125563
Review URL: https://chromiumcodereview.appspot.com/10412039
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/fast/block/line-layout/line-break-removal-near-textarea-crash-expected.txt (from rev 116551, trunk/LayoutTests/fast/block/line-layout/line-break-removal-near-textarea-crash-expected.txt) (0 => 118037)
--- branches/chromium/1132/LayoutTests/fast/block/line-layout/line-break-removal-near-textarea-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/block/line-layout/line-break-removal-near-textarea-crash-expected.txt 2012-05-22 20:21:58 UTC (rev 118037)
@@ -0,0 +1,2 @@
+PASS, if no crash or assert in debug
+abc
Copied: branches/chromium/1132/LayoutTests/fast/block/line-layout/line-break-removal-near-textarea-crash.html (from rev 116551, trunk/LayoutTests/fast/block/line-layout/line-break-removal-near-textarea-crash.html) (0 => 118037)
--- branches/chromium/1132/LayoutTests/fast/block/line-layout/line-break-removal-near-textarea-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/block/line-layout/line-break-removal-near-textarea-crash.html 2012-05-22 20:21:58 UTC (rev 118037)
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+<style>
+.style1 { display: table-row; content: counter(section); }
+.style2 { position: fixed; }
+.style3 { vertical-align: super; -webkit-appearance: button; -webkit-column-width: 100px; }
+.style3:nth-of-type(2n) { display: list-item; }
+</style>
+<script>
+window._onload_ = function() {
+ div1 = document.createElement('div');
+ document.documentElement.appendChild(div1);
+
+ spanElem1 = document.createElement('span');
+ spanElem1.setAttribute('class', 'style3');
+ document.documentElement.appendChild(spanElem1);
+
+ spanElem2 = document.createElement('span');
+ spanElem1.appendChild(spanElem2);
+ spanElem1.appendChild(document.createTextNode('abc'));
+
+ textareaElem = document.createElement('textarea');
+ textareaElem.setAttribute('class', 'style1');
+ spanElem2.appendChild(textareaElem);
+
+ canvasElem = document.createElement('canvas');
+ spanElem2.appendChild(canvasElem);
+
+ paragraphElem = document.createElement('p');
+ paragraphElem.setAttribute('class', 'style2');
+ spanElem2.appendChild(paragraphElem);
+
+ document.execCommand("SelectAll", false, "");
+ window.scrollBy(-15, -48);
+ document.documentElement.offsetHeight;
+
+ div1.setAttribute('class', 'style3');
+ spanElem2.removeChild(paragraphElem);
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+}
+</script>
+<body>
+PASS, if no crash or assert in debug
+</body>
+</html>
Modified: branches/chromium/1132/Source/WebCore/rendering/RenderObject.h (118036 => 118037)
--- branches/chromium/1132/Source/WebCore/rendering/RenderObject.h 2012-05-22 20:20:47 UTC (rev 118036)
+++ branches/chromium/1132/Source/WebCore/rendering/RenderObject.h 2012-05-22 20:21:58 UTC (rev 118037)
@@ -389,6 +389,7 @@
if (!s_ancestorLineboxDirtySet)
s_ancestorLineboxDirtySet = new RenderObjectAncestorLineboxDirtySet;
s_ancestorLineboxDirtySet->add(this);
+ setNeedsLayout(true);
} else if (s_ancestorLineboxDirtySet) {
s_ancestorLineboxDirtySet->remove(this);
if (s_ancestorLineboxDirtySet->isEmpty()) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
