Title: [118050] branches/chromium/1084
- Revision
- 118050
- Author
- [email protected]
- Date
- 2012-05-22 14:01:28 -0700 (Tue, 22 May 2012)
Log Message
Merge 116683
BUG=126723
Review URL: https://chromiumcodereview.appspot.com/10332302
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1084/LayoutTests/fast/block/float/float-not-removed-from-first-letter-expected.txt (from rev 116683, trunk/LayoutTests/fast/block/float/float-not-removed-from-first-letter-expected.txt) (0 => 118050)
--- branches/chromium/1084/LayoutTests/fast/block/float/float-not-removed-from-first-letter-expected.txt (rev 0)
+++ branches/chromium/1084/LayoutTests/fast/block/float/float-not-removed-from-first-letter-expected.txt 2012-05-22 21:01:28 UTC (rev 118050)
@@ -0,0 +1,3 @@
+Webkit Bug 86019 - Crash due to floats not removed from first-letter element.
+
+PASS. WebKit didn't crash.
Copied: branches/chromium/1084/LayoutTests/fast/block/float/float-not-removed-from-first-letter.html (from rev 116683, trunk/LayoutTests/fast/block/float/float-not-removed-from-first-letter.html) (0 => 118050)
--- branches/chromium/1084/LayoutTests/fast/block/float/float-not-removed-from-first-letter.html (rev 0)
+++ branches/chromium/1084/LayoutTests/fast/block/float/float-not-removed-from-first-letter.html 2012-05-22 21:01:28 UTC (rev 118050)
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+Webkit Bug 86019 - Crash due to floats not removed from first-letter element.
+<style>
+.li2 { width: 0px; }
+.li2:first-letter { float: left; content: counter(section); }
+.li2:first-of-type { display: -webkit-inline-flexbox; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function crash() {
+ li1 = document.createElement('li');
+ document.documentElement.appendChild(li1);
+ keygen1 = document.createElement('keygen');
+ keygen1.setAttribute('autofocus', 'autofocus');
+ document.documentElement.appendChild(keygen1);
+ li2 = document.createElement('li');
+ li2.setAttribute('class', 'li2');
+ document.documentElement.appendChild(li2);
+ text1 = document.createTextNode("PASS. WebKit didn't crash.");
+ li2.appendChild(text1);
+}
+window._onload_ = crash;
+</script>
+</html>
Modified: branches/chromium/1084/Source/WebCore/rendering/RenderObject.cpp (118049 => 118050)
--- branches/chromium/1084/Source/WebCore/rendering/RenderObject.cpp 2012-05-22 20:57:03 UTC (rev 118049)
+++ branches/chromium/1084/Source/WebCore/rendering/RenderObject.cpp 2012-05-22 21:01:28 UTC (rev 118050)
@@ -325,12 +325,6 @@
if (!children)
return;
- // We do this here instead of in removeChildNode, since the only extremely low-level uses of remove/appendChildNode
- // cannot affect the positioned object list, and the floating object list is irrelevant (since the list gets cleared on
- // layout anyway).
- if (oldChild->isFloatingOrPositioned())
- toRenderBox(oldChild)->removeFloatingOrPositionedChildFromBlockLists();
-
children->removeChildNode(this, oldChild);
}
Modified: branches/chromium/1084/Source/WebCore/rendering/RenderObjectChildList.cpp (118049 => 118050)
--- branches/chromium/1084/Source/WebCore/rendering/RenderObjectChildList.cpp 2012-05-22 20:57:03 UTC (rev 118049)
+++ branches/chromium/1084/Source/WebCore/rendering/RenderObjectChildList.cpp 2012-05-22 21:01:28 UTC (rev 118050)
@@ -75,6 +75,9 @@
{
ASSERT(oldChild->parent() == owner);
+ if (oldChild->isFloatingOrPositioned())
+ toRenderBox(oldChild)->removeFloatingOrPositionedChildFromBlockLists();
+
// So that we'll get the appropriate dirty bit set (either that a normal flow child got yanked or
// that a positioned child got yanked). We also repaint, so that the area exposed when the child
// disappears gets repainted properly.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
