Title: [118869] branches/chromium/1132
- Revision
- 118869
- Author
- [email protected]
- Date
- 2012-05-29 18:09:49 -0700 (Tue, 29 May 2012)
Log Message
Merge 118248
BUG=126475
Review URL: https://chromiumcodereview.appspot.com/10442075
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt (from rev 118248, trunk/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt) (0 => 118869)
--- branches/chromium/1132/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt 2012-05-30 01:09:49 UTC (rev 118869)
@@ -0,0 +1,3 @@
+WebKit Bug 85804 - Crash in RenderInline::linesVisualOverflowBoundingBox.
+Test passes if it does not crash.
+
Copied: branches/chromium/1132/LayoutTests/fast/block/inline-children-root-linebox-crash.html (from rev 118248, trunk/LayoutTests/fast/block/inline-children-root-linebox-crash.html) (0 => 118869)
--- branches/chromium/1132/LayoutTests/fast/block/inline-children-root-linebox-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/fast/block/inline-children-root-linebox-crash.html 2012-05-30 01:09:49 UTC (rev 118869)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+WebKit Bug 85804 - Crash in RenderInline::linesVisualOverflowBoundingBox.<br />
+Test passes if it does not crash.
+<div style='-webkit-writing-mode: vertical-rl;'>
+<div style='-webkit-transform: translatey(1px) translatez(1px) rotatex(1deg);'></div>
+<textarea></textarea>
+<span style='-webkit-opacity: 0.0;'/>
+<input autofocus>
+</div>
+<body dir=rtl>
+</body>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+</html>
Modified: branches/chromium/1132/Source/WebCore/rendering/RenderBlockLineLayout.cpp (118868 => 118869)
--- branches/chromium/1132/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2012-05-30 01:05:35 UTC (rev 118868)
+++ branches/chromium/1132/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2012-05-30 01:09:49 UTC (rev 118869)
@@ -1499,7 +1499,6 @@
else if (layoutState.isFullLayout() || o->needsLayout()) {
// Replaced elements
toRenderBox(o)->dirtyLineBoxes(layoutState.isFullLayout());
- o->layoutIfNeeded();
}
} else if (o->isText() || (o->isRenderInline() && !walker.atEndOfInline())) {
if (!o->isText())
@@ -2269,6 +2268,7 @@
width.addUncommittedWidth(borderPaddingMarginStart(flowBox) + borderPaddingMarginEnd(flowBox));
} else if (current.m_obj->isReplaced()) {
RenderBox* replacedBox = toRenderBox(current.m_obj);
+ replacedBox->layoutIfNeeded();
// Break on replaced elements if either has normal white-space.
if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!current.m_obj->isImage() || allowImagesToBreak)) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
