Title: [120101] branches/chromium/1132
- Revision
- 120101
- Author
- cev...@google.com
- Date
- 2012-06-12 12:07:56 -0700 (Tue, 12 Jun 2012)
Log Message
Merge 119914
BUG=121128
Review URL: https://chromiumcodereview.appspot.com/10533113
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1132/LayoutTests/svg/foreignObject/fO-fixed-position-crash-expected.txt (from rev 119914, trunk/LayoutTests/svg/foreignObject/fO-fixed-position-crash-expected.txt) (0 => 120101)
--- branches/chromium/1132/LayoutTests/svg/foreignObject/fO-fixed-position-crash-expected.txt (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/foreignObject/fO-fixed-position-crash-expected.txt 2012-06-12 19:07:56 UTC (rev 120101)
@@ -0,0 +1 @@
+PASS
Copied: branches/chromium/1132/LayoutTests/svg/foreignObject/fO-fixed-position-crash.html (from rev 119914, trunk/LayoutTests/svg/foreignObject/fO-fixed-position-crash.html) (0 => 120101)
--- branches/chromium/1132/LayoutTests/svg/foreignObject/fO-fixed-position-crash.html (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/foreignObject/fO-fixed-position-crash.html 2012-06-12 19:07:56 UTC (rev 120101)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<body>
+<!-- Test for https://bugs.webkit.org/show_bug.cgi?id=88547 -->
+<svg xmlns="http://www.w3.org/2000/svg">
+ <foreignObject>
+ <div id="div" style="position:fixed; height:50%; counter-increment:inherit;">Passes if replacing this text doesn't cause a crash.</div>
+ </foreignObject>
+
+ <script>
+ window._onload_=function() {
+ document.designMode="on";
+ document.execCommand("SelectAll");
+ document.getElementById('div').innerHTML = "PASS";
+ };
+
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ </script>
+</svg>
+</body>
+</html>
Copied: branches/chromium/1132/LayoutTests/svg/foreignObject/fixed-position-expected.svg (from rev 119914, trunk/LayoutTests/svg/foreignObject/fixed-position-expected.svg) (0 => 120101)
--- branches/chromium/1132/LayoutTests/svg/foreignObject/fixed-position-expected.svg (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/foreignObject/fixed-position-expected.svg 2012-06-12 19:07:56 UTC (rev 120101)
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+ <rect width="100" height="100" fill="green"/>
+</svg>
Copied: branches/chromium/1132/LayoutTests/svg/foreignObject/fixed-position.svg (from rev 119914, trunk/LayoutTests/svg/foreignObject/fixed-position.svg) (0 => 120101)
--- branches/chromium/1132/LayoutTests/svg/foreignObject/fixed-position.svg (rev 0)
+++ branches/chromium/1132/LayoutTests/svg/foreignObject/fixed-position.svg 2012-06-12 19:07:56 UTC (rev 120101)
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+ <rect width="98" height="98" fill="red"/>
+ <foreignObject width="200" height="200" transform="translate(-100, 0)">
+ <!-- Fixed-position content should be relative to the foreignObject viewport. -->
+ <div xmlns="http://www.w3.org/1999/xhtml" style="position: fixed; left: 100px; width: 100px; height: 50%; background-color: green;"></div>
+ </foreignObject>
+</svg>
Modified: branches/chromium/1132/Source/WebCore/rendering/RenderObject.cpp (120100 => 120101)
--- branches/chromium/1132/Source/WebCore/rendering/RenderObject.cpp 2012-06-12 19:06:50 UTC (rev 120100)
+++ branches/chromium/1132/Source/WebCore/rendering/RenderObject.cpp 2012-06-12 19:07:56 UTC (rev 120101)
@@ -710,8 +710,14 @@
{
RenderObject* o = parent();
if (!isText() && m_style->position() == FixedPosition) {
- while (o && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
+ while (o && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock())) {
+#if ENABLE(SVG)
+ // foreignObject is the containing block for its contents.
+ if (o->isSVGForeignObject())
+ break;
+#endif
o = o->parent();
+ }
} else if (!isText() && m_style->position() == AbsolutePosition) {
while (o && (o->style()->position() == StaticPosition || (o->isInline() && !o->isReplaced())) && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock())) {
// For relpositioned inlines, we return the nearest non-anonymous enclosing block. We don't try
@@ -2246,6 +2252,11 @@
while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock())) {
if (repaintContainerSkipped && o == repaintContainer)
*repaintContainerSkipped = true;
+#if ENABLE(SVG)
+ // foreignObject is the containing block for its contents.
+ if (o->isSVGForeignObject())
+ break;
+#endif
o = o->parent();
}
} else if (pos == AbsolutePosition) {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
