[webkit-changes] [124078] branches/safari-536.26-branch

Mon, 30 Jul 2012 13:13:26 -0700

Title: [124078] branches/safari-536.26-branch

Diff

Modified: branches/safari-536.26-branch/LayoutTests/ChangeLog (124077 => 124078)


--- branches/safari-536.26-branch/LayoutTests/ChangeLog	2012-07-30 20:05:59 UTC (rev 124077)
+++ branches/safari-536.26-branch/LayoutTests/ChangeLog	2012-07-30 20:13:31 UTC (rev 124078)
@@ -1,5 +1,19 @@
 2012-07-30  Lucas Forschler  <lforsch...@apple.com>
 
+    Merge 118005
+
+    2012-05-22  Abhishek Arya  <infe...@chromium.org>
+
+            Assertion failure (toRenderBox() called on a RenderInline) beneath RenderBlock::blockBeforeWithinSelectionRoot()
+            https://bugs.webkit.org/show_bug.cgi?id=86500
+
+            Reviewed by Ojan Vafai.
+
+            * fast/block/line-layout/selection-highlight-crash-expected.txt: Added.
+            * fast/block/line-layout/selection-highlight-crash.html: Added.
+
+2012-07-30  Lucas Forschler  <lforsch...@apple.com>
+
     Merge 117957
 
     2012-05-22  Hayato Ito  <hay...@chromium.org>

Copied: branches/safari-536.26-branch/LayoutTests/fast/block/line-layout/selection-highlight-crash-expected.txt (from rev 118005, trunk/LayoutTests/fast/block/line-layout/selection-highlight-crash-expected.txt) (0 => 124078)


--- branches/safari-536.26-branch/LayoutTests/fast/block/line-layout/selection-highlight-crash-expected.txt	                        (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/fast/block/line-layout/selection-highlight-crash-expected.txt	2012-07-30 20:13:31 UTC (rev 124078)
@@ -0,0 +1,4 @@
+Test passes if it does not crash.
+ab
+c
+d

Copied: branches/safari-536.26-branch/LayoutTests/fast/block/line-layout/selection-highlight-crash.html (from rev 118005, trunk/LayoutTests/fast/block/line-layout/selection-highlight-crash.html) (0 => 124078)


--- branches/safari-536.26-branch/LayoutTests/fast/block/line-layout/selection-highlight-crash.html	                        (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/fast/block/line-layout/selection-highlight-crash.html	2012-07-30 20:13:31 UTC (rev 124078)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<body contenteditable="true">
+Test passes if it does not crash.<br/>
+a<ruby>b<rt>c</rt></ruby>d
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.execCommand("SelectAll");
+</script>
+</body>
+</html>
+

Modified: branches/safari-536.26-branch/Source/WebCore/ChangeLog (124077 => 124078)


--- branches/safari-536.26-branch/Source/WebCore/ChangeLog	2012-07-30 20:05:59 UTC (rev 124077)
+++ branches/safari-536.26-branch/Source/WebCore/ChangeLog	2012-07-30 20:13:31 UTC (rev 124078)
@@ -1,5 +1,24 @@
 2012-07-30  Lucas Forschler  <lforsch...@apple.com>
 
+    Merge 118005
+
+    2012-05-22  Abhishek Arya  <infe...@chromium.org>
+
+            Assertion failure (toRenderBox() called on a RenderInline) beneath RenderBlock::blockBeforeWithinSelectionRoot()
+            https://bugs.webkit.org/show_bug.cgi?id=86500
+
+            Reviewed by Ojan Vafai.
+
+            Patch by Dan Bernstein<m...@apple.com>. I just added the test.
+
+            Test: fast/block/line-layout/selection-highlight-crash.html
+
+            * rendering/RenderBlock.cpp:
+            (WebCore::RenderBlock::blockBeforeWithinSelectionRoot): Demoted the object local variable to
+            RenderObject, changed use of parentBox() to parent(), and added toRenderBlock() in two places.
+
+2012-07-30  Lucas Forschler  <lforsch...@apple.com>
+
     Merge 117957
 
     2012-05-22  Hayato Ito  <hay...@chromium.org>

Modified: branches/safari-536.26-branch/Source/WebCore/rendering/RenderBlock.cpp (124077 => 124078)


--- branches/safari-536.26-branch/Source/WebCore/rendering/RenderBlock.cpp	2012-07-30 20:05:59 UTC (rev 124077)
+++ branches/safari-536.26-branch/Source/WebCore/rendering/RenderBlock.cpp	2012-07-30 20:13:31 UTC (rev 124078)
@@ -3368,15 +3368,15 @@
     if (isSelectionRoot())
         return 0;
 
-    const RenderBox* object = this;
+    const RenderObject* object = this;
     RenderObject* sibling;
     do {
         sibling = object->previousSibling();
         while (sibling && (!sibling->isRenderBlock() || toRenderBlock(sibling)->isSelectionRoot()))
             sibling = sibling->previousSibling();
 
-        offset -= LayoutSize(object->logicalLeft(), object->logicalTop());
-        object = object->parentBox();
+        offset -= LayoutSize(toRenderBlock(object)->logicalLeft(), toRenderBlock(object)->logicalTop());
+        object = object->parent();
     } while (!sibling && object && object->isRenderBlock() && !toRenderBlock(object)->isSelectionRoot());
 
     if (!sibling)

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to