Title: [90848] branches/chromium/782
- Revision
- 90848
- Author
- cev...@google.com
- Date
- 2011-07-12 14:18:23 -0700 (Tue, 12 Jul 2011)
Log Message
Merge 90568
BUG=83672
Review URL: http://codereview.chromium.org/7344020
Modified Paths
Added Paths
Diff
Copied: branches/chromium/782/LayoutTests/fast/flexbox/crash-button-input-autofocus-expected.txt (from rev 90568, trunk/LayoutTests/fast/flexbox/crash-button-input-autofocus-expected.txt) (0 => 90848)
--- branches/chromium/782/LayoutTests/fast/flexbox/crash-button-input-autofocus-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/fast/flexbox/crash-button-input-autofocus-expected.txt 2011-07-12 21:18:23 UTC (rev 90848)
@@ -0,0 +1,3 @@
+Test for bug 63776: Partial layout when a flex-box has visibility: collapse
+
+This test PASSES if it does not CRASH.
Copied: branches/chromium/782/LayoutTests/fast/flexbox/crash-button-input-autofocus.html (from rev 90568, trunk/LayoutTests/fast/flexbox/crash-button-input-autofocus.html) (0 => 90848)
--- branches/chromium/782/LayoutTests/fast/flexbox/crash-button-input-autofocus.html (rev 0)
+++ branches/chromium/782/LayoutTests/fast/flexbox/crash-button-input-autofocus.html 2011-07-12 21:18:23 UTC (rev 90848)
@@ -0,0 +1,14 @@
+<html>
+<body>
+<p style="visibility: collapse;"><button><input autofocus><input id="test"></input></button></p>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+document.body.offsetTop;
+document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
+document.body.offsetTop;
+</script>
+<p>Test for bug <a href="" Partial layout when a flex-box has visibility: collapse</p>
+<p>This test PASSES if it does not CRASH.</p>
+</body>
+</html>
Copied: branches/chromium/782/LayoutTests/fast/flexbox/crash-button-keygen-expected.txt (from rev 90568, trunk/LayoutTests/fast/flexbox/crash-button-keygen-expected.txt) (0 => 90848)
--- branches/chromium/782/LayoutTests/fast/flexbox/crash-button-keygen-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/fast/flexbox/crash-button-keygen-expected.txt 2011-07-12 21:18:23 UTC (rev 90848)
@@ -0,0 +1,3 @@
+Test for bug 63776: Partial layout when a flex-box has visibility: collapse
+
+This test PASSES if it does not CRASH.
Copied: branches/chromium/782/LayoutTests/fast/flexbox/crash-button-keygen.html (from rev 90568, trunk/LayoutTests/fast/flexbox/crash-button-keygen.html) (0 => 90848)
--- branches/chromium/782/LayoutTests/fast/flexbox/crash-button-keygen.html (rev 0)
+++ branches/chromium/782/LayoutTests/fast/flexbox/crash-button-keygen.html 2011-07-12 21:18:23 UTC (rev 90848)
@@ -0,0 +1,14 @@
+<html>
+<body>
+<p style="visibility: collapse;"><button><keygen autofocus><input id="test"></keygen></button></p>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+document.body.offsetTop;
+document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
+document.body.offsetTop;
+</script>
+<p>Test for bug <a href="" Partial layout when a flex-box has visibility: collapse</p>
+<p>This test PASSES if it does not CRASH.</p>
+</body>
+</html>
Copied: branches/chromium/782/LayoutTests/fast/flexbox/crash-button-relayout-expected.txt (from rev 90568, trunk/LayoutTests/fast/flexbox/crash-button-relayout-expected.txt) (0 => 90848)
--- branches/chromium/782/LayoutTests/fast/flexbox/crash-button-relayout-expected.txt (rev 0)
+++ branches/chromium/782/LayoutTests/fast/flexbox/crash-button-relayout-expected.txt 2011-07-12 21:18:23 UTC (rev 90848)
@@ -0,0 +1,3 @@
+Test for bug 63776: Partial layout when a flex-box has visibility: collapse
+
+This test PASSES if it does not CRASH.
Copied: branches/chromium/782/LayoutTests/fast/flexbox/crash-button-relayout.html (from rev 90568, trunk/LayoutTests/fast/flexbox/crash-button-relayout.html) (0 => 90848)
--- branches/chromium/782/LayoutTests/fast/flexbox/crash-button-relayout.html (rev 0)
+++ branches/chromium/782/LayoutTests/fast/flexbox/crash-button-relayout.html 2011-07-12 21:18:23 UTC (rev 90848)
@@ -0,0 +1,14 @@
+<html>
+<body>
+<p style="visibility: collapse;"><button><input><script>document.getElementsByTagName('input')[0].offsetTop;</script><input id="test"></input></button></p>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+document.body.offsetTop;
+document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
+document.body.offsetTop;
+</script>
+<p>Test for bug <a href="" Partial layout when a flex-box has visibility: collapse</p>
+<p>This test PASSES if it does not CRASH.</p>
+</body>
+</html>
Modified: branches/chromium/782/Source/WebCore/rendering/RenderFlexibleBox.cpp (90847 => 90848)
--- branches/chromium/782/Source/WebCore/rendering/RenderFlexibleBox.cpp 2011-07-12 21:08:27 UTC (rev 90847)
+++ branches/chromium/782/Source/WebCore/rendering/RenderFlexibleBox.cpp 2011-07-12 21:18:23 UTC (rev 90848)
@@ -89,8 +89,8 @@
m_currentChild = m_forward ? m_currentChild->nextSiblingBox() : m_currentChild->previousSiblingBox();
if (m_currentChild && m_currentChild->style()->boxOrdinalGroup() > m_lastOrdinal)
m_lastOrdinal = m_currentChild->style()->boxOrdinalGroup();
- } while (!m_currentChild || m_currentChild->style()->boxOrdinalGroup() != m_currentOrdinal
- || m_currentChild->style()->visibility() == COLLAPSE);
+ } while (!m_currentChild || (!m_currentChild->isAnonymous()
+ && (m_currentChild->style()->boxOrdinalGroup() != m_currentOrdinal || m_currentChild->style()->visibility() == COLLAPSE)));
return m_currentChild;
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
