Title: [108875] trunk
- Revision
- 108875
- Author
- infe...@chromium.org
- Date
- 2012-02-24 17:31:27 -0800 (Fri, 24 Feb 2012)
Log Message
Positioned objects not cleared when moving children
to clone block in multi-column layout.
https://bugs.webkit.org/show_bug.cgi?id=78416
Reviewed by Eric Seidel.
Source/WebCore:
Test: fast/multicol/span/positioned-child-not-removed-crash.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::splitBlocks):
LayoutTests:
* fast/multicol/span/positioned-child-not-removed-crash-expected.txt: Added.
* fast/multicol/span/positioned-child-not-removed-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (108874 => 108875)
--- trunk/LayoutTests/ChangeLog 2012-02-25 01:11:14 UTC (rev 108874)
+++ trunk/LayoutTests/ChangeLog 2012-02-25 01:31:27 UTC (rev 108875)
@@ -1,3 +1,14 @@
+2012-02-24 Abhishek Arya <infe...@chromium.org>
+
+ Positioned objects not cleared when moving children
+ to clone block in multi-column layout.
+ https://bugs.webkit.org/show_bug.cgi?id=78416
+
+ Reviewed by Eric Seidel.
+
+ * fast/multicol/span/positioned-child-not-removed-crash-expected.txt: Added.
+ * fast/multicol/span/positioned-child-not-removed-crash.html: Added.
+
2012-02-24 Eric Carlson <eric.carl...@apple.com>
Update TextTrackCue API
Added: trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash-expected.txt (0 => 108875)
--- trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash-expected.txt 2012-02-25 01:31:27 UTC (rev 108875)
@@ -0,0 +1,3 @@
+Test passes if it does not crash.
+
+
Added: trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash.html (0 => 108875)
--- trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash.html 2012-02-25 01:31:27 UTC (rev 108875)
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<body>
+Test passes if it does not crash.
+<style>
+.caption1 { -webkit-column-width: 1px; }
+.div1 { position: absolute; }
+.keygen1:nth-last-child(even) { display: block; -webkit-column-span: all; }
+.flexbox1 { display: -webkit-flexbox; padding-right: 10px; -webkit-transform: rotate3d(0, 1, 0, 90deg); }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest() {
+ caption1 = document.createElement('caption');
+ caption1.setAttribute('class', 'caption1');
+ div1 = document.createElement('div');
+ div1.setAttribute('class', 'div1');
+ flexbox1 = document.createElement('div');
+ flexbox1.setAttribute('class', 'flexbox1');
+ keygen1 = document.createElement('keygen');
+ keygen1.setAttribute('class', 'keygen1');
+
+ div2 = document.createElement('div');
+ div3 = document.createElement('div');
+
+ flexbox1.appendChild(keygen1);
+ flexbox1.appendChild(div1);
+ flexbox1.appendChild(div3);
+ caption1.appendChild(flexbox1);
+ document.body.appendChild(caption1);
+ document.body.offsetTop;
+ flexbox1.appendChild(div2);
+ document.body.offsetTop;
+ flexbox1.removeChild(div1);
+}
+window._onload_ = runTest;
+</script>
+</body>
+</html>
Property changes on: trunk/LayoutTests/fast/multicol/span/positioned-child-not-removed-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (108874 => 108875)
--- trunk/Source/WebCore/ChangeLog 2012-02-25 01:11:14 UTC (rev 108874)
+++ trunk/Source/WebCore/ChangeLog 2012-02-25 01:31:27 UTC (rev 108875)
@@ -1,3 +1,16 @@
+2012-02-24 Abhishek Arya <infe...@chromium.org>
+
+ Positioned objects not cleared when moving children
+ to clone block in multi-column layout.
+ https://bugs.webkit.org/show_bug.cgi?id=78416
+
+ Reviewed by Eric Seidel.
+
+ Test: fast/multicol/span/positioned-child-not-removed-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::splitBlocks):
+
2012-02-24 Michael Saboff <msab...@apple.com>
Unreviewed, Windows build fix. Changed "-1" to newly
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (108874 => 108875)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-02-25 01:11:14 UTC (rev 108874)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-02-25 01:31:27 UTC (rev 108875)
@@ -491,6 +491,14 @@
if (beforeChild && childrenInline())
deleteLineBoxTree();
+ // We have to remove the descendant child from our positioned objects list
+ // before we do the split and move some of the children to cloneBlock. Since
+ // we are doing layout anyway, it is easier to blow away the entire list, than
+ // traversing down the subtree looking for positioned childs and then remove them
+ // from our positioned objects list.
+ if (beforeChild)
+ removePositionedObjects(0);
+
// Now take all of the children from beforeChild to the end and remove
// them from |this| and place them in the clone.
moveChildrenTo(cloneBlock, beforeChild, 0, true);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
