Title: [112627] branches/chromium/1025
- Revision
- 112627
- Author
- [email protected]
- Date
- 2012-03-29 18:14:27 -0700 (Thu, 29 Mar 2012)
Log Message
Merge 111912
BUG=119230
Review URL: https://chromiumcodereview.appspot.com/9933006
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/multicol/span/update-after-content-before-child-crash-expected.txt (from rev 111912, trunk/LayoutTests/fast/multicol/span/update-after-content-before-child-crash-expected.txt) (0 => 112627)
--- branches/chromium/1025/LayoutTests/fast/multicol/span/update-after-content-before-child-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/multicol/span/update-after-content-before-child-crash-expected.txt 2012-03-30 01:14:27 UTC (rev 112627)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Copied: branches/chromium/1025/LayoutTests/fast/multicol/span/update-after-content-before-child-crash.html (from rev 111912, trunk/LayoutTests/fast/multicol/span/update-after-content-before-child-crash.html) (0 => 112627)
--- branches/chromium/1025/LayoutTests/fast/multicol/span/update-after-content-before-child-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/multicol/span/update-after-content-before-child-crash.html 2012-03-30 01:14:27 UTC (rev 112627)
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<body>
+<style>
+#columnContainer { -webkit-column-count: 600; }
+#divBlock::after { display: block; content: ''; }
+#columnSpanBlock:nth-last-child(even) { -webkit-column-span: all; }
+#table { float: right; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+_onload_ = function() {
+ columnContainer = document.createElement('div');
+ columnContainer.setAttribute('id', 'columnContainer');
+ document.body.appendChild(columnContainer);
+ divBlock = document.createElement('div');
+ divBlock.setAttribute('id', 'divBlock');
+ columnContainer.appendChild(divBlock);
+ columnSpanBlock = document.createElement('div');
+ columnSpanBlock.setAttribute('id', 'columnSpanBlock');
+ divBlock.appendChild(columnSpanBlock);
+ span = document.createElement('span');
+ divBlock.appendChild(span);
+ span.appendChild(document.createTextNode('A'));
+ table = document.createElement('table');
+ table.setAttribute('id', 'table');
+ divBlock.appendChild(table);
+ document.designMode = 'on';
+ document.execCommand('selectall');
+ document.execCommand('inserttext', '');
+ document.body.offsetTop;
+ document.body.innerHTML = "PASS. WebKit didn't crash.";
+}
+</script>
+</body>
+</html>
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp (112626 => 112627)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-03-30 01:01:22 UTC (rev 112626)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-03-30 01:14:27 UTC (rev 112627)
@@ -867,12 +867,19 @@
// Someone may have put a <p> inside a <q>, causing a split. When this happens, the :after content
// has to move into the inline continuation. Call updateBeforeAfterContent to ensure that our :after
// content gets properly destroyed.
+ bool isFirstChild = (beforeChild == firstChild());
bool isLastChild = (beforeChild == lastChild());
if (document()->usesBeforeAfterRules())
children()->updateBeforeAfterContent(this, AFTER);
- if (isLastChild && beforeChild != lastChild())
- beforeChild = 0; // We destroyed the last child, so now we need to update our insertion
- // point to be 0. It's just a straight append now.
+ if (isLastChild && beforeChild != lastChild()) {
+ // We destroyed the last child, so now we need to update our insertion
+ // point to be 0. It's just a straight append now.
+ beforeChild = 0;
+ } else if (isFirstChild && beforeChild != firstChild()) {
+ // If beforeChild was the last anonymous block that collapsed,
+ // then we need to update its value.
+ beforeChild = firstChild();
+ }
splitFlow(beforeChild, newBox, newChild, oldContinuation);
return;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
