Title: [114940] branches/chromium/1025
- Revision
- 114940
- Author
- cev...@google.com
- Date
- 2012-04-23 13:56:04 -0700 (Mon, 23 Apr 2012)
Log Message
Merge 112935
BUG=106413
Review URL: https://chromiumcodereview.appspot.com/10182014
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash-expected.txt (from rev 112935, trunk/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash-expected.txt) (0 => 114940)
--- branches/chromium/1025/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash-expected.txt 2012-04-23 20:56:04 UTC (rev 114940)
@@ -0,0 +1,3 @@
+Test passes if it does not crash.
+PASS
+
Copied: branches/chromium/1025/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash.html (from rev 112935, trunk/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash.html) (0 => 114940)
--- branches/chromium/1025/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/block/float/intruding-float-not-removed-from-descendant-crash.html 2012-04-23 20:56:04 UTC (rev 114940)
@@ -0,0 +1,54 @@
+<html>
+Test passes if it does not crash.
+<style>
+.div2 { float: none; width: 100px; }
+.div2:nth-last-child(odd) { float: right; }
+.span1 { float: right; height: 100px; }
+.td1 { height: 100px; }
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function runTest() {
+span1 = document.createElement('span');
+span1.setAttribute('class', 'span1');
+document.documentElement.appendChild(span1);
+
+div2 = document.createElement('div');
+div2.setAttribute('class', 'div2');
+document.documentElement.appendChild(div2);
+
+document.documentElement.appendChild(document.createElement('div'));
+
+div3 = document.createElement('div');
+document.documentElement.appendChild(div3);
+
+document.documentElement.appendChild(document.createElement('span'));
+document.documentElement.appendChild(document.createElement('span'));
+document.documentElement.appendChild(document.createElement('span'));
+
+span2 = document.createElement('span');
+document.documentElement.appendChild(span2);
+
+document.documentElement.appendChild(document.createElement('div'));
+
+document.body.offsetTop;
+div1 = document.createElement('div');
+td1 = document.createElement('td');
+td1.appendChild(document.createTextNode('PASS'));
+td1.setAttribute('class', 'td1');
+div1.appendChild(td1);
+div2.appendChild(div1);
+
+document.body.offsetTop;
+document.body.appendChild(div3);
+
+document.body.offsetTop;
+span2.appendChild(span1);
+document.createElement("span").appendChild(span2);
+}
+
+window._onload_ = runTest;
+</script>
+</html>
Modified: branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp (114939 => 114940)
--- branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-04-23 20:47:05 UTC (rev 114939)
+++ branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp 2012-04-23 20:56:04 UTC (rev 114940)
@@ -3987,6 +3987,17 @@
// Clear our positioned floats boolean.
m_hasPositionedFloats = false;
+ HashSet<RenderBox*> oldIntrudingFloatSet;
+ if (!childrenInline() && m_floatingObjects) {
+ const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+ FloatingObjectSetIterator end = floatingObjectSet.end();
+ for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+ FloatingObject* floatingObject = *it;
+ if (!floatingObject->m_isDescendant)
+ oldIntrudingFloatSet.add(floatingObject->m_renderer);
+ }
+ }
+
// Inline blocks are covered by the isReplaced() check in the avoidFloats method.
if (avoidsFloats() || isRoot() || isRenderView() || isFloatingOrPositioned() || isTableCell()) {
if (m_floatingObjects) {
@@ -3995,6 +4006,8 @@
}
if (layoutPass == PositionedFloatLayoutPass)
addPositionedFloats();
+ if (!oldIntrudingFloatSet.isEmpty())
+ markAllDescendantsWithFloatsForLayout();
return;
}
@@ -4097,6 +4110,15 @@
deleteAllValues(floatMap);
markLinesDirtyInBlockRange(changeLogicalTop, changeLogicalBottom);
+ } else if (!oldIntrudingFloatSet.isEmpty()) {
+ // If there are previously intruding floats that no longer intrude, then children with floats
+ // should also get layout because they might need their floating object lists cleared.
+ const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
+ FloatingObjectSetIterator end = floatingObjectSet.end();
+ for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it)
+ oldIntrudingFloatSet.remove((*it)->m_renderer);
+ if (!oldIntrudingFloatSet.isEmpty())
+ markAllDescendantsWithFloatsForLayout();
}
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
