Title: [114942] branches/chromium/1084
- Revision
- 114942
- Author
- cev...@google.com
- Date
- 2012-04-23 14:09:22 -0700 (Mon, 23 Apr 2012)
Log Message
Merge 113597
BUG=121645
Review URL: https://chromiumcodereview.appspot.com/10196001
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1084/ManualTests/svg-text-float-not-removed-crash.html (from rev 113597, trunk/ManualTests/svg-text-float-not-removed-crash.html) (0 => 114942)
--- branches/chromium/1084/ManualTests/svg-text-float-not-removed-crash.html (rev 0)
+++ branches/chromium/1084/ManualTests/svg-text-float-not-removed-crash.html 2012-04-23 21:09:22 UTC (rev 114942)
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<script>
+setInterval(function(){
+ var elements = document.getElementsByTagName("*");
+ var didRemoveElement = false;
+ for (var i = 0; i < elements.length; i++) {
+ var element = elements.item(i);
+ if (!element.firstElementChild && element != document.documentElement) {
+ didRemoveElement = true;
+ try {
+ element.parentNode.removeChild(element)
+ } catch(e) { }
+ }
+ }
+
+ if (!didRemoveElement)
+ document.documentElement.innerHTML = "PASS. WebKit didn't crash.";
+}, 100);
+</script>
+<style>
+#test1:after {
+ float: left;
+ content: 'A';
+}
+</style>
+<svg>
+<text>
+<a id="test1">
+A
+</a>
+</text>
+</svg>
+</html>
Modified: branches/chromium/1084/Source/WebCore/rendering/RenderBlock.h (114941 => 114942)
--- branches/chromium/1084/Source/WebCore/rendering/RenderBlock.h 2012-04-23 21:03:13 UTC (rev 114941)
+++ branches/chromium/1084/Source/WebCore/rendering/RenderBlock.h 2012-04-23 21:09:22 UTC (rev 114942)
@@ -480,6 +480,7 @@
{
LayoutUnit repaintLogicalTop = 0;
LayoutUnit repaintLogicalBottom = 0;
+ clearFloats(NormalLayoutPass);
layoutInlineChildren(true, repaintLogicalTop, repaintLogicalBottom);
}
#endif
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
