Title: [124100] branches/safari-536.26-branch
- Revision
- 124100
- Author
- lforsch...@apple.com
- Date
- 2012-07-30 15:21:45 -0700 (Mon, 30 Jul 2012)
Log Message
Merged r118248. <rdar://problem/11942129>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.26-branch/LayoutTests/ChangeLog (124099 => 124100)
--- branches/safari-536.26-branch/LayoutTests/ChangeLog 2012-07-30 22:18:20 UTC (rev 124099)
+++ branches/safari-536.26-branch/LayoutTests/ChangeLog 2012-07-30 22:21:45 UTC (rev 124100)
@@ -1,5 +1,19 @@
2012-07-30 Lucas Forschler <lforsch...@apple.com>
+ Merge 118248
+
+ 2012-05-23 Abhishek Arya <infe...@chromium.org>
+
+ Crash in RenderInline::linesVisualOverflowBoundingBox.
+ https://bugs.webkit.org/show_bug.cgi?id=85804
+
+ Reviewed by Dave Hyatt.
+
+ * fast/block/inline-children-root-linebox-crash-expected.txt: Added.
+ * fast/block/inline-children-root-linebox-crash.html: Added.
+
+2012-07-30 Lucas Forschler <lforsch...@apple.com>
+
Merge 118213
2012-05-23 Chris Fleizach <cfleiz...@apple.com>
Copied: branches/safari-536.26-branch/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt (from rev 118248, trunk/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt) (0 => 124100)
--- branches/safari-536.26-branch/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/fast/block/inline-children-root-linebox-crash-expected.txt 2012-07-30 22:21:45 UTC (rev 124100)
@@ -0,0 +1,3 @@
+WebKit Bug 85804 - Crash in RenderInline::linesVisualOverflowBoundingBox.
+Test passes if it does not crash.
+
Copied: branches/safari-536.26-branch/LayoutTests/fast/block/inline-children-root-linebox-crash.html (from rev 118248, trunk/LayoutTests/fast/block/inline-children-root-linebox-crash.html) (0 => 124100)
--- branches/safari-536.26-branch/LayoutTests/fast/block/inline-children-root-linebox-crash.html (rev 0)
+++ branches/safari-536.26-branch/LayoutTests/fast/block/inline-children-root-linebox-crash.html 2012-07-30 22:21:45 UTC (rev 124100)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+WebKit Bug 85804 - Crash in RenderInline::linesVisualOverflowBoundingBox.<br />
+Test passes if it does not crash.
+<div style='-webkit-writing-mode: vertical-rl;'>
+<div style='-webkit-transform: translatey(1px) translatez(1px) rotatex(1deg);'></div>
+<textarea></textarea>
+<span style='-webkit-opacity: 0.0;'/>
+<input autofocus>
+</div>
+<body dir=rtl>
+</body>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+</html>
Modified: branches/safari-536.26-branch/Source/WebCore/ChangeLog (124099 => 124100)
--- branches/safari-536.26-branch/Source/WebCore/ChangeLog 2012-07-30 22:18:20 UTC (rev 124099)
+++ branches/safari-536.26-branch/Source/WebCore/ChangeLog 2012-07-30 22:21:45 UTC (rev 124100)
@@ -1,5 +1,26 @@
2012-07-30 Lucas Forschler <lforsch...@apple.com>
+ Merge 118248
+
+ 2012-05-23 Abhishek Arya <infe...@chromium.org>
+
+ Crash in RenderInline::linesVisualOverflowBoundingBox.
+ https://bugs.webkit.org/show_bug.cgi?id=85804
+
+ Reviewed by Dave Hyatt.
+
+ Defer layout of replaced elements to the next line break function.
+ We shouldn't do it while we are clearing our inline chilren
+ lineboxes in full layout mode.
+
+ Test: fast/block/inline-children-root-linebox-crash.html
+
+ * rendering/RenderBlockLineLayout.cpp:
+ (WebCore::RenderBlock::layoutInlineChildren):
+ (WebCore::RenderBlock::LineBreaker::nextLineBreak):
+
+2012-07-30 Lucas Forschler <lforsch...@apple.com>
+
Merge 118213
2012-05-23 Chris Fleizach <cfleiz...@apple.com>
Modified: branches/safari-536.26-branch/Source/WebCore/rendering/RenderBlockLineLayout.cpp (124099 => 124100)
--- branches/safari-536.26-branch/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2012-07-30 22:18:20 UTC (rev 124099)
+++ branches/safari-536.26-branch/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2012-07-30 22:21:45 UTC (rev 124100)
@@ -1499,7 +1499,6 @@
else if (layoutState.isFullLayout() || o->needsLayout()) {
// Replaced elements
toRenderBox(o)->dirtyLineBoxes(layoutState.isFullLayout());
- o->layoutIfNeeded();
}
} else if (o->isText() || (o->isRenderInline() && !walker.atEndOfInline())) {
if (!o->isText())
@@ -2269,6 +2268,7 @@
width.addUncommittedWidth(borderPaddingMarginStart(flowBox) + borderPaddingMarginEnd(flowBox));
} else if (current.m_obj->isReplaced()) {
RenderBox* replacedBox = toRenderBox(current.m_obj);
+ replacedBox->layoutIfNeeded();
// Break on replaced elements if either has normal white-space.
if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!current.m_obj->isImage() || allowImagesToBreak)) {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
