Title: [143525] branches/chromium/1364
- Revision
- 143525
- Author
- cev...@google.com
- Date
- 2013-02-20 15:59:55 -0800 (Wed, 20 Feb 2013)
Log Message
Merge 142657
BUG=173399
Review URL: https://codereview.chromium.org/12330035
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1364/LayoutTests/fast/multicol/span/list-multi-column-crash-expected.txt (from rev 142657, trunk/LayoutTests/fast/multicol/span/list-multi-column-crash-expected.txt) (0 => 143525)
--- branches/chromium/1364/LayoutTests/fast/multicol/span/list-multi-column-crash-expected.txt (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/multicol/span/list-multi-column-crash-expected.txt 2013-02-20 23:59:55 UTC (rev 143525)
@@ -0,0 +1 @@
+Test passes if it does not crash.
Copied: branches/chromium/1364/LayoutTests/fast/multicol/span/list-multi-column-crash.html (from rev 142657, trunk/LayoutTests/fast/multicol/span/list-multi-column-crash.html) (0 => 143525)
--- branches/chromium/1364/LayoutTests/fast/multicol/span/list-multi-column-crash.html (rev 0)
+++ branches/chromium/1364/LayoutTests/fast/multicol/span/list-multi-column-crash.html 2013-02-20 23:59:55 UTC (rev 143525)
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+<body>
+Test passes if it does not crash.
+<style>
+.columns
+{
+ -webkit-column-count: 2;
+ -webkit-column-span: all;
+}
+.list
+{
+ display: list-item;
+}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+list = document.createElement('p');
+list.setAttribute('class', 'list');
+listChild = document.createElement('hr');
+list.appendChild(listChild);
+list.appendChild(document.createTextNode('Text.'));
+outerColumns = document.createElement('div');
+outerColumns.appendChild(list);
+document.body.appendChild(outerColumns);
+outerColumns.setAttribute('class', 'columns');
+document.body.offsetTop;
+
+innerColumns = document.createElement('div');
+innerColumns.setAttribute('class', 'columns');
+listChild.appendChild(innerColumns);
+document.body.offsetTop;
+
+document.body.removeChild(outerColumns);
+</script>
+</body>
+</html>
Modified: branches/chromium/1364/Source/WebCore/rendering/RenderBlock.cpp (143524 => 143525)
--- branches/chromium/1364/Source/WebCore/rendering/RenderBlock.cpp 2013-02-20 23:58:05 UTC (rev 143524)
+++ branches/chromium/1364/Source/WebCore/rendering/RenderBlock.cpp 2013-02-20 23:59:55 UTC (rev 143525)
@@ -522,13 +522,10 @@
|| curr->isInlineBlockOrInlineTable())
return 0;
- // FIXME: Table manages its own table parts, most of which are RenderBoxes.
- // Multi-column code cannot handle splitting the flow in table. Disabling it
- // to prevent crashes.
- // Similarly, RenderButton maintains an anonymous block child and overrides
- // addChild() to prevent itself from having additional direct children. This
- // causes problems for split flows.
- if (curr->isTable() || curr->isRenderButton())
+ // FIXME: Tables, RenderButtons, and RenderListItems all do special management
+ // of their children that breaks when the flow is split through them. Disabling
+ // multi-column for them to avoid this problem.
+ if (curr->isTable() || curr->isRenderButton() || curr->isListItem())
return 0;
RenderBlock* currBlock = toRenderBlock(curr);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
