Title: [178261] releases/WebKitGTK/webkit-2.6
- Revision
- 178261
- Author
- carlo...@webkit.org
- Date
- 2015-01-12 06:22:57 -0800 (Mon, 12 Jan 2015)
Log Message
Merge r176295 - REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
https://bugs.webkit.org/show_bug.cgi?id=137590
Reviewed by Dean Jackson.
Source/WebCore:
Added fast/block/selection-block-gaps-crash.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::blockSelectionGaps):
Check that we really are a RenderBlock before recurring.
LayoutTests:
* fast/block/selection-block-gap-crash-expected.txt: Added.
* fast/block/selection-block-gap-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog (178260 => 178261)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog 2015-01-12 14:20:01 UTC (rev 178260)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/ChangeLog 2015-01-12 14:22:57 UTC (rev 178261)
@@ -1,5 +1,15 @@
2014-11-18 David Hyatt <hy...@apple.com>
+ REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+ https://bugs.webkit.org/show_bug.cgi?id=137590
+
+ Reviewed by Dean Jackson.
+
+ * fast/block/selection-block-gap-crash-expected.txt: Added.
+ * fast/block/selection-block-gap-crash.html: Added.
+
+2014-11-18 David Hyatt <hy...@apple.com>
+
REGRESSION(r152313): Inline-block element doesn't wrap properly
https://bugs.webkit.org/show_bug.cgi?id=138846 - <rdar://problem/18838703>
Added: releases/WebKitGTK/webkit-2.6/LayoutTests/fast/block/selection-block-gap-crash-expected.txt (0 => 178261)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/fast/block/selection-block-gap-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/fast/block/selection-block-gap-crash-expected.txt 2015-01-12 14:22:57 UTC (rev 178261)
@@ -0,0 +1 @@
+This test passes if it doesn't crash.
Added: releases/WebKitGTK/webkit-2.6/LayoutTests/fast/block/selection-block-gap-crash.html (0 => 178261)
--- releases/WebKitGTK/webkit-2.6/LayoutTests/fast/block/selection-block-gap-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.6/LayoutTests/fast/block/selection-block-gap-crash.html 2015-01-12 14:22:57 UTC (rev 178261)
@@ -0,0 +1,11 @@
+This test passes if it doesn't crash.
+<div role="img" id="div"></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText()
+var elem = document.getElementById("div"); var parent = elem.parentNode;
+new_elem = document.createElement("frameset");
+new_elem.setAttribute("role", "img");
+parent.insertBefore(new_elem, elem);
+document.execCommand("SelectAll");
+</script>
Modified: releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog (178260 => 178261)
--- releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog 2015-01-12 14:20:01 UTC (rev 178260)
+++ releases/WebKitGTK/webkit-2.6/Source/WebCore/ChangeLog 2015-01-12 14:22:57 UTC (rev 178261)
@@ -1,5 +1,18 @@
2014-11-18 David Hyatt <hy...@apple.com>
+ REGRESSION (r167210): Invalid cast in WebCore::RenderBlock::blockSelectionGaps
+ https://bugs.webkit.org/show_bug.cgi?id=137590
+
+ Reviewed by Dean Jackson.
+
+ Added fast/block/selection-block-gaps-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::blockSelectionGaps):
+ Check that we really are a RenderBlock before recurring.
+
+2014-11-18 David Hyatt <hy...@apple.com>
+
REGRESSION(r152313): Inline-block element doesn't wrap properly
https://bugs.webkit.org/show_bug.cgi?id=138846 - <rdar://problem/18838703>
Modified: releases/WebKitGTK/webkit-2.6/Source/WebCore/rendering/RenderBlock.cpp (178260 => 178261)
--- releases/WebKitGTK/webkit-2.6/Source/WebCore/rendering/RenderBlock.cpp 2015-01-12 14:20:01 UTC (rev 178260)
+++ releases/WebKitGTK/webkit-2.6/Source/WebCore/rendering/RenderBlock.cpp 2015-01-12 14:22:57 UTC (rev 178261)
@@ -2054,7 +2054,7 @@
lastLogicalTop = blockDirectionOffset(rootBlock, offsetFromRootBlock) + curr->logicalBottom();
lastLogicalLeft = logicalLeftSelectionOffset(rootBlock, curr->logicalBottom(), cache);
lastLogicalRight = logicalRightSelectionOffset(rootBlock, curr->logicalBottom(), cache);
- } else if (childState != SelectionNone) {
+ } else if (childState != SelectionNone && curr->isRenderBlock()) {
// We must be a block that has some selected object inside it. Go ahead and recur.
result.unite(toRenderBlock(curr)->selectionGaps(rootBlock, rootBlockPhysicalPosition, LayoutSize(offsetFromRootBlock.width() + curr->x(), offsetFromRootBlock.height() + curr->y()),
lastLogicalTop, lastLogicalLeft, lastLogicalRight, childCache, paintInfo));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
