-
commit-queue@webkit.org authored
https://bugs.webkit.org/show_bug.cgi?id=115925 Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-05-13 Reviewed by David Hyatt. Allowing floats to overhand from flex items is not only against the spec, it causes bad bugs. Fix this by having flex items properly avoid floats. Test: fast/block/float/float-not-removed-crash2.html * rendering/RenderBox.cpp: (WebCore::RenderBox::avoidsFloats): Add flex items to avoid floats. * rendering/RenderBox.h: (WebCore::RenderBox::isFlexItemIncludingDeprecated): Determine if the current box is a flex item or deprecated flex item. LayoutTests: Fix the float logic to not return an anonymous block ancestor https://bugs.webkit.org/show_bug.cgi?id=115925 Patch by Bem Jones-Bey <bjonesbe@adobe.com> on 2013-05-13 Reviewed by David Hyatt. Cleaned up fuzzer test. Note that this will only crash when run under a memory checker like ASAN. * fast/block/float/float-not-removed-crash2-expected.txt: Added. * fast/block/float/float-not-removed-crash2.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150029 268f45cc-cd09-0410-ab3c-d52691b4dbfc
24a5e474