-
mitz@apple.com authored
Reviewed by Darin Adler. - fix <rdar://problem/5619240> REGRESSION (Leopard-r28069): Reproducible crash with a Mootools-based calendar picker (jump to null in FrameView::layout) Test: fast/dynamic/subtree-common-root.html * page/FrameView.cpp: (WebCore::FrameView::layoutRoot): Added a parameter to let this method return the layout root for a pending layout as well. (WebCore::FrameView::scheduleRelayoutOfSubtree): Pass the new root to markContainingBlocksForLayout(). Otherwise, markContainingBlocksForLayout() could mark past the new root, if it had previously been marked as having a normal child needing layout and then was reached via a positioned child. * page/FrameView.h: * rendering/RenderBox.cpp: (WebCore::RenderBox::calcWidth): * rendering/RenderObject.cpp: (WebCore::RenderObject::~RenderObject): Fixed the ASSERT so that it would really catch deletion of the layout root. (WebCore::RenderObject::markContainingBlocksForLayout): Added the newRoot parameter, which tells this method where to stop marking. * rendering/RenderObject.h: LayoutTests: Reviewed by Darin Adler. - test for <rdar://problem/5619240> REGRESSION (Leopard-r28069): Reproducible crash with a Mootools-based calendar picker (jump to null in FrameView::layout) * fast/dynamic/subtree-common-root-expected.txt: Added. * fast/dynamic/subtree-common-root.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@28299 268f45cc-cd09-0410-ab3c-d52691b4dbfc
919b5999