Commit 28ed1a04 authored by inferno@chromium.org's avatar inferno@chromium.org

2011-05-13 Abhishek Arya <inferno@chromium.org>

        Reviewed by Dave Hyatt.

        Regression(r75823): Revert initialization back to the first RenderBlock
        in the parent chain.
        https://bugs.webkit.org/show_bug.cgi?id=60780

        Test: fast/block/float/float-not-removed-crash.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
        In r75823, I forgot to initialize parentBlock, when the original code
        did and Hyatt did mention in c#5. Now, initializing parentBlock to the
        first RenderBlock in the parent chain.
2011-05-13  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Dave Hyatt.

        Tests that we do not crash when trying to access a deleted float.
        https://bugs.webkit.org/show_bug.cgi?id=60780

        * fast/block/float/float-not-removed-crash-expected.txt: Added.
        * fast/block/float/float-not-removed-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@86448 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent cb31a816
2011-05-13 Abhishek Arya <inferno@chromium.org>
Reviewed by Dave Hyatt.
Tests that we do not crash when trying to access a deleted float.
https://bugs.webkit.org/show_bug.cgi?id=60780
* fast/block/float/float-not-removed-crash-expected.txt: Added.
* fast/block/float/float-not-removed-crash.html: Added.
2011-05-13 Robert Hogan <robert@webkit.org>
Reviewed by Benjamin Poulain.
<html>
Test passes if it does not crash.
<body onload="runTest()">
<div style="display: -webkit-inline-box">
<span id="span1">
<span><blockquote></blockquote></span>
<span><p style="float: left;"></p></span>
</span>
<span id="span2" style="display: list-item"></span>
</div>
<script type="text/javascript">
if (window.layoutTestController)
layoutTestController.dumpAsText();
function runTest() {
document.body.offsetTop;
span1 = document.getElementById('span1');
span2 = document.getElementById('span2');
tfoot = document.createElement('tfoot');
span2.appendChild(tfoot);
document.body.offsetTop;
span1.parentNode.removeChild(span1);
}
</script>
</body>
</html>
\ No newline at end of file
2011-05-13 Abhishek Arya <inferno@chromium.org>
Reviewed by Dave Hyatt.
Regression(r75823): Revert initialization back to the first RenderBlock
in the parent chain.
https://bugs.webkit.org/show_bug.cgi?id=60780
Test: fast/block/float/float-not-removed-crash.html
* rendering/RenderBox.cpp:
(WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
In r75823, I forgot to initialize parentBlock, when the original code
did and Hyatt did mention in c#5. Now, initializing parentBlock to the
first RenderBlock in the parent chain.
2011-05-05 Pavel Podivilov <podivilov@chromium.org>
Reviewed by Yury Semikhatsky.
......@@ -219,7 +219,7 @@ void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
for (RenderObject* curr = parent(); curr && !curr->isRenderView(); curr = curr->parent()) {
if (curr->isRenderBlock()) {
RenderBlock* currBlock = toRenderBlock(curr);
if (currBlock->containsFloat(this))
if (!parentBlock || currBlock->containsFloat(this))
parentBlock = currBlock;
}
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment