2008-05-02 Antti Koivisto <antti@apple.com>

        Reviewed by Mitz.

        Fix <rdar://problem/5840475>
        CrashTracer: [USER] 2 crashes in Safari at com.apple.WebCore: WebCore::RenderBlock::insertPositionedObject
        
        Non-block objects can have transforms so containingBlock() could end up returning null. 
        RenderObject::container() needs to match.

        Test: fast/transforms/container-transform-crash.html

        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::containingBlock):
        (WebCore::RenderObject::container):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@32861 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore/ChangeLog

+2008-05-02  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mitz.
+
+        Fix <rdar://problem/5840475>
+        CrashTracer: [USER] 2 crashes in Safari at com.apple.WebCore: WebCore::RenderBlock::insertPositionedObject
+        
+        Non-block objects can have transforms so containingBlock() could end up returning null. 
+        RenderObject::container() needs to match.
+
+        Test: fast/transforms/container-transform-crash.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        (WebCore::RenderObject::container):
+
 2008-05-04  Sam Weinig  <sam@webkit.org>
 
         Roll out r32851.  It broke tiger builds.

WebCore/rendering/RenderObject.cpp

@@ -796,10 +796,10 @@ RenderBlock* RenderObject::containingBlock() const
 
     RenderObject* o = parent();
     if (!isText() && m_style->position() == FixedPosition) {
-        while (o && !o->isRenderView() && !o->hasTransform())
+        while (o && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
             o = o->parent();
     } else if (!isText() && m_style->position() == AbsolutePosition) {
-        while (o && (o->style()->position() == StaticPosition || (o->isInline() && !o->isReplaced())) && !o->isRenderView() && !o->hasTransform()) {
+        while (o && (o->style()->position() == StaticPosition || (o->isInline() && !o->isReplaced())) && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock())) {
             // For relpositioned inlines, we return the nearest enclosing block.  We don't try
             // to return the inline itself.  This allows us to avoid having a positioned objects
             // list in all RenderInlines and lets us return a strongly-typed RenderBlock* result
@@ -2456,13 +2456,13 @@ RenderObject* RenderObject::container() const
         // as we can.  If we're in the tree, we'll get the root.  If we
         // aren't we'll get the root of our little subtree (most likely
         // we'll just return 0).
-        while (o && o->parent() && !o->hasTransform())
+        while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock()))
             o = o->parent();
     } else if (pos == AbsolutePosition) {
         // Same goes here.  We technically just want our containing block, but
         // we may not have one if we're part of an uninstalled subtree.  We'll
         // climb as high as we can though.
-        while (o && o->style()->position() == StaticPosition && !o->isRenderView() && !o->hasTransform())
+        while (o && o->style()->position() == StaticPosition && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
             o = o->parent();
     }