Commit e3baac1e authored by inferno@chromium.org's avatar inferno@chromium.org
Browse files

2011-01-14 Abhishek Arya <inferno@chromium.org>

        Reviewed by David Hyatt.

        Fix parent block calculation when trying to find top most node
        containing "this" float.
        https://bugs.webkit.org/show_bug.cgi?id=51711

        Replace use of containingBlock and traverse the parents directly
        to check for float existence. containingBlock can skip parents and
        jump to the RenderView directly which will cause floats to not get
        cleared from intermediate parents.

        Test: fast/block/float/floats-not-cleared-crash.html

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
2011-01-14  Abhishek Arya  <inferno@chromium.org>

        Reviewed by Dave Hyatt.

        Tests that we do not crash due to uncleared floats in parent nodes.
        https://bugs.webkit.org/show_bug.cgi?id=51711

        * fast/block/float/floats-not-cleared-crash-expected.txt: Added.
        * fast/block/float/floats-not-cleared-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@75823 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 9de2e21f
2011-01-14 Abhishek Arya <inferno@chromium.org>
Reviewed by Dave Hyatt.
Tests that we do not crash due to uncleared floats in parent nodes.
https://bugs.webkit.org/show_bug.cgi?id=51711
* fast/block/float/floats-not-cleared-crash-expected.txt: Added.
* fast/block/float/floats-not-cleared-crash.html: Added.
2011-01-14 Jessie Berlin <jberlin@apple.com>
 
REGRESSION (r75660): compositing/reflections/load-video-in-reflection.html crashes on Windows 7
......
<html>
<script>
if (window.layoutTestController)
{
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
window.setTimeout('crash();', 0);
function crash()
{
document.body.offsetTop;
block1.style.position = 'absolute';
float1.style.display = 'none';
document.body.offsetTop;
block1.innerHTML = "PASS";
if (window.layoutTestController)
layoutTestController.notifyDone();
}
</script>
<div id="block1">
<span id="float1" style="float: left; margin-bottom: 10000px;">
</div>
<junk>
<html>
2011-01-14 Abhishek Arya <inferno@chromium.org>
Reviewed by David Hyatt.
Fix parent block calculation when trying to find top most node
containing "this" float.
https://bugs.webkit.org/show_bug.cgi?id=51711
Replace use of containingBlock and traverse the parents directly
to check for float existence. containingBlock can skip parents and
jump to the RenderView directly which will cause floats to not get
cleared from intermediate parents.
Test: fast/block/float/floats-not-cleared-crash.html
* rendering/RenderBox.cpp:
(WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
2011-01-14 Adam Klein <adamk@chromium.org>
 
Reviewed by Darin Fisher.
......
......@@ -217,26 +217,30 @@ void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
return;
if (isFloating()) {
RenderBlock* outermostBlock = containingBlock();
for (RenderBlock* p = outermostBlock; p && !p->isRenderView(); p = p->containingBlock()) {
if (p->containsFloat(this))
outermostBlock = p;
RenderBlock* parentBlock = 0;
for (RenderObject* curr = parent(); curr && !curr->isRenderView(); curr = curr->parent()) {
if (curr->isRenderBlock()) {
RenderBlock* currBlock = toRenderBlock(curr);
if (currBlock->containsFloat(this))
parentBlock = currBlock;
else
break;
}
}
if (outermostBlock) {
RenderObject* parent = outermostBlock->parent();
if (parentBlock) {
RenderObject* parent = parentBlock->parent();
if (parent && parent->isFlexibleBox())
outermostBlock = toRenderBlock(parent);
parentBlock = toRenderBlock(parent);
outermostBlock->markAllDescendantsWithFloatsForLayout(this, false);
parentBlock->markAllDescendantsWithFloatsForLayout(this, false);
}
}
if (isPositioned()) {
RenderObject* p;
for (p = parent(); p; p = p->parent()) {
if (p->isRenderBlock())
toRenderBlock(p)->removePositionedObject(this);
for (RenderObject* curr = parent(); curr; curr = curr->parent()) {
if (curr->isRenderBlock())
toRenderBlock(curr)->removePositionedObject(this);
}
}
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment