-
rniwa@webkit.org authored
REGRESSION: ASSERTION FAILED: obj->isRenderInline() || obj == this, Bad cast in WebCore::RenderBlock::createLineBoxes https://bugs.webkit.org/show_bug.cgi?id=110622 Reviewed by David Hyatt. Source/WebCore: Merge https://chromium.googlesource.com/chromium/blink/+/998ad358eed702b873dd54697b3fa3f952e0feb7 Inserting an element before the fullscreened element could crash if it caused a containing inline to be split, since the splitting logic doesn't expect the fullscreened element to be wrapped in a RenderFullScreen. This patch changes inline splitting to be aware of RenderFullScreen. Test: fullscreen/full-screen-inline-split-crash.html * rendering/RenderInline.cpp: (WebCore::RenderInline::splitInlines): LayoutTests: Add a regression test. * fullscreen/full-screen-inline-split-crash-expected.txt: Added. * fullscreen/full-screen-inline-split-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@150531 268f45cc-cd09-0410-ab3c-d52691b4dbfc
39c8c1b0