Inline continuation code should not take anonymous containing wrapper granted.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 27 Mar 2015 04:41:46 +0000 (04:41 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 27 Mar 2015 04:41:46 +0000 (04:41 +0000)
commit0bff648263c1edea01e652ab8a7a1fd2258d125f
treec2d1d92a34c8ab43960ddf57036d82f4980031c1
parent09b318e0077945c06301ec8f082c38c2b88d4afb
Inline continuation code should not take anonymous containing wrapper granted.
https://bugs.webkit.org/show_bug.cgi?id=133312

Reviewed by Dave Hyatt.

It's wrong to assume that when RenderInline is part of an inline continuation, its containing block
is an anonymous wrapper and its sibling might be a block level renderer.
When the inline continuation is no longer needed, for example when the block level renderer that initiated the continuation
is detached from the render tree, the inline renderes still continue to form continuation.(however they no longer require
anonymous wrappers)

Source/WebCore:

Test: fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html

* rendering/RenderInline.cpp:
(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):

LayoutTests:

* fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation-expected.txt: Added.
* fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@182051 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation-expected.txt [new file with mode: 0644]
LayoutTests/fast/inline/crash-when-position-property-is-changed-and-no-longer-in-continuation.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderInline.cpp