Crash with tables in multi-column layout.
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 16 Feb 2012 23:35:17 +0000 (23:35 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 16 Feb 2012 23:35:17 +0000 (23:35 +0000)
commit6f5aed32c5e397a210aaf27a3c4982eee748bffd
tree241a4b7c89eaa3d48391423d2f3bfb147f289141
parent9e7c864a74c5b9f44f27dc3a048ad2bda63f37d8
Crash with tables in multi-column layout.
https://bugs.webkit.org/show_bug.cgi?id=78415

Reviewed by Julien Chaffraix.

Source/WebCore:

Multi-column code creates anonymous column blocks directly
under RenderTable, thereby violating table layout assumption.
E.g. Captions in this testcase gets reparented to these anonymous
column blocks and when they go away, they are not able to clear
themselves from table's m_captions list (since RenderTable::removeChild
is not called).

Test: fast/multicol/span/table-multi-column-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::containingColumnsBlock):

LayoutTests:

* fast/multicol/span/table-multi-column-crash-expected.txt: Added.
* fast/multicol/span/table-multi-column-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@107987 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/multicol/span/table-multi-column-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/multicol/span/table-multi-column-crash.html [new file with mode: 0755]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlock.cpp