FloatingObject::unsafeClone should not copy m_originatingLine
authorbjonesbe@adobe.com <bjonesbe@adobe.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 7 Feb 2014 23:01:19 +0000 (23:01 +0000)
committerbjonesbe@adobe.com <bjonesbe@adobe.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 7 Feb 2014 23:01:19 +0000 (23:01 +0000)
commitd3c865117045803718d9851c4b006a9d1c050090
treee3794af6ac08a752d249b236a1848e869ff61942
parent58d2f31419f5862d2343bc111e6aa4e4932c76ce
FloatingObject::unsafeClone should not copy m_originatingLine
https://bugs.webkit.org/show_bug.cgi?id=128381

Reviewed by Andreas Kling.

Copying the originatingLine allows to break the invariant that the
floating object must only contain lines that are owned by the renderer
it is attached to.

* rendering/FloatingObjects.cpp:
(WebCore::FloatingObject::unsafeClone):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@163651 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/rendering/FloatingObjects.cpp