Crash from multicol spans with layers
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 7 Dec 2011 20:01:27 +0000 (20:01 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 7 Dec 2011 20:01:27 +0000 (20:01 +0000)
https://bugs.webkit.org/show_bug.cgi?id=68030

Patch by Ken Buchanan <kenrb@chromium.org> on 2011-12-07
Reviewed by David Hyatt.

Source/WebCore:

The layer tree diverges from the render tree when a span is being split
between columns. This patch causes the layer tree to be updated when necessary.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::splitFlow)
(WebCore::RenderBlock::splitBlocks)

LayoutTests:

New test for fix to crash on bug 68030.

* fast/multicol/span/removal-of-multicol-span-crash-expected.txt: Added
* fast/multicol/span/removal-of-multicol-span-crash.html: Added

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@102263 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog [changed mode: 0644->0755]
LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt [new file with mode: 0755]
LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html [new file with mode: 0755]
Source/WebCore/ChangeLog [changed mode: 0644->0755]
Source/WebCore/rendering/RenderBlock.cpp

old mode 100644 (file)
new mode 100755 (executable)
index ff5cbab..7a5aa4b
@@ -1,3 +1,15 @@
+2011-12-07  Ken Buchanan <kenrb@chromium.org>
+
+        Crash from multicol spans with layers
+        https://bugs.webkit.org/show_bug.cgi?id=68030
+
+        Reviewed by David Hyatt.
+
+        New test for fix to crash on bug 68030.
+
+        * fast/multicol/span/removal-of-multicol-span-crash-expected.txt: Added
+        * fast/multicol/span/removal-of-multicol-span-crash.html: Added
+
 2011-12-07  Alexey Proskuryakov  <ap@apple.com>
 
         Handling of !important in inline style sets is broken
diff --git a/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt b/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash-expected.txt
new file mode 100755 (executable)
index 0000000..b3ead00
--- /dev/null
@@ -0,0 +1 @@
+PASS, if no exception or crash
diff --git a/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html b/LayoutTests/fast/multicol/span/removal-of-multicol-span-crash.html
new file mode 100755 (executable)
index 0000000..fca19f5
--- /dev/null
@@ -0,0 +1,24 @@
+<style>
+body { -webkit-column-width: 0; }
+#container { position: relative; }
+.hardware:last-of-type { -webkit-column-span: all; }
+</style>
+
+<script>
+    function clear() {
+        document.documentElement.removeChild(document.body);
+        document.documentElement.innerHTML='PASS, if no exception or crash';
+        if (window.layoutTestController) {
+            layoutTestController.notifyDone();
+        }
+    }
+    setTimeout("clear();", 0);
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+</script>
+<body>
+<div id="container">
+    <div class="hardware box">
+</body>
old mode 100644 (file)
new mode 100755 (executable)
index f720bba..3ce4060
@@ -1,3 +1,17 @@
+2011-12-07  Ken Buchanan <kenrb@chromium.org>
+
+        Crash from multicol spans with layers
+        https://bugs.webkit.org/show_bug.cgi?id=68030
+
+        Reviewed by David Hyatt.
+
+        The layer tree diverges from the render tree when a span is being split
+        between columns. This patch causes the layer tree to be updated when necessary.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitFlow)
+        (WebCore::RenderBlock::splitBlocks)
+
 2011-12-07  Alexey Proskuryakov  <ap@apple.com>
 
         Handling of !important in inline style sets is broken
index 4c71440..10f9f7f 100755 (executable)
@@ -464,7 +464,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     // them from |this| and place them in the clone.
     if (!beforeChild && isAfterContent(lastChild()))
         beforeChild = lastChild();
-    moveChildrenTo(cloneBlock, beforeChild, 0);
+    moveChildrenTo(cloneBlock, beforeChild, 0, true);
     
     // Hook |clone| up as the continuation of the middle block.
     if (!cloneBlock->isAnonymousBlock())
@@ -506,8 +506,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
 
         // Now we need to take all of the children starting from the first child
         // *after* currChild and append them all to the clone.
-        RenderObject* afterContent = isAfterContent(cloneBlock->lastChild()) ? cloneBlock->lastChild() : 0;
-        blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, afterContent);
+        blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, true);
 
         // Keep walking up the chain.
         currChild = curr;
@@ -519,7 +518,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
 
     // Now take all the children after currChild and remove them from the fromBlock
     // and put them in the toBlock.
-    fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0);
+    fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0, true);
 }
 
 void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
@@ -555,7 +554,7 @@ void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
     block->setChildrenInline(false);
     
     if (madeNewBeforeBlock)
-        block->moveChildrenTo(pre, boxFirst, 0);
+        block->moveChildrenTo(pre, boxFirst, 0, true);
 
     splitBlocks(pre, post, newBlockBox, beforeChild, oldCont);