https://bugs.webkit.org/show_bug.cgi?id=83021
Reviewed by Dirk Schulze.
.:
* ManualTests/svg-text-float-not-removed-crash.html: Added.
Source/WebCore:
Manual Test - ManualTests/svg-text-float-not-removed-crash.html.
Can't reproduce the failure in DRT.
forceLayoutInlineChildren is used in SVG <text> layout and overrides
RenderBlock::layoutBlock. However, it missed the 'clearFloats' step,
which will cause a crash when trying to access removed renderers.
* rendering/RenderBlock.h:
(WebCore::RenderBlock::forceLayoutInlineChildren):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@113597
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2012-04-09 Abhishek Arya <inferno@chromium.org>
+
+ Crash due to floats not cleared before starting SVG <text> layout.
+ https://bugs.webkit.org/show_bug.cgi?id=83021
+
+ Reviewed by Dirk Schulze.
+
+ * ManualTests/svg-text-float-not-removed-crash.html: Added.
+
2012-04-09 Patrick Gansterer <paroga@webkit.org>
[CMake] Build fix for USE_SYSTEM_MALLOC after r113570.
--- /dev/null
+<!DOCTYPE html>
+<html>
+<script>
+setInterval(function(){
+ var elements = document.getElementsByTagName("*");
+ var didRemoveElement = false;
+ for (var i = 0; i < elements.length; i++) {
+ var element = elements.item(i);
+ if (!element.firstElementChild && element != document.documentElement) {
+ didRemoveElement = true;
+ try {
+ element.parentNode.removeChild(element)
+ } catch(e) { }
+ }
+ }
+
+ if (!didRemoveElement)
+ document.documentElement.innerHTML = "PASS. WebKit didn't crash.";
+}, 100);
+</script>
+<style>
+#test1:after {
+ float: left;
+ content: 'A';
+}
+</style>
+<svg>
+<text>
+<a id="test1">
+A
+</a>
+</text>
+</svg>
+</html>
+2012-04-09 Abhishek Arya <inferno@chromium.org>
+
+ Crash due to floats not cleared before starting SVG <text> layout.
+ https://bugs.webkit.org/show_bug.cgi?id=83021
+
+ Reviewed by Dirk Schulze.
+
+ Manual Test - ManualTests/svg-text-float-not-removed-crash.html.
+ Can't reproduce the failure in DRT.
+
+ forceLayoutInlineChildren is used in SVG <text> layout and overrides
+ RenderBlock::layoutBlock. However, it missed the 'clearFloats' step,
+ which will cause a crash when trying to access removed renderers.
+
+ * rendering/RenderBlock.h:
+ (WebCore::RenderBlock::forceLayoutInlineChildren):
+
2012-04-09 Jeffrey Pfau <jpfau@apple.com>
Filter files from dataTransfer.getData on Mac
{
LayoutUnit repaintLogicalTop = 0;
LayoutUnit repaintLogicalBottom = 0;
+ clearFloats(NormalLayoutPass);
layoutInlineChildren(true, repaintLogicalTop, repaintLogicalBottom);
}
#endif
git://git.webkit.org / WebKit-https.git / commitdiff