WebCore:
authormitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 7 May 2008 06:33:25 +0000 (06:33 +0000)
committermitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 7 May 2008 06:33:25 +0000 (06:33 +0000)
        Reviewed by Darin Adler.

        - fix <rdar://problem/5914544> Crash in layoutInlineChildren()

        Test: fast/block/float/float-on-zero-height-line.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::markLinesDirtyInVerticalRange):

LayoutTests:

        Reviewed by Darin Adler.

        - test for <rdar://problem/5914544> Crash in layoutInlineChildren()

        * fast/block/float/float-on-zero-height-line.html: Added.
        * platform/mac/fast/block/float/float-on-zero-height-line-expected.checksum: Added.
        * platform/mac/fast/block/float/float-on-zero-height-line-expected.png: Added.
        * platform/mac/fast/block/float/float-on-zero-height-line-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@32945 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/block/float/float-on-zero-height-line.html [new file with mode: 0644]
LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.checksum [new file with mode: 0644]
LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.png [new file with mode: 0644]
LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.txt [new file with mode: 0644]
WebCore/ChangeLog
WebCore/rendering/RenderBlock.cpp

index 979744a..d9f2929 100644 (file)
@@ -1,3 +1,14 @@
+2008-05-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - test for <rdar://problem/5914544> Crash in layoutInlineChildren()
+
+        * fast/block/float/float-on-zero-height-line.html: Added.
+        * platform/mac/fast/block/float/float-on-zero-height-line-expected.checksum: Added.
+        * platform/mac/fast/block/float/float-on-zero-height-line-expected.png: Added.
+        * platform/mac/fast/block/float/float-on-zero-height-line-expected.txt: Added.
+
 2008-05-06  Adam Barth  <abarth-webkit@adambarth.com>
 
         Reviewed by Sam Weinig.
diff --git a/LayoutTests/fast/block/float/float-on-zero-height-line.html b/LayoutTests/fast/block/float/float-on-zero-height-line.html
new file mode 100644 (file)
index 0000000..71afab5
--- /dev/null
@@ -0,0 +1,10 @@
+<div>
+    <div style="display: inline-block; height: 0; width: 50px;">
+        <div style="width: 50px; height: 50px; background-color: green;"></div>
+    </div>
+    <div id="float" style="float: left; height: 50px; width: 50px; background-color: red;"></div>
+</div>
+<script>
+    document.body.offsetTop;
+    document.getElementById("float").style.display = "none";
+</script>
diff --git a/LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.checksum b/LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.checksum
new file mode 100644 (file)
index 0000000..b7d91da
--- /dev/null
@@ -0,0 +1 @@
+7c24eb9d66ff789d889ea113bb0b8a8e
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.png b/LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.png
new file mode 100644 (file)
index 0000000..135d9fa
Binary files /dev/null and b/LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.png differ
diff --git a/LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.txt b/LayoutTests/platform/mac/fast/block/float/float-on-zero-height-line-expected.txt
new file mode 100644 (file)
index 0000000..d728926
--- /dev/null
@@ -0,0 +1,10 @@
+layer at (0,0) size 800x600
+  RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  RenderBlock {HTML} at (0,0) size 800x600
+    RenderBody {BODY} at (8,8) size 784x584
+      RenderBlock {DIV} at (0,0) size 784x0
+        RenderBlock {DIV} at (0,0) size 50x0
+          RenderBlock {DIV} at (0,0) size 50x50 [bgcolor=#008000]
+        RenderText {#text} at (0,0) size 0x0
+        RenderText {#text} at (0,0) size 0x0
index 8780875..49cc09b 100644 (file)
@@ -1,3 +1,14 @@
+2008-05-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/5914544> Crash in layoutInlineChildren()
+
+        Test: fast/block/float/float-on-zero-height-line.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markLinesDirtyInVerticalRange):
+
 2008-05-06  Alice Liu  <alice.liu@apple.com>
 
         Reviewed by Adele Peterson and John Sullivan.
index bc88f7c..f4471cc 100644 (file)
@@ -2648,7 +2648,7 @@ void RenderBlock::markLinesDirtyInVerticalRange(int top, int bottom)
         lowestDirtyLine = lowestDirtyLine->prevRootBox();
     }
 
-    while (afterLowest && afterLowest->blockHeight() > top) {
+    while (afterLowest && afterLowest->blockHeight() >= top) {
         afterLowest->markDirty();
         afterLowest = afterLowest->prevRootBox();
     }