REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThre...
[WebKit-https.git] / LayoutTests / ChangeLog
index 1415a9476f8a4bbd233cadf53dccc7a8d46a1feb..0147332a7d03488a3296144fa1b2d73474b133e0 100644 (file)
@@ -1,3 +1,19 @@
+2015-02-07  Zalan Bujtas  <zalan@apple.com>
+
+        REGRESSION (r168046): Crash in WebCore::InlineBox::renderer / WebCore::RenderFlowThread::checkLinesConsistency
+        https://bugs.webkit.org/show_bug.cgi?id=133462
+
+        Reviewed by David Hyatt.
+
+        RenderFlowThread::m_lineToRegionMap stores pointers to the root inlineboxes in the block flow.
+        Normally root inlineboxes remove themselves from this map in their dtors. However when collapsing an anonymous block,
+        we detach the inline tree first and destroy them after. The detached root boxes can't access
+        the flowthread containing block and we end up with dangling pointers in this map.
+        Call removeFlowChildInfo() before detaching the subtree to ensure proper pointer removal.
+
+        * fast/multicol/newmulticol/crash-when-switching-to-floating-expected.txt: Added.
+        * fast/multicol/newmulticol/crash-when-switching-to-floating.html: Added.
+
 2015-02-10  David Kilzer  <ddkilzer@apple.com>
 
         [iOS] Gardening: fast/loader/subframe-navigate-during-main-frame-load.html crashes running all tests