Crash in RenderBlock::splitBlocks.
authorinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 23 Mar 2012 22:05:21 +0000 (22:05 +0000)
committerinferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 23 Mar 2012 22:05:21 +0000 (22:05 +0000)
commitb6a21bfa6fbcb9e71f2470db7ed445d5b09843b1
tree32988a0e24c936e76c5f58c205647a76e683ac9a
parentd98a26fca885abb63d88978487074f4018ff44df
Crash in RenderBlock::splitBlocks.
https://bugs.webkit.org/show_bug.cgi?id=81926

Reviewed by Julien Chaffraix.

Source/WebCore:

We are updating the :after content before calling splitFlow. The :after content
gets blown away since it will go to the continuation. beforeChild was earlier
set to the first child. Being the last anonymous block, its children gets pulled
up in collapseAnonymousBoxChild and it gets destroyed. So, we need to update
beforeChild value.

Test: fast/multicol/span/update-after-content-before-child-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):

LayoutTests:

* fast/multicol/span/update-after-content-before-child-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@111912 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/multicol/span/update-after-content-before-child-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/multicol/span/update-after-content-before-child-crash.html [new file with mode: 0755]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlock.cpp