2011-02-03 Abhishek Arya <inferno@chromium.org>
Reviewed by James Robinson.
Tests that we do not crash when overflowing the height of a root
inline box.
https://bugs.webkit.org/show_bug.cgi?id=53729
* fast/overflow/overflow-height-float-not-removed-crash-expected.txt: Added.
* fast/overflow/overflow-height-float-not-removed-crash.html: Added.
2011-02-03 Abhishek Arya <inferno@chromium.org>
Reviewed by James Robinson.
Enforce more limits on root inline boxes height calculations.
https://bugs.webkit.org/show_bug.cgi?id=53729
Test: fast/overflow/overflow-height-float-not-removed-crash.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::removeFloatingObject): prevent logicalBottom to
become negative when logicalTop is INT_MAX.
(WebCore::RenderBlock::markLinesDirtyInBlockRange): when logicalBottom
is INT_MAX, we should dirty everything. So, we bail out to make
afterLowest equal to the lastRootBox() or lowestDirstLine.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@77565
268f45cc-cd09-0410-ab3c-
d52691b4dbfc