[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

Wed Dec 22 12:14:54 UTC 2010

The following commit has been merged in the debian/experimental branch:
commit aa25c1127eb5f3dd79d18e353dd186931b86da88
Author: inferno at chromium.org <inferno at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Aug 17 20:49:50 2010 +0000

    2010-08-17  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dave Hyatt.
    
            Only destroy empty anonymous block when it is columns or column span block
            in RenderBlock::removeChild.
            https://bugs.webkit.org/show_bug.cgi?id=44035
    
            Test: fast/block/basic/empty-anonymous-block-remove-crash.html
    
            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::removeChild):
    2010-08-17  Abhishek Arya  <inferno at chromium.org>
    
            Reviewed by Dave Hyatt.
    
            Tests that removing an empty anonymous block does not result in crash.
            https://bugs.webkit.org/show_bug.cgi?id=44035
    
            * fast/block/basic/empty-anonymous-block-remove-crash-expected.txt: Added.
            * fast/block/basic/empty-anonymous-block-remove-crash.html: Added.
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@65538 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index fef024f..f5a5456 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-08-17  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Tests that removing an empty anonymous block does not result in crash.
+        https://bugs.webkit.org/show_bug.cgi?id=44035
+
+        * fast/block/basic/empty-anonymous-block-remove-crash-expected.txt: Added.
+        * fast/block/basic/empty-anonymous-block-remove-crash.html: Added.
+
 2010-08-17  John Gregg  <johnnyg at google.com>
 
         Unreviewed, test expectation.
diff --git a/LayoutTests/editing/selection/5136696-expected.txt b/LayoutTests/fast/block/basic/empty-anonymous-block-remove-crash-expected.txt
similarity index 100%
copy from LayoutTests/editing/selection/5136696-expected.txt
copy to LayoutTests/fast/block/basic/empty-anonymous-block-remove-crash-expected.txt
diff --git a/LayoutTests/fast/block/basic/empty-anonymous-block-remove-crash.html b/LayoutTests/fast/block/basic/empty-anonymous-block-remove-crash.html
new file mode 100644
index 0000000..23328fa
--- /dev/null
+++ b/LayoutTests/fast/block/basic/empty-anonymous-block-remove-crash.html
@@ -0,0 +1,29 @@
+<html>
+    <head>
+        <script>
+            if (window.layoutTestController)
+            {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+        
+            function runTest()
+            {
+                var button = document.getElementById("test");
+                button.insertBefore(document.createElement("tbody"));
+                document.body.offsetTop;
+                document.body.removeChild(button);
+                
+                var result = document.createElement("div");
+                result.innerHTML = "PASS";
+                document.body.appendChild(result);
+                if (window.layoutTestController)
+                    layoutTestController.notifyDone();
+            }
+        </script>
+    </head>
+    <body onload="runTest()">
+        <button id="test"/>
+    </body>
+</html>
+
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index ad3ea90..e075717 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-08-17  Abhishek Arya  <inferno at chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Only destroy empty anonymous block when it is columns or column span block
+        in RenderBlock::removeChild.
+        https://bugs.webkit.org/show_bug.cgi?id=44035
+
+        Test: fast/block/basic/empty-anonymous-block-remove-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+
 2010-08-17  Darin Fisher  <darin at chromium.org>
 
         Reviewed by Darin Adler.
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index 668a92e..bbda168 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -1017,8 +1017,8 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         // If this was our last child be sure to clear out our line boxes.
         if (childrenInline())
             lineBoxes()->deleteLineBoxes(renderArena());
-        // If we're now an empty anonymous block then go ahead and delete ourselves.
-        else if (isAnonymousBlock() && parent() && parent()->isRenderBlock() && !continuation())
+        // If we're now an empty anonymous columns or column span block, then go ahead and delete ourselves.
+        else if ((isAnonymousColumnsBlock() || isAnonymousColumnSpanBlock()) && parent() && parent()->isRenderBlock() && !continuation())
             destroy();
     }
 }

-- 
WebKit Debian packaging

