[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-9427-gc2be6fc

[mitz at apple.com]

The following commit has been merged in the debian/experimental branch:
commit b955a90e5e0a1749d81ec5ec70d8ef50b4893ee4
Author: mitz at apple.com <mitz at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Oct 29 02:35:46 2010 +0000

    <rdar://problem/8597430> Crash triggered by incremental layout of block truncated by line-clamp
    https://bugs.webkit.org/show_bug.cgi?id=48602
    
    Reviewed by Simon Fraser.
    
    WebCore:
    
    Test: fast/flexbox/line-clamp-crash.html
    
    * rendering/RenderFlexibleBox.cpp:
    (WebCore::RenderFlexibleBox::applyLineClamp): Even if the child needs layout, call clearTruncation(),
    since layout itself may be partial and not touch the truncated line (but touch its markup box).
    
    LayoutTests:
    
    * fast/flexbox/line-clamp-crash-expected.txt: Added.
    * fast/flexbox/line-clamp-crash.html: Added.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@70834 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 1560bb5..3beeed0 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-10-28  Dan Bernstein  <mitz at apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/8597430> Crash triggered by incremental layout of block truncated by line-clamp
+        https://bugs.webkit.org/show_bug.cgi?id=48602
+
+        * fast/flexbox/line-clamp-crash-expected.txt: Added.
+        * fast/flexbox/line-clamp-crash.html: Added.
+
 2010-10-28  Dmitry Titov  <dimich at chromium.org>
 
         [Chromium] Uneviewed, test_expectations fix.
diff --git a/LayoutTests/fast/flexbox/line-clamp-crash-expected.txt b/LayoutTests/fast/flexbox/line-clamp-crash-expected.txt
new file mode 100644
index 0000000..3c000f5
--- /dev/null
+++ b/LayoutTests/fast/flexbox/line-clamp-crash-expected.txt
@@ -0,0 +1,18 @@
+Test that an incremental layout of a block with line-clamp truncation does not trigger a crash.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+X
diff --git a/LayoutTests/fast/flexbox/line-clamp-crash.html b/LayoutTests/fast/flexbox/line-clamp-crash.html
new file mode 100644
index 0000000..8746f13
--- /dev/null
+++ b/LayoutTests/fast/flexbox/line-clamp-crash.html
@@ -0,0 +1,38 @@
+<p>
+    Test that an incremental layout of a block with line-clamp truncation does not trigger a crash.
+</p>
+<div style="-webkit-box-orient: vertical; -webkit-line-clamp: 5; display: -webkit-box;">
+    <div>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <span id="target">Running </span>
+        <a href="#">X</a>
+    </div>
+</div>
+<script>
+    function test()
+    {
+        var placeholder = document.getElementById("target");
+        placeholder.parentNode.removeChild(placeholder);
+    }
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    document.body.offsetTop;
+    test();
+    document.body.offsetTop;
+</script>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index bfd4c2c..1e33eb5 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2010-10-28  Dan Bernstein  <mitz at apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/8597430> Crash triggered by incremental layout of block truncated by line-clamp
+        https://bugs.webkit.org/show_bug.cgi?id=48602
+
+        Test: fast/flexbox/line-clamp-crash.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::applyLineClamp): Even if the child needs layout, call clearTruncation(),
+        since layout itself may be partial and not touch the truncated line (but touch its markup box).
+
 2010-10-28  Jian Li  <jianli at chromium.org>
 
         Reviewed by Dmitry Titov.
diff --git a/WebCore/rendering/RenderFlexibleBox.cpp b/WebCore/rendering/RenderFlexibleBox.cpp
index da4a6fa..63bada6 100644
--- a/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/WebCore/rendering/RenderFlexibleBox.cpp
@@ -918,7 +918,7 @@ void RenderFlexibleBox::applyLineClamp(FlexBoxIterator& iterator, bool relayoutC
             continue;
 
         if (relayoutChildren || (child->isReplaced() && (child->style()->width().isPercent() || child->style()->height().isPercent()))
-            || (child->style()->height().isAuto() && child->isBlockFlow() && !child->needsLayout())) {
+            || (child->style()->height().isAuto() && child->isBlockFlow())) {
             child->setChildNeedsLayout(true, false);
 
             // Dirty all the positioned objects.

-- 
WebKit Debian packaging