source: trunk/LayoutTests/ChangeLog @ 116551

Revision 116551, 534.4 KB checked in by commit-queue@webkit.org, 2 years ago (diff)

Crash from removal of a line break object
https://bugs.webkit.org/show_bug.cgi?id=85997

Patch by Ken Buchanan <kenrb@chromium.org> on 2012-05-09
Reviewed by David Hyatt.

Source/WebCore:

Regression from r115343. That replaced a call to setNeedsLayout()
with a separate call that used a different bit during linebox
invalidation after renderer child removal. There are special cases
where layout isn't marked on parent nodes just from the removal, so
line dirtying needs to explicitly mark ancestors for layout.

  • rendering/RenderObject.h:

(WebCore::RenderObject::setAncestorLineBoxDirty):

LayoutTests:

Test case to exercise crashing condition in bug 85997.

  • fast/block/line-layout/line-break-removal-near-textarea-crash-expected.txt: Added
  • fast/block/line-layout/line-break-removal-near-textarea-crash.html: Added
  • Property svn:eol-style set to native

HTML preview not available, since the file size exceeds 262144 bytes. Try downloading the file instead.

Note: See TracBrowser for help on using the repository browser.