Changeset 31227

Timestamp:

03/21/08 23:57:28 (8 months ago)

Author:

mitz@apple.com

Message:

WebCore:

Reviewed by Oliver Hunt.

• fix http://bugs.webkit.org/show_bug.cgi?id=17988 REGRESSION (r31114-31132): Crash in InlineBox::isDirty() opening chowhound.com

Test: fast/css-generated-content/empty-content-with-float-crash.html

• rendering/bidi.cpp: (WebCore::RenderBlock::layoutInlineChildren): Added a null check for the case where the block contains no in-flow elements but still lays out as a line flow, which can happen as a result of empty generated content.

LayoutTests:

Reviewed by Oliver Hunt.

• test for http://bugs.webkit.org/show_bug.cgi?id=17988 REGRESSION (r31114-31132): Crash in InlineBox::isDirty() opening chowhound.com

• fast/css-generated-content/empty-content-with-float-crash-expected.txt: Added.
• fast/css-generated-content/empty-content-with-float-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css-generated-content/empty-content-with-float-crash-expected.txt (added)
• LayoutTests/fast/css-generated-content/empty-content-with-float-crash.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/rendering/bidi.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2008-03-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - test for http://bugs.webkit.org/show_bug.cgi?id=17988
+          REGRESSION (r31114-31132): Crash in InlineBox::isDirty() opening chowhound.com
+
+        * fast/css-generated-content/empty-content-with-float-crash-expected.txt: Added.
+        * fast/css-generated-content/empty-content-with-float-crash.html: Added.
+
 2008-03-21  Oliver Hunt  <oliver@apple.com>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2008-03-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=17988
+          REGRESSION (r31114-31132): Crash in InlineBox::isDirty() opening chowhound.com
+
+        Test: fast/css-generated-content/empty-content-with-float-crash.html
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Added a null check for
+        the case where the block contains no in-flow elements but still lays
+        out as a line flow, which can happen as a result of empty generated
+        content.
+
 2008-03-21  Sam Weinig  <sam@webkit.org>
 

trunk/WebCore/rendering/bidi.cpp

@@ -940 +940 @@
             }
 
-            if (m_floatingObjects) {
+            if (m_floatingObjects && lastRootBox()) {
                 if (lastFloat) {
                     for (FloatingObject* f = m_floatingObjects->last(); f != lastFloat; f = m_floatingObjects->prev()) {