Changeset 107336 in webkit

Timestamp:

Feb 9, 2012, 6:13:08 PM (15 years ago)

Author:

cevans@google.com

Message:

Merge 106744
BUG=104317
Review URL: ​https://chromiumcodereview.appspot.com/9374042

Location:

branches/chromium/1025

Files:

• LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash-expected.txt (copied) (copied from trunk/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash-expected.txt )
• LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash.html (copied) (copied from trunk/LayoutTests/fast/css-generated-content/remove-div-from-flexible-box-with-floating-after-content-crash.html )
• Source/WebCore/rendering/RenderBlock.cpp (modified) (2 diffs)

branches/chromium/1025/Source/WebCore/rendering/RenderBlock.cpp

@@ -1025 +1025 @@
     parent->setNeedsLayoutAndPrefWidthsRecalc();
     parent->setChildrenInline(child->childrenInline());
+    RenderObject* nextSibling = child->nextSibling();
     RenderBlock* anonBlock = toRenderBlock(parent->children()->removeChildNode(parent, child, child->hasLayer()));
-    anonBlock->moveAllChildrenTo(parent, child->hasLayer());
+    anonBlock->moveAllChildrenTo(parent, nextSibling, child->hasLayer());
     // Delete the now-empty block's lines and nuke it.
     if (!parent->documentBeingDestroyed())
@@ -1090 +1091 @@
         // box.
         collapseAnonymousBoxChild(this, child);
-    } else if ((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) {
+    } else if (((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) && !isFlexibleBoxIncludingDeprecated()) {
         // It's possible that the removal has knocked us down to a single anonymous
         // block with pseudo-style element siblings (e.g. first-letter). If these