Changeset 176750 in webkit

Timestamp:

Dec 3, 2014, 12:53:49 PM (12 years ago)

Author:

Alan Bujtas

Message:

ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
​https://bugs.webkit.org/show_bug.cgi?id=139188
rdar://problem/18502182

Reviewed by David Hyatt.

This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
(descendant's parent is expected to be a RenderBlockFlow)

Source/WebCore:

Test: fast/multicol/svg-content-as-column-spanner-crash.html

• rendering/RenderMultiColumnFlowThread.cpp:

(WebCore::isValidColumnSpanner):

LayoutTests:

• fast/multicol/svg-content-as-column-spanner-crash-expected.txt: Added.
• fast/multicol/svg-content-as-column-spanner-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/multicol/svg-content-as-column-spanner-crash-expected.txt (added)
• LayoutTests/fast/multicol/svg-content-as-column-spanner-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-12-03  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
+        https://bugs.webkit.org/show_bug.cgi?id=139188
+        rdar://problem/18502182
+
+        Reviewed by David Hyatt.
+
+        This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
+        with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
+        (descendant's parent is expected to be a RenderBlockFlow)
+
+        * fast/multicol/svg-content-as-column-spanner-crash-expected.txt: Added.
+        * fast/multicol/svg-content-as-column-spanner-crash.html: Added.
+
 2014-12-03  Joanmarie Diggs  <jdiggs@igalia.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-12-03  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
+        https://bugs.webkit.org/show_bug.cgi?id=139188
+        rdar://problem/18502182
+
+        Reviewed by David Hyatt.
+
+        This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
+        with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
+        (descendant's parent is expected to be a RenderBlockFlow)
+
+        Test: fast/multicol/svg-content-as-column-spanner-crash.html
+
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::isValidColumnSpanner):
+
 2014-12-03  peavo@outlook.com  <peavo@outlook.com>
 

trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp

@@ -250 +250 @@
         return false;
 
-    RenderBlock* container = descendant->containingBlock();
+    RenderElement* container = descendant->parent();
     if (!is<RenderBlockFlow>(*container) || container->childrenInline()) {
         // Needs to be block-level.