Changeset 40313 in webkit

Timestamp:

Jan 28, 2009 9:39:41 AM (15 years ago)

Author:

hyatt@apple.com

Message:

2009-01-28 David Hyatt <​hyatt@apple.com>

Fix for

<rdar://problem/6531287> REGRESSION: CrashTracer: [USER] 12 crashes in Safari at com.apple.WebCore • WebCore::RenderBlock::removeFloatingObject + 59

My tightening up of markAllDescendantsWithFloatsForLayout exposed a buggy check in that code that could
lead to a bad cast.

• rendering/RenderBlock.cpp: (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderBlock.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Fix for 
+
+        <rdar://problem/6531287> REGRESSION: CrashTracer: [USER] 12 crashes in Safari at com.apple.WebCore • WebCore::RenderBlock::removeFloatingObject + 59
+
+        My tightening up of markAllDescendantsWithFloatsForLayout exposed a buggy check in that code that could
+        lead to a bad cast.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+
 2009-01-27  David Hyatt  <hyatt@apple.com>
 

trunk/WebCore/rendering/RenderBlock.cpp

@@ -3056 +3056 @@
     if (!childrenInline()) {
         for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
-            if (isBlockFlow() && !child->isFloatingOrPositioned() &&
+            if (child->isRenderBlock() && !child->isFloatingOrPositioned() &&
                 ((floatToRemove ? child->containsFloat(floatToRemove) : child->containsFloats()) || child->shrinkToAvoidFloats()))
                 static_cast<RenderBlock*>(child)->markAllDescendantsWithFloatsForLayout(floatToRemove, inLayout);