Changeset 41537 in webkit
- Timestamp:
- Mar 9, 2009 2:01:54 PM (15 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r41530 r41537 1 2009-03-09 Alpha Lam <hclam@chromium.org> 2 3 Reviewed by Dave Hyatt. 4 5 https://bugs.webkit.org/show_bug.cgi?id=23024 6 7 Added regression test for a bug that causes crashes. 8 9 * fast/block/float/crash-on-absolute-positioning.html: Added. 10 * platform/mac/fast/block/float/crash-on-absolute-positioning-expected.txt: Added. 11 1 12 2009-03-09 Simon Fraser <simon.fraser@apple.com> 2 13 -
trunk/WebCore/ChangeLog
r41535 r41537 1 2009-03-09 Alpha Lam <hclam@chromium.org> 2 3 Reviewed by Dave Hyatt. 4 5 https://bugs.webkit.org/show_bug.cgi?id=23024 6 7 Fix an incorrect criteria in the if statement that leaves references to 8 deleted floating objects in RenderBlock. 9 10 Test: fast/block/float/crash-on-absolute-positioning.html 11 12 * rendering/RenderBlock.cpp: 13 (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout): 14 1 15 2009-03-09 Mike Belshe <mike@belshe.com> 2 16 -
trunk/WebCore/rendering/RenderBlock.cpp
r41458 r41537 3159 3159 if (!childrenInline()) { 3160 3160 for (RenderObject* child = firstChild(); child; child = child->nextSibling()) { 3161 if ( child->isFloatingOrPositioned() || !child->isRenderBlock())3161 if ((!floatToRemove && child->isFloatingOrPositioned()) || !child->isRenderBlock()) 3162 3162 continue; 3163 3163 RenderBlock* childBlock = toRenderBlock(child);
Note: See TracChangeset
for help on using the changeset viewer.