Skip to content

GitLab

T
tangled
Commit 01b3266b authored by kenrb@chromium.org's avatar kenrb@chromium.org
Browse files
Options

Clear sibling floats while splitting inline flow. 

During RenderInline::splitFlow(), floats are cleared on an anonymous containingBlock() for
the inline being split. This is a problem if siblings of the block contain references to
the same floats, since the float removal code in markSiblingsWithFloatsForLayout() will not
later find them.

R=inferno@chromium.org
BUG=245727

Review URL: https://codereview.chromium.org/203483002

git-svn-id: svn://svn.chromium.org/blink/trunk@169658 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent 50dcc591
Hide whitespace changes
Inline Side-by-side
Showing with 35 additions and 0 deletions
third_party/WebKit/LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html 0 → 100644
View file @ 01b3266b
<html>
<p style='white: fuchsia; padding: 198px 108 2147483647px; '></p>
<myelement>
<body>
<sup style="kerning: 7; display: table-row; "></sup>
<iframe align=right style="font-variant: small-caps;> mask: url(#tCF84); border-right-width: 20543.4114163cm; "></iframe>
<p id=tCF100></p>
<span id=tCF104>
</body>
<script>
window.onload = function() {
keygenElem = document.createElementNS("http://www.w3.org/1999/xhtml", "keygen");
keygenElem.setAttribute("autofocus", "Tm");
document.body.appendChild(keygenElem);
document.body.appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "td"));
document.body.appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "video"));
setTimeout("CFcrash()", 1);
if (window.testRunner)
testRunner.waitUntilDone();
}
function CFcrash() {
tCF104.appendChild(tCF100);
document.body.innerHTML = "PASS if no crash or assert under ASAN";
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.notifyDone();
}
}
</script>
</html>
third_party/WebKit/Source/core/rendering/RenderBlockFlow.cpp
View file @ 01b3266b
...@@ -2090,6 +2090,8 @@ void RenderBlockFlow::removeFloatingObjects() ...@@ -2090,6 +2090,8 @@ void RenderBlockFlow::removeFloatingObjects()
if (!m_floatingObjects) if (!m_floatingObjects)
return; return;
markSiblingsWithFloatsForLayout();
m_floatingObjects->clear(); m_floatingObjects->clear();
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment