| Révision | 538b01d6410e7c7a5b2faabe7b84c80ddc32d5f3 (tree) |
|---|---|
| l'heure | 2012-02-28 22:16:38 |
| Auteur | Steve Block <steveblock@goog...> |
| Commiter | Steve Block |
Cherry-pick WebKit r100677 to fix a rendering crash
This fixes a crash from positioned generated content under run-in.
See http://trac.webkit.org/changeset/100677.
Bug: 6079158
Change-Id: I3d2012c58f47e71ae500e33551dfab5587b84534
Source/WebCore/rendering/RenderBlock.cpp (diff)| @@ -1561,6 +1561,16 @@ bool RenderBlock::handleRunInChild(RenderBox* child) | ||
| 1561 | 1561 | |
| 1562 | 1562 | RenderBlock* currBlock = toRenderBlock(curr); |
| 1563 | 1563 | |
| 1564 | + // First we destroy any :before/:after content. It will be regenerated by the new inline. | |
| 1565 | + // Exception is if the run-in itself is generated. | |
| 1566 | + if (child->style()->styleType() != BEFORE && child->style()->styleType() != AFTER) { | |
| 1567 | + RenderObject* generatedContent; | |
| 1568 | + if (child->getCachedPseudoStyle(BEFORE) && (generatedContent = child->beforePseudoElementRenderer())) | |
| 1569 | + generatedContent->destroy(); | |
| 1570 | + if (child->getCachedPseudoStyle(AFTER) && (generatedContent = child->afterPseudoElementRenderer())) | |
| 1571 | + generatedContent->destroy(); | |
| 1572 | + } | |
| 1573 | + | |
| 1564 | 1574 | // Remove the old child. |
| 1565 | 1575 | children()->removeChildNode(this, blockRunIn); |
| 1566 | 1576 |
| @@ -1569,16 +1579,11 @@ bool RenderBlock::handleRunInChild(RenderBox* child) | ||
| 1569 | 1579 | RenderInline* inlineRunIn = new (renderArena()) RenderInline(runInNode ? runInNode : document()); |
| 1570 | 1580 | inlineRunIn->setStyle(blockRunIn->style()); |
| 1571 | 1581 | |
| 1572 | - bool runInIsGenerated = child->style()->styleType() == BEFORE || child->style()->styleType() == AFTER; | |
| 1573 | - | |
| 1574 | - // Move the nodes from the old child to the new child, but skip any :before/:after content. It has already | |
| 1575 | - // been regenerated by the new inline. | |
| 1582 | + // Move the nodes from the old child to the new child | |
| 1576 | 1583 | for (RenderObject* runInChild = blockRunIn->firstChild(); runInChild;) { |
| 1577 | 1584 | RenderObject* nextSibling = runInChild->nextSibling(); |
| 1578 | - if (runInIsGenerated || (runInChild->style()->styleType() != BEFORE && runInChild->style()->styleType() != AFTER)) { | |
| 1579 | - blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false); | |
| 1580 | - inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content. | |
| 1581 | - } | |
| 1585 | + blockRunIn->children()->removeChildNode(blockRunIn, runInChild, false); | |
| 1586 | + inlineRunIn->addChild(runInChild); // Use addChild instead of appendChildNode since it handles correct placement of the children relative to :after-generated content. | |
| 1582 | 1587 | runInChild = nextSibling; |
| 1583 | 1588 | } |
| 1584 | 1589 |
Android-x86
Fork