Merge r173845 - Bad cast in isValidColumnSpanner.

https://bugs.webkit.org/show_bug.cgi?id=133380. Reviewed by Simon Fraser. Source/WebCore: Added fast/multicol/multicol-crazy-nesting.html * rendering/RenderMultiColumnFlowThread.cpp: (WebCore::isValidColumnSpanner): The crawl up the chain looking for unsplittable objects should use containing blocks and not be casting to parent boxes. You can have an inline in the parent chain, so this was not the right way to walk up the tree. LayoutTests: * fast/multicol/multicol-crazy-nesting-expected.txt: Added. * fast/multicol/multicol-crazy-nesting.html: Added. Canonical link: https://commits.webkit.org/154760.22@webkitgtk/2.6 git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173916 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Sep 24, 2014 · 0639290 · 0639290
1 parent cea3b10
commit 0639290
Show file tree

Hide file tree

Showing 5 changed files with 41 additions and 1 deletion.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2014-09-22  David Hyatt  <hyatt@apple.com>
+
+        Bad cast in isValidColumnSpanner.
+        https://bugs.webkit.org/show_bug.cgi?id=133380.
+
+        Reviewed by Simon Fraser.
+
+        * fast/multicol/multicol-crazy-nesting-expected.txt: Added.
+        * fast/multicol/multicol-crazy-nesting.html: Added.
+
 2014-09-22  David Hyatt  <hyatt@apple.com>
 
         ASSERT in RenderMultiColumnSet::requiresBalancing.

diff --git a/LayoutTests/fast/multicol/multicol-crazy-nesting-expected.txt b/LayoutTests/fast/multicol/multicol-crazy-nesting-expected.txt
@@ -0,0 +1,2 @@
+This test passes if it doesn't crash.
+
diff --git a/LayoutTests/fast/multicol/multicol-crazy-nesting.html b/LayoutTests/fast/multicol/multicol-crazy-nesting.html
@@ -0,0 +1,13 @@
+<head>
+<script>
+if (window.testRunner)
+        testRunner.dumpAsText();
+</script>
+<style>
+* { -webkit-columns:3; -webkit-column-span:all }
+</style>
+</head>
+This test passes if it doesn't crash.
+<span>
+<div style="float:left">
+<div></div>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2014-09-22  David Hyatt  <hyatt@apple.com>
+
+        Bad cast in isValidColumnSpanner.
+        https://bugs.webkit.org/show_bug.cgi?id=133380.
+
+        Reviewed by Simon Fraser.
+
+        Added fast/multicol/multicol-crazy-nesting.html
+
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::isValidColumnSpanner):
+        The crawl up the chain looking for unsplittable objects should use containing blocks
+        and not be casting to parent boxes. You can have an inline in the parent chain, so
+        this was not the right way to walk up the tree.
+
 2014-09-22  David Hyatt  <hyatt@apple.com>
 
         ASSERT in RenderMultiColumnSet::requiresBalancing.

diff --git a/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp b/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp
@@ -264,7 +264,7 @@ static bool isValidColumnSpanner(RenderMultiColumnFlowThread* flowThread, Render
         return false;
 
     // This looks like a spanner, but if we're inside something unbreakable, it's not to be treated as one.
-    for (RenderBox* ancestor = toRenderBox(descendant)->parentBox(); ancestor; ancestor = ancestor->parentBox()) {
+    for (RenderBox* ancestor = toRenderBox(descendant)->containingBlock(); ancestor; ancestor = ancestor->containingBlock()) {
         if (ancestor->isRenderFlowThread()) {
             // Don't allow any intervening non-multicol fragmentation contexts. The spec doesn't say
             // anything about disallowing this, but it's just going to be too complicated to