Skip to content
Permalink
Browse files
ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescend…
…ant() when column spanner's parent is not a RenderBlockFlow.

https://bugs.webkit.org/show_bug.cgi?id=139188
rdar://problem/18502182

Reviewed by David Hyatt.

This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
(descendant's parent is expected to be a RenderBlockFlow)

Source/WebCore:

Test: fast/multicol/svg-content-as-column-spanner-crash.html

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):

LayoutTests:

* fast/multicol/svg-content-as-column-spanner-crash-expected.txt: Added.
* fast/multicol/svg-content-as-column-spanner-crash.html: Added.


Canonical link: https://commits.webkit.org/157081@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@176750 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
alanbujtas committed Dec 3, 2014
1 parent a08f31f commit be82cd3cc9bb73dd146be11cd0259283903f8209
Showing 5 changed files with 46 additions and 1 deletion.
@@ -1,3 +1,18 @@
2014-12-03 Zalan Bujtas <zalan@apple.com>

ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
https://bugs.webkit.org/show_bug.cgi?id=139188
rdar://problem/18502182

Reviewed by David Hyatt.

This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
(descendant's parent is expected to be a RenderBlockFlow)

* fast/multicol/svg-content-as-column-spanner-crash-expected.txt: Added.
* fast/multicol/svg-content-as-column-spanner-crash.html: Added.

2014-12-03 Joanmarie Diggs <jdiggs@igalia.com>

AX: [ATK] Inline text elements with accessible object attributes and/or event handlers are not exposed
@@ -0,0 +1,2 @@
PASS if no crash.

@@ -0,0 +1,11 @@
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 200">
<g>
<text id="text">PASS if no crash.</text>
</g>
<script>
if (window.testRunner)
testRunner.dumpAsText();
document.getElementById("text").setAttribute("style","-webkit-column-span:all;");
document.documentElement.setAttribute("style","-webkit-mask-origin:content;overflow:-webkit-paged-y;");
</script>
</svg>
@@ -1,3 +1,20 @@
2014-12-03 Zalan Bujtas <zalan@apple.com>

ASSERTION: RenderMultiColumnFlowThread::processPossibleSpannerDescendant() when column spanner's parent is not a RenderBlockFlow.
https://bugs.webkit.org/show_bug.cgi?id=139188
rdar://problem/18502182

Reviewed by David Hyatt.

This patch ensures that the validation check for spanner in isValidColumnSpanner() is in synch
with the expectation in RenderMultiColumnFlowThread::processPossibleSpannerDescendant().
(descendant's parent is expected to be a RenderBlockFlow)

Test: fast/multicol/svg-content-as-column-spanner-crash.html

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):

2014-12-03 peavo@outlook.com <peavo@outlook.com>

[TexMap] Redundant method in GraphicsLayerTextureMapper.
@@ -249,7 +249,7 @@ static bool isValidColumnSpanner(RenderMultiColumnFlowThread* flowThread, Render
if (style.columnSpan() != ColumnSpanAll || !is<RenderBox>(*descendant) || descendant->isFloatingOrOutOfFlowPositioned())
return false;

RenderBlock* container = descendant->containingBlock();
RenderElement* container = descendant->parent();
if (!is<RenderBlockFlow>(*container) || container->childrenInline()) {
// Needs to be block-level.
return false;

0 comments on commit be82cd3

Please sign in to comment.