Merge r173843 - ASSERT in RenderMultiColumnSet::requiresBalancing.

https://bugs.webkit.org/show_bug.cgi?id=136376. Reviewed by David Kilzer. Source/WebCore: Added fast/multicol/multicol-selection.html. * rendering/RenderMultiColumnFlowThread.cpp: (WebCore::isValidColumnSpanner): Don't allow an object to become a spanner if it does not have the flow thread as its containing block. Otherwise the flow thread won't get notified of spanner placeholder insertions, and so the spanner ends up orphaned. LayoutTests: * fast/multicol/multicol-selection-expected.txt: Added. * fast/multicol/multicol-selection.html: Added. Canonical link: https://commits.webkit.org/154760.21@webkitgtk/2.6 git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@173915 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Sep 24, 2014 · cea3b10 · cea3b10
1 parent 02c6e6b
commit cea3b10
Show file tree

Hide file tree

Showing 5 changed files with 51 additions and 0 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2014-09-22  David Hyatt  <hyatt@apple.com>
+
+        ASSERT in RenderMultiColumnSet::requiresBalancing.
+        https://bugs.webkit.org/show_bug.cgi?id=136376.
+
+        Reviewed by David Kilzer.
+
+        * fast/multicol/multicol-selection-expected.txt: Added.
+        * fast/multicol/multicol-selection.html: Added.
+
 2014-09-22  Mihnea Ovidenie  <mihnea@adobe.com>
 
         [CSS Regions] Assertion failure and null dereference crash when using animations and regions

diff --git a/LayoutTests/fast/multicol/multicol-selection-expected.txt b/LayoutTests/fast/multicol/multicol-selection-expected.txt
@@ -0,0 +1,2 @@
+This test passes if it doesn't crash.
+
diff --git a/LayoutTests/fast/multicol/multicol-selection.html b/LayoutTests/fast/multicol/multicol-selection.html
@@ -0,0 +1,19 @@
+<head>
+<script>
+if (window.testRunner)
+        testRunner.dumpAsText();
+</script>
+</head>
+This test passes if it doesn't crash.
+<style id="style">
+#elm::before, #elm::after { display:block; -webkit-column-span:all; content:".........."; }
+:last-of-type { position: absolute;}
+</style>
+<div id="div" style="visibility:hidden; -webkit-columns:4; columns:4;">
+   <span id="elm">&nbsp;</span>
+</div>
+<script>
+document.execCommand("SelectAll");
+var elem = document.getElementById("style");
+elem.innerHTML="%a%b3%bf%5c";
+</script>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2014-09-22  David Hyatt  <hyatt@apple.com>
+
+        ASSERT in RenderMultiColumnSet::requiresBalancing.
+        https://bugs.webkit.org/show_bug.cgi?id=136376.
+
+        Reviewed by David Kilzer.
+
+        Added fast/multicol/multicol-selection.html.
+
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::isValidColumnSpanner):
+        Don't allow an object to become a spanner if it does not have the flow
+        thread as its containing block. Otherwise the flow thread won't get notified
+        of spanner placeholder insertions, and so the spanner ends up orphaned.
+
 2014-09-22  Eva Balazsfalvi  <evab.u-szeged@partner.samsung.com>
 
         REGRESSION(r173631): It broke the !ENABLE(VIDEO) build

diff --git a/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp b/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp
@@ -257,6 +257,11 @@ static bool isValidColumnSpanner(RenderMultiColumnFlowThread* flowThread, Render
         // Needs to be block-level.
         return false;
     }
+
+    // We need to have the flow thread as the containing block. A spanner cannot break out of the flow thread.
+    RenderFlowThread* enclosingFlowThread = descendant->flowThreadContainingBlock();
+    if (enclosingFlowThread != flowThread)
+        return false;
 
     // This looks like a spanner, but if we're inside something unbreakable, it's not to be treated as one.
     for (RenderBox* ancestor = toRenderBox(descendant)->parentBox(); ancestor; ancestor = ancestor->parentBox()) {