vitalif
/
phantomjs
mirror of https://github.com/vitalif/phantomjs
1
0
Fork 0
Code Issues Releases Wiki Activity

Restore dirty line logic in RenderInline::destroy. 

WebKit upstream fix: http://trac.webkit.org/changeset/86060
WebKit upsteam bug: https://bugs.webkit.org/show_bug.cgi?id=60448

Related issues:
http://code.google.com/p/phantomjs/issues/detail?id=704
http://code.google.com/p/phantomjs/issues/detail?id=703
http://code.google.com/p/phantomjs/issues/detail?id=675
http://code.google.com/p/phantomjs/issues/detail?id=689
http://code.google.com/p/phantomjs/issues/detail?id=532
http://code.google.com/p/phantomjs/issues/detail?id=851
1.8
Vitaliy Slobodin 2012-11-14 14:20:06 +04:00 committed by Ariya Hidayat
parent 559afcd4e8
commit 40a14b72b1
3 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/qt/src/3rdparty/webkit/Source/WebCore/rendering/RenderInline.cpp vendored
View File

@ -99,7 +99,8 @@ void RenderInline::destroy()
for (InlineFlowBox* box = firstLineBox(); box; box = box->nextLineBox())
box->remove();
}
}
} else if (parent())
parent()->dirtyLinesFromChangedChild(this);
}
m_lineBoxes.deleteLineBoxes(renderArena());

6
test/webkit-spec.js
View File

@ -8,4 +8,10 @@ describe("WebKit", function() {
var date = Date.parse("2012-01-01");
expect(date).toEqual(1325376000000);
});
it("should not crash when failing to dirty lines while removing a inline.", function () {
var p = require("webpage").create();
p.open('../test/webkit-spec/inline-destroy-dirty-lines-crash.html');
waits(50);
});
});

15
test/webkit-spec/inline-destroy-dirty-lines-crash.html Normal file
View File

@ -0,0 +1,15 @@
<html>
<body onload="runTest()">
Test passes if it does not crash.
<script>
function runTest()
{
document.body.offsetTop;
child = document.getElementById('test');
child.parentNode.removeChild(child);
}
</script>
<br>
<span id="test"></span>
</body>
</html>