resetFlowThreadContainingBlockAndChildInfoIncludingDescendants should not ignore RenderElement subtrees.
https://bugs.webkit.org/show_bug.cgi?id=171873
<rdar://problem/32004954>
Reviewed by Simon Fraser.
Source/WebCore:
Normally a RenderBlock's parent is another RenderBlock, but In some cases (e.g. tables) a RenderBlock can
have a non-RenderBlock(RenderBox) ancestor.
While updating the flow thread state on a subtree, we should descent into subtrees with RenderElement
roots and not just RenderBlocks so that we clear the state on the entire subtree.
Test: fast/multicol/crash-when-column-inside-table.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::resetFlowThreadContainingBlockAndChildInfoIncludingDescendants):
* rendering/RenderBlock.h:
* rendering/RenderElement.cpp:
(WebCore::RenderElement::resetFlowThreadContainingBlockAndChildInfoIncludingDescendants):
* rendering/RenderElement.h:
LayoutTests:
* fast/multicol/crash-when-column-inside-table-expected.txt: Added.
* fast/multicol/crash-when-column-inside-table.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@216549 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 4b7e941..f800f20 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2017-05-09 Zalan Bujtas <zalan@apple.com>
+
+ resetFlowThreadContainingBlockAndChildInfoIncludingDescendants should not ignore RenderElement subtrees.
+ https://bugs.webkit.org/show_bug.cgi?id=171873
+ <rdar://problem/32004954>
+
+ Reviewed by Simon Fraser.
+
+ * fast/multicol/crash-when-column-inside-table-expected.txt: Added.
+ * fast/multicol/crash-when-column-inside-table.html: Added.
+
2017-05-09 Ryan Haddad <ryanhaddad@apple.com>
[iOS Simulator] Flaky failure LayoutTest/webrtc/libwebrtc/release-while-setting-local-description.html
