Crash in RenderObjectChildList::destroyLeftOverChildren()
https://bugs.webkit.org/show_bug.cgi?id=64753
Reviewed by James Robinson.
Source/WebCore:
If any of the ancestors between column span element and containing
column's block is a continuation, then don't attempt to render the
column span by splitting the block into continuations.
Test: fast/multicol/column-span-parent-continuation-crash.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::columnsBlockForSpanningElement):
LayoutTests:
anonymous-split-block-crash rendering was already wrong. The fix prevents
the tree to go bad and hence does not do the column-span rendering. same issue
with clone-anonymous-block-non-inline-child-crash test.
* fast/multicol/column-span-parent-continuation-crash-expected.txt: Added.
* fast/multicol/column-span-parent-continuation-crash.html: Added.
* platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.png:
* platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.txt:
* platform/mac/fast/multicol/span/clone-anonymous-block-non-inline-child-crash-expected.png:
* platform/mac/fast/multicol/span/clone-anonymous-block-non-inline-child-crash-expected.txt:
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@94541 268f45cc-cd09-0410-ab3c-d52691b4dbfc
9 files changed
