tree 3b5405e593db1ccbd1d98c23d9f919906452dbb1
parent 1292e7045d45903d217537d3e19132170d979689
author inferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1315271817 +0000
committer inferno@chromium.org <inferno@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1315271817 +0000

Crash in RenderObjectChildList::destroyLeftOverChildren()
https://bugs.webkit.org/show_bug.cgi?id=64753

Reviewed by James Robinson.

Source/WebCore: 

If any of the ancestors between column span element and containing
column's block is a continuation, then don't attempt to render the
column span by splitting the block into continuations.

Test: fast/multicol/column-span-parent-continuation-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::columnsBlockForSpanningElement):

LayoutTests: 

anonymous-split-block-crash rendering was already wrong. The fix prevents
the tree to go bad and hence does not do the column-span rendering. same issue
with clone-anonymous-block-non-inline-child-crash test.

* fast/multicol/column-span-parent-continuation-crash-expected.txt: Added.
* fast/multicol/column-span-parent-continuation-crash.html: Added.
* platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.png:
* platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.txt:
* platform/mac/fast/multicol/span/clone-anonymous-block-non-inline-child-crash-expected.png:
* platform/mac/fast/multicol/span/clone-anonymous-block-non-inline-child-crash-expected.txt:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@94541 268f45cc-cd09-0410-ab3c-d52691b4dbfc