Stale pointer due to floats not removed (flexible box display)
authorTony Chang <tony@chromium.org>
Wed, 20 Jul 2011 19:01:55 +0000 (19:01 +0000)
committerAdemar de Souza Reis Jr <ademar.reis@openbossa.org>
Fri, 22 Jul 2011 15:11:35 +0000 (12:11 -0300)
commitbce3b14f54c084e3e331ec2fbe0fdb30097cd368
treeb3279ec421bb656a940733bf1d0b800e4dc95d7a
parent0f2aaa057e79e01f6935e41c84d40cb23c6cc6f4
Stale pointer due to floats not removed (flexible box display)
https://bugs.webkit.org/show_bug.cgi?id=64603

Reviewed by David Hyatt.

Source/WebCore:

Flexbox items should avoid floats.

Test: fast/flexbox/horizontal-box-float-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::avoidsFloats):
* rendering/RenderBox.h:
(WebCore::RenderBox::isDeprecatedFlexItem):

LayoutTests:

* fast/flexbox/horizontal-box-float-crash-expected.txt: Added.
* fast/flexbox/horizontal-box-float-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@91386 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/flexbox/horizontal-box-float-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/flexbox/horizontal-box-float-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBox.cpp
Source/WebCore/rendering/RenderBox.h