diff options
| author | Ben Murdoch <benm@google.com> | 2010-10-21 16:26:08 +0100 |
|---|---|---|
| committer | Ben Murdoch <benm@google.com> | 2010-10-21 16:26:41 +0100 |
| commit | 8da84207b2b14801ccc039279df2a859a4a52847 (patch) | |
| tree | 3cbc5ab6134db8710fe424756ce9cf1f6432aa0d /WebCore/rendering/RenderBlock.cpp | |
| parent | a7b8ec708c2566cc6e69c0b464e416c018227b02 (diff) | |
| download | external_webkit-8da84207b2b14801ccc039279df2a859a4a52847.zip external_webkit-8da84207b2b14801ccc039279df2a859a4a52847.tar.gz external_webkit-8da84207b2b14801ccc039279df2a859a4a52847.tar.bz2 | |
Cherry-pick WebKit security fix (webkit.org r68485) Do not merge
See http://trac.webkit.org/changeset/68485
Change-Id: I714d385759a6e30d315cd2ace4aa87a2d7b28e92
Diffstat (limited to 'WebCore/rendering/RenderBlock.cpp')
| -rw-r--r-- | WebCore/rendering/RenderBlock.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp index f061953..b720488 100644 --- a/WebCore/rendering/RenderBlock.cpp +++ b/WebCore/rendering/RenderBlock.cpp @@ -1005,7 +1005,8 @@ bool RenderBlock::handleRunInChild(RenderBox* child) if (runInNode) runInNode->setRenderer(inlineRunIn); - // Destroy the block run-in. + // Destroy the block run-in, which includes deleting its line box tree. + blockRunIn->deleteLineBoxTree(); blockRunIn->destroy(); // The block acts like an inline, so just null out its |