diff options
author | Grace Kloba <klobag@google.com> | 2009-11-17 18:40:37 -0800 |
---|---|---|
committer | Android Git Automerger <android-git-automerger@android.com> | 2009-11-17 18:40:37 -0800 |
commit | ed6043358cfce2b3a20a5a4aace2ae99b5302200 (patch) | |
tree | 343335aecfa73f39aad96bb164a7183ea88dbb42 /WebCore/rendering/RenderBlock.cpp | |
parent | 8dcb4bb39afc3d3e0f58ecee412a420fe0290076 (diff) | |
parent | ffe27b58c77e71641efd3bd4258323cd4c29c39a (diff) | |
download | external_webkit-ed6043358cfce2b3a20a5a4aace2ae99b5302200.zip external_webkit-ed6043358cfce2b3a20a5a4aace2ae99b5302200.tar.gz external_webkit-ed6043358cfce2b3a20a5a4aace2ae99b5302200.tar.bz2 |
am ffe27b58: Integrate WebKit security fix http://trac.webkit.org/changeset/50466
Merge commit 'ffe27b58c77e71641efd3bd4258323cd4c29c39a' into eclair-mr2
* commit 'ffe27b58c77e71641efd3bd4258323cd4c29c39a':
Integrate WebKit security fix
Diffstat (limited to 'WebCore/rendering/RenderBlock.cpp')
-rw-r--r-- | WebCore/rendering/RenderBlock.cpp | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp index 902a5b3..7040e06 100644 --- a/WebCore/rendering/RenderBlock.cpp +++ b/WebCore/rendering/RenderBlock.cpp @@ -167,14 +167,17 @@ RenderBlock::~RenderBlock() void RenderBlock::destroy() { - // Detach our continuation first. - if (m_inlineContinuation) + // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will + // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise. + children()->destroyLeftoverChildren(); + + // Destroy our continuation before anything other than anonymous children. + // The reason we don't destroy it before anonymous children is that they may + // have continuations of their own that are anonymous children of our continuation. + if (m_inlineContinuation) { m_inlineContinuation->destroy(); - m_inlineContinuation = 0; - - // Make sure to destroy anonymous children first while they are still connected to the rest of the tree, so that they will - // properly dirty line boxes that they are removed from. Effects that do :before/:after only on hover could crash otherwise. - children()->destroyLeftoverChildren(); + m_inlineContinuation = 0; + } if (!documentBeingDestroyed()) { if (firstLineBox()) { |