summaryrefslogtreecommitdiffstats
path: root/WebCore
diff options
context:
space:
mode:
authorBen Murdoch <benm@google.com>2010-10-21 11:46:02 -0700
committerAndroid Git Automerger <android-git-automerger@android.com>2010-10-21 11:46:02 -0700
commit7616c8cd53cceb7d29b9382fc6754e46725af8fc (patch)
tree95cfa0fb0c3875dd325c4d1976872fce691b73d6 /WebCore
parentec63c9f977997c275ca985c2ffa5cad8a2e29523 (diff)
parent8da84207b2b14801ccc039279df2a859a4a52847 (diff)
downloadexternal_webkit-7616c8cd53cceb7d29b9382fc6754e46725af8fc.zip
external_webkit-7616c8cd53cceb7d29b9382fc6754e46725af8fc.tar.gz
external_webkit-7616c8cd53cceb7d29b9382fc6754e46725af8fc.tar.bz2
am 8da84207: Cherry-pick WebKit security fix (webkit.org r68485) Do not merge
Merge commit '8da84207b2b14801ccc039279df2a859a4a52847' into gingerbread-plus-aosp * commit '8da84207b2b14801ccc039279df2a859a4a52847': Cherry-pick WebKit security fix (webkit.org r68485) Do not merge
Diffstat (limited to 'WebCore')
-rw-r--r--WebCore/rendering/RenderBlock.cpp3
1 files changed, 2 insertions, 1 deletions
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index f061953..b720488 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -1005,7 +1005,8 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
if (runInNode)
runInNode->setRenderer(inlineRunIn);
- // Destroy the block run-in.
+ // Destroy the block run-in, which includes deleting its line box tree.
+ blockRunIn->deleteLineBoxTree();
blockRunIn->destroy();
// The block acts like an inline, so just null out its