Source/WebCore/ChangeLog

 12012-11-28 Qiankun Miao <qiankun.miao@intel.com>
 2
 3 Fix "endColumn" overflow in RenderBlock::adjustRectForColumns()
 4 https://bugs.webkit.org/show_bug.cgi?id=68744
 5
 6 Reviewed by NOBODY (OOPS!).
 7
 8 When running fast/multicol/span/span-as-immediate-child-complex-splitting.html
 9 "endColumn" variable in RenderBlock::adjustRectForColumns overflows.
 10 This is due to during endColumn calculation "endOffset" is smaller than
 11 "beforeBorderPadding", while "endOffset" should be no less than
 12 "startOffset" which is equal to or larger than "beforeBorderPadding".
 13 Set "endOffset" be the maximum of "startOffset" and "endOffset" to fix
 14 this issue.
 15
 16 Tests: fast/multicol/span/span-as-nested-columns-child-dynamic.html
 17 fast/multicol/span/span-as-immediate-columns-child-dynamic.html
 18 fast/multicol/span/span-as-immediate-columns-child.html
 19 fast/multicol/span/span-as-nested-columns-child.html
 20 fast/multicol/span/span-as-immediate-child-generated-content.html
 21 fast/multicol/span/span-as-immediate-columns-child-removal.html
 22 fast/multicol/span/generated-child-split-flow-crash.html
 23 fast/multicol/span/span-as-immediate-child-property-removal.html
 24 fast/multicol/span/span-as-immediate-child-complex-splitting.html
 25
 26 * rendering/RenderBlock.cpp:
 27 (WebCore::RenderBlock::adjustRectForColumns):
 28
1292012-11-23 Dirk Schulze <krit@webkit.org>
230
331 Remove -webkit-mask-attachment

Source/WebCore/rendering/RenderBlock.cpp

@@void RenderBlock::adjustRectForColumns(LayoutRect& r) const
54865486
54875487 LayoutUnit startOffset = max(isHorizontal ? r.y() : r.x(), beforeBorderPadding);
54885488 LayoutUnit endOffset = min<LayoutUnit>(isHorizontal ? r.maxY() : r.maxX(), beforeBorderPadding + colCount * colHeight);
 5489 endOffset = max<LayoutUnit>(startOffset, endOffset);
 5490 ASSERT(startOffset <= endOffset);
54895491
5490  // FIXME: Can overflow on fast/block/float/float-not-removed-from-next-sibling4.html, see https://bugs.webkit.org/show_bug.cgi?id=68744
54915492 unsigned startColumn = (startOffset - beforeBorderPadding) / colHeight;
54925493 unsigned endColumn = (endOffset - beforeBorderPadding) / colHeight;
54935494