Shadow children of elements like TextInput may bypass the check for shape inside sharing, as they do not use typical layout mechanisms. The check should check the containing blocks between a descendant and shape-inside ancestor to make sure the descendant can use the shape-inside.
Created attachment 219681 [details] Initial Patch
Created attachment 220669 [details] Additional ancestor check Inline children respecting shape-inside must only have block ancestors between themselves and the shape container. Special controls or Shadow DOM instances may add inline children to non-block elements.
Comment on attachment 220669 [details] Additional ancestor check Attachment 220669 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.appspot.com/results/6594254147158016 New failing tests: media/track/media-element-enqueue-event-crash.html
Created attachment 220687 [details] Archive of layout-test-results from webkit-ews-12 for mac-mountainlion-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: webkit-ews-12 Port: mac-mountainlion-wk2 Platform: Mac OS X 10.8.5
Created attachment 220751 [details] Updated Patch
Created attachment 221510 [details] Updating test with crash note
Comment on attachment 221510 [details] Updating test with crash note View in context: https://bugs.webkit.org/attachment.cgi?id=221510&action=review > Source/WebCore/rendering/RenderBlock.cpp:1463 > + if (flowThread && allowsShapeInsideInfoSharing(*flowThread)) { I think it looks better if you pass the flowThread here as a reference already, thus you define flowThread as RenderFlowThread& > Source/WebCore/rendering/RenderBlock.h:33 > +#if ENABLE(CSS_SHAPES) This guard needs to updated for the new shape-inside guard. > Source/WebCore/rendering/RenderBlock.h:637 > +#if ENABLE(CSS_SHAPES) ditto