ASSERTION FAILED: !object || object->isBox(), UNKNOWN in WebCore::RenderListItem::positionListMarker

https://bugs.webkit.org/show_bug.cgi?id=108699

Reviewed by Abhishek Arya.

Source/WebCore:

RenderListItems performs special management of its children to maintain list markers. Splitting a flow
through a list item results in assumptions made inside RenderListItem failing, so for now, avoid splittin
flows when inside one.

Test: fast/multicol/span/list-multi-column-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::containingColumnsBlock):

LayoutTests:

* fast/multicol/span/list-multi-column-crash-expected.txt: Added.
* fast/multicol/span/list-multi-column-crash.html: Added.

Change-Id: If570c787773fbc69cecbb60833be32c445f2dc2b
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142657 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>

2 files changed, 20 insertions, 7 deletions

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 3f112badb..a356e1911 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2013-02-21  Levi Weintraub  <leviw@chromium.org>
+
+        ASSERTION FAILED: !object || object->isBox(), UNKNOWN in WebCore::RenderListItem::positionListMarker
+        https://bugs.webkit.org/show_bug.cgi?id=108699
+
+        Reviewed by Abhishek Arya.
+
+        RenderListItems performs special management of its children to maintain list markers. Splitting a flow
+        through a list item results in assumptions made inside RenderListItem failing, so for now, avoid splitting
+        flows when inside one.
+
+        Test: fast/multicol/span/list-multi-column-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::containingColumnsBlock):
+
 2013-02-19  Andras Becsi  <andras.becsi@digia.com>
 
         [Qt] Fix compilation if Qt was configured with -no-rtti
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 8c6249765..4265ecdf3 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -530,13 +530,10 @@ RenderBlock* RenderBlock::containingColumnsBlock(bool allowAnonymousColumnBlock)
             || curr->isInlineBlockOrInlineTable())
             return 0;
 
-        // FIXME: Table manages its own table parts, most of which are RenderBoxes.
-        // Multi-column code cannot handle splitting the flow in table. Disabling it
-        // to prevent crashes.
-        // Similarly, RenderButton maintains an anonymous block child and overrides
-        // addChild() to prevent itself from having additional direct children. This
-        // causes problems for split flows.
-        if (curr->isTable() || curr->isRenderButton())
+        // FIXME: Tables, RenderButtons, and RenderListItems all do special management
+        // of their children that breaks when the flow is split through them. Disabling
+        // multi-column for them to avoid this problem.
+        if (curr->isTable() || curr->isRenderButton() || curr->isListItem())
             return 0;
         
         RenderBlock* currBlock = toRenderBlock(curr);