Merge 105769 - Crash when rendering -webkit-column-span.

Source/WebCore/rendering/RenderBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 428 matching lines @@
 }
 
 RenderBlock* RenderBlock::clone() const
 {
     RenderBlock* cloneBlock;
     if (isAnonymousBlock())
         cloneBlock = createAnonymousBlock();
     else {
         cloneBlock = new (renderArena()) RenderBlock(node());
         cloneBlock->setStyle(style());
+        if (!childrenInline() && cloneBlock->firstChild() && cloneBlock->firstChild()->isInline())
+            cloneBlock->makeChildrenNonInline();
     }
     cloneBlock->setChildrenInline(childrenInline());
     return cloneBlock;
 }
 
 void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
                               RenderBlock* middleBlock,
                               RenderObject* beforeChild, RenderBoxModelObject* oldCont)
 {
     // Create a clone of this inline.
@@ skipping 193 matching lines @@
 RenderBlock* RenderBlock::columnsBlockForSpanningElement(RenderObject* newChild)
 {
     // FIXME: This function is the gateway for the addition of column-span support.  It will
     // be added to in three stages:
     // (1) Immediate children of a multi-column block can span.
     // (2) Nested block-level children with only block-level ancestors between them and the multi-column block can span.
     // (3) Nested children with block or inline ancestors between them and the multi-column block can span (this is when we
     // cross the streams and have to cope with both types of continuations mixed together).
     // This function currently supports (1) and (2).
     RenderBlock* columnsBlockAncestor = 0;
-    if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isFloatingOrPositioned()
-        && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
+    if (!newChild->isText() && newChild->style()->columnSpan() && !newChild->isBeforeOrAfterContent()
+        && !newChild->isFloatingOrPositioned() && !newChild->isInline() && !isAnonymousColumnSpanBlock()) {
         if (style()->specifiesColumns())
             columnsBlockAncestor = this;
         else if (!isInline() && parent() && parent()->isRenderBlock()) {
             columnsBlockAncestor = toRenderBlock(parent())->containingColumnsBlock(false);
             
             if (columnsBlockAncestor) {
                 // Make sure that none of the parent ancestors have a continuation.
                 // If yes, we do not want split the block into continuations.
                 RenderObject* curr = this;
                 while (curr && curr != columnsBlockAncestor) {
@@ skipping 6370 matching lines @@
 }
 
 String ValueToString<RenderBlock::FloatingObject*>::string(const RenderBlock::FloatingObject* floatingObject)
 {
     return String::format("%p (%dx%d %dx%d)", floatingObject, floatingObject->x(), floatingObject->y(), floatingObject->maxX(), floatingObject->maxY());
 }
 
 #endif
 
 } // namespace WebCore