Diff
Modified: branches/safari-603-branch/LayoutTests/ChangeLog (214157 => 214158)
--- branches/safari-603-branch/LayoutTests/ChangeLog 2017-03-20 01:32:20 UTC (rev 214157)
+++ branches/safari-603-branch/LayoutTests/ChangeLog 2017-03-20 01:32:24 UTC (rev 214158)
@@ -1,5 +1,20 @@
2017-03-16 Jason Marcell <jmarc...@apple.com>
+ Merge r214023. rdar://problem/31091039
+
+ 2017-03-15 Zalan Bujtas <za...@apple.com>
+
+ Do not reparent floating object until after intruding/overhanging dependency is cleared.
+ https://bugs.webkit.org/show_bug.cgi?id=169711
+ <rdar://problem/30959743>
+
+ Reviewed by Simon Fraser.
+
+ * fast/block/float/inline-becomes-float-and-moves-around-expected.txt: Added.
+ * fast/block/float/inline-becomes-float-and-moves-around.html: Added.
+
+2017-03-16 Jason Marcell <jmarc...@apple.com>
+
Merge r213967. rdar://problem/30921827
2017-03-14 Wenson Hsieh <wenson_hs...@apple.com>
Added: branches/safari-603-branch/LayoutTests/fast/block/float/inline-becomes-float-and-moves-around-expected.txt (0 => 214158)
--- branches/safari-603-branch/LayoutTests/fast/block/float/inline-becomes-float-and-moves-around-expected.txt (rev 0)
+++ branches/safari-603-branch/LayoutTests/fast/block/float/inline-becomes-float-and-moves-around-expected.txt 2017-03-20 01:32:24 UTC (rev 214158)
@@ -0,0 +1,2 @@
+
+PASS if no crash or assert.
Added: branches/safari-603-branch/LayoutTests/fast/block/float/inline-becomes-float-and-moves-around.html (0 => 214158)
--- branches/safari-603-branch/LayoutTests/fast/block/float/inline-becomes-float-and-moves-around.html (rev 0)
+++ branches/safari-603-branch/LayoutTests/fast/block/float/inline-becomes-float-and-moves-around.html 2017-03-20 01:32:24 UTC (rev 214158)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we don't crash while moving floats around.</title>
+<script>
+function runTest() {
+ document.body.offsetHeight
+ div0.style.float = "right"
+ window.getSelection().addRange(document.createRange());
+ div0.parentElement.removeChild(div0)
+ document.body.offsetHeight
+ if (window.testRunner)
+ testRunner.dumpAsText();
+}
+</script>
+<body _onload_="runTest()">
+<div style="display: inline-flex"></div><div id=div0><li style="float: left"></li></div><br><div></div>
+PASS if no crash or assert.
+</body>
+</html>
Modified: branches/safari-603-branch/Source/WebCore/ChangeLog (214157 => 214158)
--- branches/safari-603-branch/Source/WebCore/ChangeLog 2017-03-20 01:32:20 UTC (rev 214157)
+++ branches/safari-603-branch/Source/WebCore/ChangeLog 2017-03-20 01:32:24 UTC (rev 214158)
@@ -1,5 +1,28 @@
2017-03-16 Jason Marcell <jmarc...@apple.com>
+ Merge r214023. rdar://problem/31091039
+
+ 2017-03-15 Zalan Bujtas <za...@apple.com>
+
+ Do not reparent floating object until after intruding/overhanging dependency is cleared.
+ https://bugs.webkit.org/show_bug.cgi?id=169711
+ <rdar://problem/30959743>
+
+ Reviewed by Simon Fraser.
+
+ This patch ensures that we cleanup the m_floatingObjects for siblings before reparenting the fresh float.
+
+ Test: fast/block/float/inline-becomes-float-and-moves-around.html
+
+ * rendering/RenderBlockFlow.cpp:
+ (WebCore::RenderBlockFlow::styleDidChange):
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::styleDidChange):
+ * rendering/RenderElement.h:
+ (WebCore::RenderElement::noLongerAffectsParentBlock):
+
+2017-03-16 Jason Marcell <jmarc...@apple.com>
+
Merge r213967. rdar://problem/30921827
2017-03-14 Wenson Hsieh <wenson_hs...@apple.com>
Modified: branches/safari-603-branch/Source/WebCore/rendering/RenderBlockFlow.cpp (214157 => 214158)
--- branches/safari-603-branch/Source/WebCore/rendering/RenderBlockFlow.cpp 2017-03-20 01:32:20 UTC (rev 214157)
+++ branches/safari-603-branch/Source/WebCore/rendering/RenderBlockFlow.cpp 2017-03-20 01:32:24 UTC (rev 214158)
@@ -2066,6 +2066,10 @@
parentBlock->markAllDescendantsWithFloatsForLayout();
parentBlock->markSiblingsWithFloatsForLayout();
}
+ // Fresh floats need to be reparented if they actually belong to the previous anonymous block.
+ // It copies the logic of RenderBlock::addChildIgnoringContinuation
+ if (noLongerAffectsParentBlock() && style().isFloating() && previousSibling() && previousSibling()->isAnonymousBlock())
+ downcast<RenderBoxModelObject>(*parent()).moveChildTo(&downcast<RenderBoxModelObject>(*previousSibling()), this);
if (auto fragment = renderNamedFlowFragment())
fragment->setStyle(RenderNamedFlowFragment::createStyle(style()));
Modified: branches/safari-603-branch/Source/WebCore/rendering/RenderElement.cpp (214157 => 214158)
--- branches/safari-603-branch/Source/WebCore/rendering/RenderElement.cpp 2017-03-20 01:32:20 UTC (rev 214157)
+++ branches/safari-603-branch/Source/WebCore/rendering/RenderElement.cpp 2017-03-20 01:32:24 UTC (rev 214158)
@@ -997,13 +997,8 @@
if (s_affectsParentBlock)
handleDynamicFloatPositionChange();
- if (s_noLongerAffectsParentBlock) {
+ if (s_noLongerAffectsParentBlock)
removeAnonymousWrappersForInlinesIfNecessary();
- // Fresh floats need to be reparented if they actually belong to the previous anonymous block.
- // It copies the logic of RenderBlock::addChildIgnoringContinuation
- if (style().isFloating() && previousSibling() && previousSibling()->isAnonymousBlock())
- downcast<RenderBoxModelObject>(*parent()).moveChildTo(&downcast<RenderBoxModelObject>(*previousSibling()), this);
- }
SVGRenderSupport::styleChanged(*this, oldStyle);
Modified: branches/safari-603-branch/Source/WebCore/rendering/RenderElement.h (214157 => 214158)
--- branches/safari-603-branch/Source/WebCore/rendering/RenderElement.h 2017-03-20 01:32:20 UTC (rev 214157)
+++ branches/safari-603-branch/Source/WebCore/rendering/RenderElement.h 2017-03-20 01:32:24 UTC (rev 214158)
@@ -273,6 +273,8 @@
void removeFromRenderFlowThreadIncludingDescendants(bool shouldUpdateState);
void adjustFlowThreadStateOnContainingBlockChangeIfNeeded();
+
+ bool noLongerAffectsParentBlock() const { return s_noLongerAffectsParentBlock; }
private:
RenderElement(ContainerNode&, RenderStyle&&, BaseTypeFlags);
