Title: [227120] branches/safari-605-branch
- Revision
- 227120
- Author
- jmarc...@apple.com
- Date
- 2018-01-17 21:48:05 -0800 (Wed, 17 Jan 2018)
Log Message
Cherry-pick r227087. rdar://problem/36597993
Modified Paths
Added Paths
Diff
Modified: branches/safari-605-branch/LayoutTests/ChangeLog (227119 => 227120)
--- branches/safari-605-branch/LayoutTests/ChangeLog 2018-01-18 05:48:02 UTC (rev 227119)
+++ branches/safari-605-branch/LayoutTests/ChangeLog 2018-01-18 05:48:05 UTC (rev 227120)
@@ -1,5 +1,20 @@
2018-01-17 Jason Marcell <jmarc...@apple.com>
+ Cherry-pick r227087. rdar://problem/36597993
+
+ 2018-01-17 Zalan Bujtas <za...@apple.com>
+
+ Multicol: RenderMultiColumnFlow should not inherit the flow state
+ https://bugs.webkit.org/show_bug.cgi?id=181762
+ <rdar://problem/35448565>
+
+ Reviewed by Simon Fraser.
+
+ * fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow-expected.txt: Added.
+ * fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow.html: Added.
+
+2018-01-17 Jason Marcell <jmarc...@apple.com>
+
Cherry-pick r227076. rdar://problem/36598105
2018-01-17 John Wilander <wilan...@apple.com>
Added: branches/safari-605-branch/LayoutTests/fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow-expected.txt (0 => 227120)
--- branches/safari-605-branch/LayoutTests/fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow-expected.txt (rev 0)
+++ branches/safari-605-branch/LayoutTests/fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow-expected.txt 2018-01-18 05:48:05 UTC (rev 227120)
@@ -0,0 +1,2 @@
+PASS if no crash.
+
Added: branches/safari-605-branch/LayoutTests/fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow.html (0 => 227120)
--- branches/safari-605-branch/LayoutTests/fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow.html (rev 0)
+++ branches/safari-605-branch/LayoutTests/fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow.html 2018-01-18 05:48:05 UTC (rev 227120)
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.positioned {
+ position: absolute;
+}
+div, span {
+ column-count: 2;
+}
+</style>
+</head>
+<body>
+PASS if no crash.
+<div><div></div><span></span><div class=positioned><div class=positioned><div></div></div></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.body.offsetHeight;
+document.head.innerText = "";
+</script>
+</body>
+</html>
Modified: branches/safari-605-branch/Source/WebCore/ChangeLog (227119 => 227120)
--- branches/safari-605-branch/Source/WebCore/ChangeLog 2018-01-18 05:48:02 UTC (rev 227119)
+++ branches/safari-605-branch/Source/WebCore/ChangeLog 2018-01-18 05:48:05 UTC (rev 227120)
@@ -1,5 +1,25 @@
2018-01-17 Jason Marcell <jmarc...@apple.com>
+ Cherry-pick r227087. rdar://problem/36597993
+
+ 2018-01-17 Zalan Bujtas <za...@apple.com>
+
+ Multicol: RenderMultiColumnFlow should not inherit the flow state
+ https://bugs.webkit.org/show_bug.cgi?id=181762
+ <rdar://problem/35448565>
+
+ Reviewed by Simon Fraser.
+
+ Do not compute the inherited flow state flag for RenderMultiColumnFlow.
+ It is (by definition) always inside a fragmented flow.
+
+ Test: fast/multicol/crash-when-out-of-flow-positioned-becomes-in-flow.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::computedFragmentedFlowState):
+
+2018-01-17 Jason Marcell <jmarc...@apple.com>
+
Cherry-pick r227076. rdar://problem/36598105
2018-01-17 John Wilander <wilan...@apple.com>
Modified: branches/safari-605-branch/Source/WebCore/rendering/RenderObject.cpp (227119 => 227120)
--- branches/safari-605-branch/Source/WebCore/rendering/RenderObject.cpp 2018-01-18 05:48:02 UTC (rev 227119)
+++ branches/safari-605-branch/Source/WebCore/rendering/RenderObject.cpp 2018-01-18 05:48:05 UTC (rev 227120)
@@ -196,6 +196,11 @@
if (!renderer.parent())
return renderer.fragmentedFlowState();
+ if (is<RenderMultiColumnFlow>(renderer)) {
+ // Multicolumn flows do not inherit the flow state.
+ return InsideInFragmentedFlow;
+ }
+
auto inheritedFlowState = RenderObject::NotInsideFragmentedFlow;
if (is<RenderText>(renderer))
inheritedFlowState = renderer.parent()->fragmentedFlowState();
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
