Title: [207547] trunk
- Revision
- 207547
- Author
- za...@apple.com
- Date
- 2016-10-19 11:15:08 -0700 (Wed, 19 Oct 2016)
Log Message
Use anonymous table row for new child at RenderTableRow::addChild() if available.
https://bugs.webkit.org/show_bug.cgi?id=163651
<rdar://problem/28705022>
Reviewed by David Hyatt.
Source/WebCore:
We should try to prevent the continuation siblings from getting separated and inserted into
wrapper renderers. It makes finding these continuation siblings difficult.
This patch adds a checks for anonymous table rows so that we could find a closer common ancestor of
beforeChild/new child.
Test: fast/table/crash-when-table-has-continuation-and-content-inserted.html
* rendering/RenderObject.cpp:
(WebCore::RenderObject::showRenderObject): Add continuation information.
* rendering/RenderTableRow.cpp:
(WebCore::RenderTableRow::addChild):
LayoutTests:
* fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt: Added.
* fast/table/crash-when-table-has-continuation-and-content-inserted.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (207546 => 207547)
--- trunk/LayoutTests/ChangeLog 2016-10-19 18:09:50 UTC (rev 207546)
+++ trunk/LayoutTests/ChangeLog 2016-10-19 18:15:08 UTC (rev 207547)
@@ -1,3 +1,14 @@
+2016-10-19 Zalan Bujtas <za...@apple.com>
+
+ Use anonymous table row for new child at RenderTableRow::addChild() if available.
+ https://bugs.webkit.org/show_bug.cgi?id=163651
+ <rdar://problem/28705022>
+
+ Reviewed by David Hyatt.
+
+ * fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt: Added.
+ * fast/table/crash-when-table-has-continuation-and-content-inserted.html: Added.
+
2016-10-19 Chris Dumez <cdu...@apple.com>
MouseEvent's coordinates should be 0 for simulated clicks
Added: trunk/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt (0 => 207547)
--- trunk/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt 2016-10-19 18:15:08 UTC (rev 207547)
@@ -0,0 +1,2 @@
+PASS
+
Added: trunk/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html (0 => 207547)
--- trunk/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html (rev 0)
+++ trunk/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html 2016-10-19 18:15:08 UTC (rev 207547)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we find the appropriate container for content injected into continuation context.</title>
+</head>
+<body>
+<table><tr><td><span id=firstSpan>PASS<div id=firstDiv></div></span></td></tr></table>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ var newTd = document.createElement("td");
+ newTd.style.display = "inline";
+ document.getElementById("firstSpan").insertBefore(newTd, document.getElementById("firstDiv"));
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (207546 => 207547)
--- trunk/Source/WebCore/ChangeLog 2016-10-19 18:09:50 UTC (rev 207546)
+++ trunk/Source/WebCore/ChangeLog 2016-10-19 18:15:08 UTC (rev 207547)
@@ -1,3 +1,23 @@
+2016-10-19 Zalan Bujtas <za...@apple.com>
+
+ Use anonymous table row for new child at RenderTableRow::addChild() if available.
+ https://bugs.webkit.org/show_bug.cgi?id=163651
+ <rdar://problem/28705022>
+
+ Reviewed by David Hyatt.
+
+ We should try to prevent the continuation siblings from getting separated and inserted into
+ wrapper renderers. It makes finding these continuation siblings difficult.
+ This patch adds a checks for anonymous table rows so that we could find a closer common ancestor of
+ beforeChild/new child.
+
+ Test: fast/table/crash-when-table-has-continuation-and-content-inserted.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::showRenderObject): Add continuation information.
+ * rendering/RenderTableRow.cpp:
+ (WebCore::RenderTableRow::addChild):
+
2016-10-19 Joseph Pecoraro <pecor...@apple.com>
Cleanup WebCore/workers
Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (207546 => 207547)
--- trunk/Source/WebCore/rendering/RenderObject.cpp 2016-10-19 18:09:50 UTC (rev 207546)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp 2016-10-19 18:15:08 UTC (rev 207547)
@@ -1127,7 +1127,11 @@
fprintf(stderr, " \"%s\"", value.utf8().data());
}
}
-
+ if (is<RenderBoxModelObject>(*this)) {
+ auto& renderer = downcast<RenderBoxModelObject>(*this);
+ if (renderer.hasContinuation())
+ fprintf(stderr, " continuation->(%p)", renderer.continuation());
+ }
showRegionsInformation();
fprintf(stderr, "\n");
}
Modified: trunk/Source/WebCore/rendering/RenderTableRow.cpp (207546 => 207547)
--- trunk/Source/WebCore/rendering/RenderTableRow.cpp 2016-10-19 18:09:50 UTC (rev 207546)
+++ trunk/Source/WebCore/rendering/RenderTableRow.cpp 2016-10-19 18:15:08 UTC (rev 207547)
@@ -128,12 +128,22 @@
}
}
- // If beforeChild is inside an anonymous cell, insert into the cell.
- if (last && !is<RenderTableCell>(*last) && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
- last->parent()->addChild(child, beforeChild);
- return;
+ // Try to find an anonymous container for the child.
+ if (last && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
+ // If beforeChild is inside an anonymous cell, insert into the cell.
+ if (!is<RenderTableCell>(*last)) {
+ last->parent()->addChild(child, beforeChild);
+ return;
+ }
+ // If beforeChild is inside an anonymous row, insert into the row.
+ auto& parent = *last->parent();
+ if (is<RenderTableRow>(parent)) {
+ auto* cell = RenderTableCell::createAnonymousWithParentRenderer(*this).release();
+ parent.addChild(cell, beforeChild);
+ cell->addChild(child);
+ return;
+ }
}
-
auto* cell = RenderTableCell::createAnonymousWithParentRenderer(*this).release();
addChild(cell, beforeChild);
cell->addChild(child);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
