Title: [207921] branches/safari-602-branch
- Revision
- 207921
- Author
- matthew_han...@apple.com
- Date
- 2016-10-26 16:18:05 -0700 (Wed, 26 Oct 2016)
Log Message
Merge r207631. rdar://problem/28810750
Modified Paths
Added Paths
Diff
Modified: branches/safari-602-branch/LayoutTests/ChangeLog (207920 => 207921)
--- branches/safari-602-branch/LayoutTests/ChangeLog 2016-10-26 23:18:02 UTC (rev 207920)
+++ branches/safari-602-branch/LayoutTests/ChangeLog 2016-10-26 23:18:05 UTC (rev 207921)
@@ -1,5 +1,20 @@
2016-10-26 Matthew Hanson <matthew_han...@apple.com>
+ Merge r207631. rdar://problem/28810750
+
+ 2016-10-20 Zalan Bujtas <za...@apple.com>
+
+ Stop searching for first-letter containers at multi-column boundary.
+ https://bugs.webkit.org/show_bug.cgi?id=163739
+ <rdar://problem/28810750>
+
+ Reviewed by David Hyatt.
+
+ * fast/css-generated-content/first-letter-move-to-multicolumn-crash-expected.txt: Added.
+ * fast/css-generated-content/first-letter-move-to-multicolumn-crash.html: Added.
+
+2016-10-26 Matthew Hanson <matthew_han...@apple.com>
+
Merge r206190. rdar://problem/28744102
2016-09-20 Nan Wang <n_w...@apple.com>
Added: branches/safari-602-branch/LayoutTests/fast/css-generated-content/first-letter-move-to-multicolumn-crash-expected.txt (0 => 207921)
--- branches/safari-602-branch/LayoutTests/fast/css-generated-content/first-letter-move-to-multicolumn-crash-expected.txt (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/css-generated-content/first-letter-move-to-multicolumn-crash-expected.txt 2016-10-26 23:18:05 UTC (rev 207921)
@@ -0,0 +1,2 @@
+PASS if no crash or ASSERT.
+f
Added: branches/safari-602-branch/LayoutTests/fast/css-generated-content/first-letter-move-to-multicolumn-crash.html (0 => 207921)
--- branches/safari-602-branch/LayoutTests/fast/css-generated-content/first-letter-move-to-multicolumn-crash.html (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/css-generated-content/first-letter-move-to-multicolumn-crash.html 2016-10-26 23:18:05 UTC (rev 207921)
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we can move first-letter elements to column content and back.</title>
+<style>
+.original::first-letter{
+ -webkit-columns: 2;
+}
+.newClass::first-letter{
+ float: left;
+}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function runTest() {
+ li.style.webkitColumns = "2";
+ li.offsetParent;
+
+ li.className = "newClass";
+ li.style.cssText = "letter-spacing: 10px;"
+ li.offsetParent;
+
+ li.style.webkitColumns = "2";
+ li.offsetParent;
+}
+</script>
+</head>
+<body _onload_="runTest()">
+PASS if no crash or ASSERT.
+<li class=original id="li">f<script></script>
+</li>
+</body>
+</html>
Modified: branches/safari-602-branch/Source/WebCore/ChangeLog (207920 => 207921)
--- branches/safari-602-branch/Source/WebCore/ChangeLog 2016-10-26 23:18:02 UTC (rev 207920)
+++ branches/safari-602-branch/Source/WebCore/ChangeLog 2016-10-26 23:18:05 UTC (rev 207921)
@@ -1,5 +1,28 @@
2016-10-26 Matthew Hanson <matthew_han...@apple.com>
+ Merge r207631. rdar://problem/28810750
+
+ 2016-10-20 Zalan Bujtas <za...@apple.com>
+
+ Stop searching for first-letter containers at multi-column boundary.
+ https://bugs.webkit.org/show_bug.cgi?id=163739
+ <rdar://problem/28810750>
+
+ We should not cross the multi-column boundary while searching for the first-letter container.
+ While moving first-letter renderers to a multi-column parent, it could result in finding the wrong
+ container and end up adding a new wrapper under the original container (from where we are moving the renderers).
+
+ Reviewed by David Hyatt.
+
+ Test: fast/css-generated-content/first-letter-move-to-multicolumn-crash.html
+
+ * rendering/RenderBoxModelObject.cpp:
+ (WebCore::RenderBoxModelObject::moveChildrenTo):
+ * rendering/RenderTextFragment.cpp:
+ (WebCore::RenderTextFragment::blockForAccompanyingFirstLetter):
+
+2016-10-26 Matthew Hanson <matthew_han...@apple.com>
+
Merge r207477. rdar://problem/28810756
2016-10-18 Brent Fulgham <bfulg...@apple.com>
Modified: branches/safari-602-branch/Source/WebCore/rendering/RenderBoxModelObject.cpp (207920 => 207921)
--- branches/safari-602-branch/Source/WebCore/rendering/RenderBoxModelObject.cpp 2016-10-26 23:18:02 UTC (rev 207920)
+++ branches/safari-602-branch/Source/WebCore/rendering/RenderBoxModelObject.cpp 2016-10-26 23:18:05 UTC (rev 207921)
@@ -2529,9 +2529,11 @@
// Save our next sibling as moveChildTo will clear it.
RenderObject* nextSibling = child->nextSibling();
+ // FIXME: This logic here fails to detect the first letter in certain cases
+ // and skips a valid sibling renderer (see webkit.org/b/163737).
// Check to make sure we're not saving the firstLetter as the nextSibling.
// When the |child| object will be moved, its firstLetter will be recreated,
- // so saving it now in nextSibling would let us with a destroyed object.
+ // so saving it now in nextSibling would leave us with a stale object.
if (is<RenderTextFragment>(*child) && is<RenderText>(nextSibling)) {
RenderObject* firstLetterObj = nullptr;
if (RenderBlock* block = downcast<RenderTextFragment>(*child).blockForAccompanyingFirstLetter()) {
Modified: branches/safari-602-branch/Source/WebCore/rendering/RenderTextFragment.cpp (207920 => 207921)
--- branches/safari-602-branch/Source/WebCore/rendering/RenderTextFragment.cpp 2016-10-26 23:18:02 UTC (rev 207920)
+++ branches/safari-602-branch/Source/WebCore/rendering/RenderTextFragment.cpp 2016-10-26 23:18:05 UTC (rev 207921)
@@ -25,6 +25,7 @@
#include "RenderBlock.h"
#include "RenderIterator.h"
+#include "RenderMultiColumnFlowThread.h"
#include "Text.h"
namespace WebCore {
@@ -112,6 +113,8 @@
if (!m_firstLetter)
return nullptr;
for (auto& block : ancestorsOfType<RenderBlock>(*m_firstLetter)) {
+ if (is<RenderMultiColumnFlowThread>(block))
+ break;
if (block.style().hasPseudoStyle(FIRST_LETTER) && block.canHaveChildren())
return █
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
