Diff
Modified: branches/safari-602-branch/LayoutTests/ChangeLog (207925 => 207926)
--- branches/safari-602-branch/LayoutTests/ChangeLog 2016-10-26 23:18:22 UTC (rev 207925)
+++ branches/safari-602-branch/LayoutTests/ChangeLog 2016-10-26 23:19:32 UTC (rev 207926)
@@ -1,5 +1,20 @@
2016-10-26 Matthew Hanson <[email protected]>
+ Merge r207547. rdar://problem/28810755
+
+ 2016-10-19 Zalan Bujtas <[email protected]>
+
+ Use anonymous table row for new child at RenderTableRow::addChild() if available.
+ https://bugs.webkit.org/show_bug.cgi?id=163651
+ <rdar://problem/28705022>
+
+ Reviewed by David Hyatt.
+
+ * fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt: Added.
+ * fast/table/crash-when-table-has-continuation-and-content-inserted.html: Added.
+
+2016-10-26 Matthew Hanson <[email protected]>
+
Merge r207804. rdar://problem/28849628
2016-10-24 Zalan Bujtas <[email protected]>
Added: branches/safari-602-branch/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt (0 => 207926)
--- branches/safari-602-branch/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt 2016-10-26 23:19:32 UTC (rev 207926)
@@ -0,0 +1,2 @@
+PASS
+
Added: branches/safari-602-branch/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html (0 => 207926)
--- branches/safari-602-branch/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html (rev 0)
+++ branches/safari-602-branch/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html 2016-10-26 23:19:32 UTC (rev 207926)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we find the appropriate container for content injected into continuation context.</title>
+</head>
+<body>
+<table><tr><td><span id=firstSpan>PASS<div id=firstDiv></div></span></td></tr></table>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ var newTd = document.createElement("td");
+ newTd.style.display = "inline";
+ document.getElementById("firstSpan").insertBefore(newTd, document.getElementById("firstDiv"));
+</script>
+</body>
+</html>
Modified: branches/safari-602-branch/Source/WebCore/ChangeLog (207925 => 207926)
--- branches/safari-602-branch/Source/WebCore/ChangeLog 2016-10-26 23:18:22 UTC (rev 207925)
+++ branches/safari-602-branch/Source/WebCore/ChangeLog 2016-10-26 23:19:32 UTC (rev 207926)
@@ -1,5 +1,29 @@
2016-10-26 Matthew Hanson <[email protected]>
+ Merge r207547. rdar://problem/28810755
+
+ 2016-10-19 Zalan Bujtas <[email protected]>
+
+ Use anonymous table row for new child at RenderTableRow::addChild() if available.
+ https://bugs.webkit.org/show_bug.cgi?id=163651
+ <rdar://problem/28705022>
+
+ Reviewed by David Hyatt.
+
+ We should try to prevent the continuation siblings from getting separated and inserted into
+ wrapper renderers. It makes finding these continuation siblings difficult.
+ This patch adds a checks for anonymous table rows so that we could find a closer common ancestor of
+ beforeChild/new child.
+
+ Test: fast/table/crash-when-table-has-continuation-and-content-inserted.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::showRenderObject): Add continuation information.
+ * rendering/RenderTableRow.cpp:
+ (WebCore::RenderTableRow::addChild):
+
+2016-10-26 Matthew Hanson <[email protected]>
+
Merge r207804. rdar://problem/28849628
2016-10-24 Zalan Bujtas <[email protected]>
Modified: branches/safari-602-branch/Source/WebCore/rendering/RenderObject.cpp (207925 => 207926)
--- branches/safari-602-branch/Source/WebCore/rendering/RenderObject.cpp 2016-10-26 23:18:22 UTC (rev 207925)
+++ branches/safari-602-branch/Source/WebCore/rendering/RenderObject.cpp 2016-10-26 23:19:32 UTC (rev 207926)
@@ -1172,7 +1172,11 @@
fprintf(stderr, " \"%s\"", value.utf8().data());
}
}
-
+ if (is<RenderBoxModelObject>(*this)) {
+ auto& renderer = downcast<RenderBoxModelObject>(*this);
+ if (renderer.hasContinuation())
+ fprintf(stderr, " continuation->(%p)", renderer.continuation());
+ }
showRegionsInformation();
fprintf(stderr, "\n");
}
Modified: branches/safari-602-branch/Source/WebCore/rendering/RenderTableRow.cpp (207925 => 207926)
--- branches/safari-602-branch/Source/WebCore/rendering/RenderTableRow.cpp 2016-10-26 23:18:22 UTC (rev 207925)
+++ branches/safari-602-branch/Source/WebCore/rendering/RenderTableRow.cpp 2016-10-26 23:19:32 UTC (rev 207926)
@@ -128,13 +128,23 @@
}
}
- // If beforeChild is inside an anonymous cell, insert into the cell.
- if (last && !is<RenderTableCell>(*last) && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
- last->parent()->addChild(child, beforeChild);
- return;
+ // Try to find an anonymous container for the child.
+ if (last && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
+ // If beforeChild is inside an anonymous cell, insert into the cell.
+ if (!is<RenderTableCell>(*last)) {
+ last->parent()->addChild(child, beforeChild);
+ return;
+ }
+ // If beforeChild is inside an anonymous row, insert into the row.
+ auto& parent = *last->parent();
+ if (is<RenderTableRow>(parent)) {
+ auto* cell = RenderTableCell::createAnonymousWithParentRenderer(this);
+ parent.addChild(cell, beforeChild);
+ cell->addChild(child);
+ return;
+ }
}
-
- RenderTableCell* cell = RenderTableCell::createAnonymousWithParentRenderer(this);
+ auto* cell = RenderTableCell::createAnonymousWithParentRenderer(this);
addChild(cell, beforeChild);
cell->addChild(child);
return;
