Title: [207974] releases/WebKitGTK/webkit-2.14
- Revision
- 207974
- Author
- [email protected]
- Date
- 2016-10-27 03:06:45 -0700 (Thu, 27 Oct 2016)
Log Message
Merge r207547 - Use anonymous table row for new child at RenderTableRow::addChild() if available.
https://bugs.webkit.org/show_bug.cgi?id=163651
<rdar://problem/28705022>
Reviewed by David Hyatt.
Source/WebCore:
We should try to prevent the continuation siblings from getting separated and inserted into
wrapper renderers. It makes finding these continuation siblings difficult.
This patch adds a checks for anonymous table rows so that we could find a closer common ancestor of
beforeChild/new child.
Test: fast/table/crash-when-table-has-continuation-and-content-inserted.html
* rendering/RenderObject.cpp:
(WebCore::RenderObject::showRenderObject): Add continuation information.
* rendering/RenderTableRow.cpp:
(WebCore::RenderTableRow::addChild):
LayoutTests:
* fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt: Added.
* fast/table/crash-when-table-has-continuation-and-content-inserted.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog (207973 => 207974)
--- releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog 2016-10-27 10:01:13 UTC (rev 207973)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog 2016-10-27 10:06:45 UTC (rev 207974)
@@ -1,3 +1,14 @@
+2016-10-19 Zalan Bujtas <[email protected]>
+
+ Use anonymous table row for new child at RenderTableRow::addChild() if available.
+ https://bugs.webkit.org/show_bug.cgi?id=163651
+ <rdar://problem/28705022>
+
+ Reviewed by David Hyatt.
+
+ * fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt: Added.
+ * fast/table/crash-when-table-has-continuation-and-content-inserted.html: Added.
+
2016-10-18 Said Abou-Hallawa <[email protected]>
SVGCSSParser: m_implicitShorthand value is not reset after adding the shorthand property
Added: releases/WebKitGTK/webkit-2.14/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt (0 => 207974)
--- releases/WebKitGTK/webkit-2.14/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted-expected.txt 2016-10-27 10:06:45 UTC (rev 207974)
@@ -0,0 +1,2 @@
+PASS
+
Added: releases/WebKitGTK/webkit-2.14/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html (0 => 207974)
--- releases/WebKitGTK/webkit-2.14/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html (rev 0)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/fast/table/crash-when-table-has-continuation-and-content-inserted.html 2016-10-27 10:06:45 UTC (rev 207974)
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we find the appropriate container for content injected into continuation context.</title>
+</head>
+<body>
+<table><tr><td><span id=firstSpan>PASS<div id=firstDiv></div></span></td></tr></table>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ var newTd = document.createElement("td");
+ newTd.style.display = "inline";
+ document.getElementById("firstSpan").insertBefore(newTd, document.getElementById("firstDiv"));
+</script>
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog (207973 => 207974)
--- releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog 2016-10-27 10:01:13 UTC (rev 207973)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog 2016-10-27 10:06:45 UTC (rev 207974)
@@ -1,3 +1,23 @@
+2016-10-19 Zalan Bujtas <[email protected]>
+
+ Use anonymous table row for new child at RenderTableRow::addChild() if available.
+ https://bugs.webkit.org/show_bug.cgi?id=163651
+ <rdar://problem/28705022>
+
+ Reviewed by David Hyatt.
+
+ We should try to prevent the continuation siblings from getting separated and inserted into
+ wrapper renderers. It makes finding these continuation siblings difficult.
+ This patch adds a checks for anonymous table rows so that we could find a closer common ancestor of
+ beforeChild/new child.
+
+ Test: fast/table/crash-when-table-has-continuation-and-content-inserted.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::showRenderObject): Add continuation information.
+ * rendering/RenderTableRow.cpp:
+ (WebCore::RenderTableRow::addChild):
+
2016-10-18 Brent Fulgham <[email protected]>
Correct Document::removeAllEventListeners
Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderObject.cpp (207973 => 207974)
--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderObject.cpp 2016-10-27 10:01:13 UTC (rev 207973)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderObject.cpp 2016-10-27 10:06:45 UTC (rev 207974)
@@ -1144,7 +1144,11 @@
fprintf(stderr, " \"%s\"", value.utf8().data());
}
}
-
+ if (is<RenderBoxModelObject>(*this)) {
+ auto& renderer = downcast<RenderBoxModelObject>(*this);
+ if (renderer.hasContinuation())
+ fprintf(stderr, " continuation->(%p)", renderer.continuation());
+ }
showRegionsInformation();
fprintf(stderr, "\n");
}
Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTableRow.cpp (207973 => 207974)
--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTableRow.cpp 2016-10-27 10:01:13 UTC (rev 207973)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTableRow.cpp 2016-10-27 10:06:45 UTC (rev 207974)
@@ -128,12 +128,22 @@
}
}
- // If beforeChild is inside an anonymous cell, insert into the cell.
- if (last && !is<RenderTableCell>(*last) && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
- last->parent()->addChild(child, beforeChild);
- return;
+ // Try to find an anonymous container for the child.
+ if (last && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
+ // If beforeChild is inside an anonymous cell, insert into the cell.
+ if (!is<RenderTableCell>(*last)) {
+ last->parent()->addChild(child, beforeChild);
+ return;
+ }
+ // If beforeChild is inside an anonymous row, insert into the row.
+ auto& parent = *last->parent();
+ if (is<RenderTableRow>(parent)) {
+ auto* cell = RenderTableCell::createAnonymousWithParentRenderer(*this).release();
+ parent.addChild(cell, beforeChild);
+ cell->addChild(child);
+ return;
+ }
}
-
auto* cell = RenderTableCell::createAnonymousWithParentRenderer(*this).release();
addChild(cell, beforeChild);
cell->addChild(child);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
