Diff
Modified: trunk/Source/WebCore/ChangeLog (210144 => 210145)
--- trunk/Source/WebCore/ChangeLog 2016-12-24 04:39:52 UTC (rev 210144)
+++ trunk/Source/WebCore/ChangeLog 2016-12-24 18:00:00 UTC (rev 210145)
@@ -1,3 +1,31 @@
+2016-12-24 Zalan Bujtas <[email protected]>
+
+ RenderBlockFlow::moveFloatsTo does not move floats.
+ https://bugs.webkit.org/show_bug.cgi?id=166467
+
+ Reviewed by Darin Adler.
+
+ RenderBlockFlow::moveFloatsTo name is misleading. Floats are not moved from "this" to
+ the new RenderBlockFlow parent, but rather they are copied so that overhanging floats
+ don't get lost.
+
+ Covered by existing tests.
+
+ * rendering/FloatingObjects.cpp:
+ (WebCore::FloatingObject::cloneForNewParent):
+ (WebCore::FloatingObject::unsafeClone): Deleted.
+ * rendering/FloatingObjects.h:
+ * rendering/RenderBlockFlow.cpp:
+ (WebCore::RenderBlockFlow::addFloatsToNewParent):
+ (WebCore::RenderBlockFlow::moveAllChildrenIncludingFloatsTo):
+ (WebCore::RenderBlockFlow::moveFloatsTo): Deleted.
+ * rendering/RenderBlockFlow.h:
+ * rendering/RenderRubyBase.cpp:
+ (WebCore::RenderRubyBase::mergeChildrenWithBase):
+ * rendering/RenderRubyBase.h:
+ * rendering/RenderRubyRun.cpp:
+ (WebCore::RenderRubyRun::removeChild):
+
2016-12-23 Andreas Kling <[email protected]>
REGRESSION(r209865): Crash when navigating back to some pages with compositing layers.
Modified: trunk/Source/WebCore/rendering/FloatingObjects.cpp (210144 => 210145)
--- trunk/Source/WebCore/rendering/FloatingObjects.cpp 2016-12-24 04:39:52 UTC (rev 210144)
+++ trunk/Source/WebCore/rendering/FloatingObjects.cpp 2016-12-24 18:00:00 UTC (rev 210145)
@@ -88,10 +88,9 @@
return std::make_unique<FloatingObject>(renderer(), type(), LayoutRect(frameRect().location() - offset, frameRect().size()), shouldPaint, isDescendant);
}
-std::unique_ptr<FloatingObject> FloatingObject::unsafeClone() const
+std::unique_ptr<FloatingObject> FloatingObject::cloneForNewParent() const
{
- // FIXME: Use make_unique here, once we can get it to compile on all platforms we support.
- std::unique_ptr<FloatingObject> cloneObject(new FloatingObject(renderer(), type(), m_frameRect, m_shouldPaint, m_isDescendant));
+ auto cloneObject = std::make_unique<FloatingObject>(renderer(), type(), m_frameRect, m_shouldPaint, m_isDescendant);
cloneObject->m_paginationStrut = m_paginationStrut;
cloneObject->m_isPlaced = m_isPlaced;
return cloneObject;
Modified: trunk/Source/WebCore/rendering/FloatingObjects.h (210144 => 210145)
--- trunk/Source/WebCore/rendering/FloatingObjects.h 2016-12-24 04:39:52 UTC (rev 210144)
+++ trunk/Source/WebCore/rendering/FloatingObjects.h 2016-12-24 18:00:00 UTC (rev 210145)
@@ -40,7 +40,7 @@
static std::unique_ptr<FloatingObject> create(RenderBox&);
std::unique_ptr<FloatingObject> copyToNewContainer(LayoutSize, bool shouldPaint = false, bool isDescendant = false) const;
- std::unique_ptr<FloatingObject> unsafeClone() const;
+ std::unique_ptr<FloatingObject> cloneForNewParent() const;
explicit FloatingObject(RenderBox&);
FloatingObject(RenderBox&, Type, const LayoutRect&, bool shouldPaint, bool isDescendant);
Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.cpp (210144 => 210145)
--- trunk/Source/WebCore/rendering/RenderBlockFlow.cpp 2016-12-24 04:39:52 UTC (rev 210144)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.cpp 2016-12-24 18:00:00 UTC (rev 210145)
@@ -2118,7 +2118,7 @@
RenderBlock::deleteLines();
}
-void RenderBlockFlow::moveFloatsTo(RenderBlockFlow* toBlockFlow)
+void RenderBlockFlow::addFloatsToNewParent(RenderBlockFlow& toBlockFlow) const
{
// When a portion of the render tree is being detached, anonymous blocks
// will be combined as their children are deleted. In this process, the
@@ -2137,30 +2137,21 @@
// all be wrong, but since toBlockFlow is already marked for layout, this
// will get fixed before anything gets displayed.
// See bug https://bugs.webkit.org/show_bug.cgi?id=115566
- if (m_floatingObjects) {
- if (!toBlockFlow->m_floatingObjects)
- toBlockFlow->createFloatingObjects();
+ if (!m_floatingObjects)
+ return;
- const FloatingObjectSet& fromFloatingObjectSet = m_floatingObjects->set();
- auto end = fromFloatingObjectSet.end();
+ if (!toBlockFlow.m_floatingObjects)
+ toBlockFlow.createFloatingObjects();
- for (auto it = fromFloatingObjectSet.begin(); it != end; ++it) {
- FloatingObject* floatingObject = it->get();
-
- // Don't insert the object again if it's already in the list
- if (toBlockFlow->containsFloat(floatingObject->renderer()))
- continue;
-
- toBlockFlow->m_floatingObjects->add(floatingObject->unsafeClone());
- }
- }
+ for (auto& floatingObject : m_floatingObjects->set())
+ toBlockFlow.m_floatingObjects->add(floatingObject->cloneForNewParent());
}
void RenderBlockFlow::moveAllChildrenIncludingFloatsTo(RenderBlock& toBlock, bool fullRemoveInsert)
{
- RenderBlockFlow& toBlockFlow = downcast<RenderBlockFlow>(toBlock);
+ auto& toBlockFlow = downcast<RenderBlockFlow>(toBlock);
moveAllChildrenTo(&toBlockFlow, fullRemoveInsert);
- moveFloatsTo(&toBlockFlow);
+ addFloatsToNewParent(toBlockFlow);
}
void RenderBlockFlow::addOverflowFromFloats()
Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.h (210144 => 210145)
--- trunk/Source/WebCore/rendering/RenderBlockFlow.h 2016-12-24 04:39:52 UTC (rev 210144)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.h 2016-12-24 18:00:00 UTC (rev 210145)
@@ -461,7 +461,7 @@
bool isTopLayoutOverflowAllowed() const override;
bool isLeftLayoutOverflowAllowed() const override;
- void moveFloatsTo(RenderBlockFlow* toBlock);
+ void addFloatsToNewParent(RenderBlockFlow& toBlockFlow) const;
virtual void computeColumnCountAndWidth();
virtual bool requiresColumns(int) const;
Modified: trunk/Source/WebCore/rendering/RenderRubyBase.cpp (210144 => 210145)
--- trunk/Source/WebCore/rendering/RenderRubyBase.cpp 2016-12-24 04:39:52 UTC (rev 210144)
+++ trunk/Source/WebCore/rendering/RenderRubyBase.cpp 2016-12-24 18:00:00 UTC (rev 210145)
@@ -71,10 +71,10 @@
toBase->setNeedsLayoutAndPrefWidthsRecalc();
}
-void RenderRubyBase::mergeChildrenWithBase(RenderRubyBase* toBlock)
+void RenderRubyBase::mergeChildrenWithBase(RenderRubyBase& toBlock)
{
- moveChildren(toBlock);
- moveFloatsTo(toBlock);
+ moveChildren(&toBlock);
+ addFloatsToNewParent(toBlock);
}
void RenderRubyBase::moveInlineChildren(RenderRubyBase* toBase, RenderObject* beforeChild)
Modified: trunk/Source/WebCore/rendering/RenderRubyBase.h (210144 => 210145)
--- trunk/Source/WebCore/rendering/RenderRubyBase.h 2016-12-24 04:39:52 UTC (rev 210144)
+++ trunk/Source/WebCore/rendering/RenderRubyBase.h 2016-12-24 18:00:00 UTC (rev 210145)
@@ -63,7 +63,7 @@
bool isChildAllowed(const RenderObject&, const RenderStyle&) const override;
ETextAlign textAlignmentForLine(bool endsWithSoftBreak) const override;
void adjustInlineDirectionLineBounds(int expansionOpportunityCount, float& logicalLeft, float& logicalWidth) const override;
- void mergeChildrenWithBase(RenderRubyBase* toBlock);
+ void mergeChildrenWithBase(RenderRubyBase& toBlock);
void moveChildren(RenderRubyBase* toBase, RenderObject* beforeChild = 0);
void moveInlineChildren(RenderRubyBase* toBase, RenderObject* beforeChild = 0);
Modified: trunk/Source/WebCore/rendering/RenderRubyRun.cpp (210144 => 210145)
--- trunk/Source/WebCore/rendering/RenderRubyRun.cpp 2016-12-24 04:39:52 UTC (rev 210144)
+++ trunk/Source/WebCore/rendering/RenderRubyRun.cpp 2016-12-24 18:00:00 UTC (rev 210145)
@@ -167,7 +167,7 @@
if (rightRun.hasRubyBase()) {
RenderRubyBase* rightBase = rightRun.rubyBaseSafe();
// Collect all children in a single base, then swap the bases.
- rightBase->mergeChildrenWithBase(base);
+ rightBase->mergeChildrenWithBase(*base);
moveChildTo(&rightRun, base);
rightRun.moveChildTo(this, rightBase);
// The now empty ruby base will be removed below.
