Title: [210369] trunk
- Revision
- 210369
- Author
- [email protected]
- Date
- 2017-01-05 12:24:59 -0800 (Thu, 05 Jan 2017)
Log Message
Mark the dedicated root linebox for trailing floats in empty inlines dirty.
https://bugs.webkit.org/show_bug.cgi?id=166732
<rdar://problem/29100419>
Reviewed by Antti Koivisto.
Source/WebCore:
We normally attach floating boxes to the last root linebox. However when the floatbox is preceded by a <br>
we generate a dedicated root linebox (TrailingFloatsRootInlineBox) for the floatbox.
When this floatbox is a RenderInline descendant and this RenderInline does not generate lineboxes (it's ancestor RenderBlockFlow does)
we have to make sure that this special root linebox gets marked dirty when the associated floatbox changes.
(Unfortunately through the recursive calls on dirtyLinesFromChangedChild(), we lose the information about
the "changed child" since the inlines propagates the marking logic to the RenderBlockFlow, see FIXME.)
Test: fast/inline/trailing-floats-inline-crash2.html
* rendering/RenderLineBoxList.cpp:
(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
LayoutTests:
* fast/inline/trailing-floats-inline-crash2-expected.txt: Added.
* fast/inline/trailing-floats-inline-crash2.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (210368 => 210369)
--- trunk/LayoutTests/ChangeLog 2017-01-05 20:15:27 UTC (rev 210368)
+++ trunk/LayoutTests/ChangeLog 2017-01-05 20:24:59 UTC (rev 210369)
@@ -1,3 +1,14 @@
+2017-01-05 Zalan Bujtas <[email protected]>
+
+ Mark the dedicated root linebox for trailing floats in empty inlines dirty.
+ https://bugs.webkit.org/show_bug.cgi?id=166732
+ <rdar://problem/29100419>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/inline/trailing-floats-inline-crash2-expected.txt: Added.
+ * fast/inline/trailing-floats-inline-crash2.html: Added.
+
2017-01-04 Brian Burg <[email protected]>
Web Inspector: Test.html should support globals reportInternalError, reportUnhandledRejection, reportUncaughtException
Added: trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt (0 => 210369)
--- trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt 2017-01-05 20:24:59 UTC (rev 210369)
@@ -0,0 +1,5 @@
+PASS if no crash or assert.
+
+
+foobar foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar
+
Added: trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2.html (0 => 210369)
--- trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2.html (rev 0)
+++ trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2.html 2017-01-05 20:24:59 UTC (rev 210369)
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+ :last-child {float:left;}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+PASS if no crash or assert.
+<div></div><br><div><pre></pre><br><span><strike>
+foobar foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar<br><input></strike><script>
+document.body.offsetHeight;</script></span></div>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (210368 => 210369)
--- trunk/Source/WebCore/ChangeLog 2017-01-05 20:15:27 UTC (rev 210368)
+++ trunk/Source/WebCore/ChangeLog 2017-01-05 20:24:59 UTC (rev 210369)
@@ -1,3 +1,23 @@
+2017-01-05 Zalan Bujtas <[email protected]>
+
+ Mark the dedicated root linebox for trailing floats in empty inlines dirty.
+ https://bugs.webkit.org/show_bug.cgi?id=166732
+ <rdar://problem/29100419>
+
+ Reviewed by Antti Koivisto.
+
+ We normally attach floating boxes to the last root linebox. However when the floatbox is preceded by a <br>
+ we generate a dedicated root linebox (TrailingFloatsRootInlineBox) for the floatbox.
+ When this floatbox is a RenderInline descendant and this RenderInline does not generate lineboxes (it's ancestor RenderBlockFlow does)
+ we have to make sure that this special root linebox gets marked dirty when the associated floatbox changes.
+ (Unfortunately through the recursive calls on dirtyLinesFromChangedChild(), we lose the information about
+ the "changed child" since the inlines propagates the marking logic to the RenderBlockFlow, see FIXME.)
+
+ Test: fast/inline/trailing-floats-inline-crash2.html
+
+ * rendering/RenderLineBoxList.cpp:
+ (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+
2017-01-05 Antoine Quint <[email protected]>
[Cocoa] Both modern-media-controls/images/iOS modern-media-controls/images/macOS are installed on both platforms
Modified: trunk/Source/WebCore/rendering/RenderLineBoxList.cpp (210368 => 210369)
--- trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2017-01-05 20:15:27 UTC (rev 210368)
+++ trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2017-01-05 20:24:59 UTC (rev 210369)
@@ -323,8 +323,8 @@
return;
}
- // Try to figure out which line box we belong in. First try to find a previous
- // line box by examining our siblings. If we didn't find a line box, then use our
+ // Try to figure out which line box we belong in. First try to find a previous
+ // line box by examining our siblings. If we didn't find a line box, then use our
// parent's first line box.
RootInlineBox* box = nullptr;
RenderObject* current;
@@ -370,11 +370,11 @@
if (box) {
box->markDirty();
- // dirty the adjacent lines that might be affected
+ // Dirty the adjacent lines that might be affected.
// NOTE: we dirty the previous line because RootInlineBox objects cache
// the address of the first object on the next line after a BR, which we may be
- // invalidating here. For more info, see how RenderBlock::layoutInlineChildren
- // calls setLineBreakInfo with the result of findNextLineBreak. findNextLineBreak,
+ // invalidating here. For more info, see how RenderBlock::layoutInlineChildren
+ // calls setLineBreakInfo with the result of findNextLineBreak. findNextLineBreak,
// despite the name, actually returns the first RenderObject after the BR.
// <rdar://problem/3849947> "Typing after pasting line does not appear until after window resize."
if (RootInlineBox* prevBox = box->prevRootBox())
@@ -384,11 +384,13 @@
// necessary some of the time, in situations involving BRs.
if (RootInlineBox* nextBox = box->nextRootBox()) {
nextBox->markDirty();
-
- // Special root box for floats may be added at the end of the list. If this occurs with BRs we need to invalidate it explicitly.
- if (auto* nextNextBox = nextBox->nextRootBox()) {
- if (nextNextBox->isTrailingFloatsRootInlineBox())
- nextNextBox->markDirty();
+ // Dedicated linebox for floats may be added as the last rootbox. If this occurs with BRs inside inlines that propagte their lineboxes to
+ // the parent flow, we need to invalidate it explicitly.
+ // FIXME: We should be able to figure out the actual "changed child" even when we are calling through empty inlines recursively.
+ if (is<RenderInline>(child) && !downcast<RenderInline>(child).firstLineBoxIncludingCulling()) {
+ auto* lastRootBox = nextBox->blockFlow().lastRootBox();
+ if (lastRootBox->isTrailingFloatsRootInlineBox() && !lastRootBox->isDirty())
+ lastRootBox->markDirty();
}
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
