Title: [214501] trunk
- Revision
- 214501
- Author
- [email protected]
- Date
- 2017-03-28 15:48:26 -0700 (Tue, 28 Mar 2017)
Log Message
Missing render tree position invalidation when tearing down renderers for display:contents subtree
https://bugs.webkit.org/show_bug.cgi?id=170199
<rdar://problem/31260856>
Reviewed by Zalan Bujtas.
Source/WebCore:
Test: fast/shadow-dom/slot-renderer-teardown.html
* style/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::updateElementRenderer):
Invalidate the render tree position in case we do a teardown for an element without renderer.
LayoutTests:
* fast/shadow-dom/slot-renderer-teardown-expected.txt: Added.
* fast/shadow-dom/slot-renderer-teardown.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (214500 => 214501)
--- trunk/LayoutTests/ChangeLog 2017-03-28 22:32:43 UTC (rev 214500)
+++ trunk/LayoutTests/ChangeLog 2017-03-28 22:48:26 UTC (rev 214501)
@@ -1,3 +1,14 @@
+2017-03-28 Antti Koivisto <[email protected]>
+
+ Missing render tree position invalidation when tearing down renderers for display:contents subtree
+ https://bugs.webkit.org/show_bug.cgi?id=170199
+ <rdar://problem/31260856>
+
+ Reviewed by Zalan Bujtas.
+
+ * fast/shadow-dom/slot-renderer-teardown-expected.txt: Added.
+ * fast/shadow-dom/slot-renderer-teardown.html: Added.
+
2017-03-28 Ryan Haddad <[email protected]>
Unreviewed, rolling out r214485.
Added: trunk/LayoutTests/fast/shadow-dom/slot-renderer-teardown-expected.txt (0 => 214501)
--- trunk/LayoutTests/fast/shadow-dom/slot-renderer-teardown-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/slot-renderer-teardown-expected.txt 2017-03-28 22:48:26 UTC (rev 214501)
@@ -0,0 +1,2 @@
+This test passes if it does not assert
+
Added: trunk/LayoutTests/fast/shadow-dom/slot-renderer-teardown.html (0 => 214501)
--- trunk/LayoutTests/fast/shadow-dom/slot-renderer-teardown.html (rev 0)
+++ trunk/LayoutTests/fast/shadow-dom/slot-renderer-teardown.html 2017-03-28 22:48:26 UTC (rev 214501)
@@ -0,0 +1,21 @@
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+<style>
+:last-child {
+ -webkit-animation-name: name5;
+ -webkit-animation-duration: 10s;
+}
+@-webkit-keyframes name5 {
+ from { }
+ to { }
+}
+</style>
+<body>
+<summary>This test passes if it does not assert<div></div><slot id=slot1><div></div></slot></summary>
+</body>
+
+<script>
+document.execCommand("SelectAll");
+</script>
Modified: trunk/Source/WebCore/ChangeLog (214500 => 214501)
--- trunk/Source/WebCore/ChangeLog 2017-03-28 22:32:43 UTC (rev 214500)
+++ trunk/Source/WebCore/ChangeLog 2017-03-28 22:48:26 UTC (rev 214501)
@@ -1,3 +1,18 @@
+2017-03-28 Antti Koivisto <[email protected]>
+
+ Missing render tree position invalidation when tearing down renderers for display:contents subtree
+ https://bugs.webkit.org/show_bug.cgi?id=170199
+ <rdar://problem/31260856>
+
+ Reviewed by Zalan Bujtas.
+
+ Test: fast/shadow-dom/slot-renderer-teardown.html
+
+ * style/RenderTreeUpdater.cpp:
+ (WebCore::RenderTreeUpdater::updateElementRenderer):
+
+ Invalidate the render tree position in case we do a teardown for an element without renderer.
+
2017-03-28 Ryan Haddad <[email protected]>
Unreviewed, rolling out r214485.
Modified: trunk/Source/WebCore/style/RenderTreeUpdater.cpp (214500 => 214501)
--- trunk/Source/WebCore/style/RenderTreeUpdater.cpp 2017-03-28 22:32:43 UTC (rev 214500)
+++ trunk/Source/WebCore/style/RenderTreeUpdater.cpp 2017-03-28 22:48:26 UTC (rev 214501)
@@ -259,8 +259,13 @@
bool shouldTearDownRenderers = update.change == Style::Detach
&& (element.renderer() || element.isNamedFlowContentElement() || element.hasDisplayContents());
- if (shouldTearDownRenderers)
+ if (shouldTearDownRenderers) {
+ if (!element.renderer()) {
+ // We may be tearing down a descendant renderer cached in renderTreePosition.
+ renderTreePosition().invalidateNextSibling();
+ }
tearDownRenderers(element, TeardownType::KeepHoverAndActive);
+ }
bool hasDisplayContents = update.style->display() == CONTENTS;
if (hasDisplayContents != element.hasDisplayContents()) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
