Title: [227306] branches/safari-605-branch
- Revision
- 227306
- Author
- jmarc...@apple.com
- Date
- 2018-01-22 09:57:18 -0800 (Mon, 22 Jan 2018)
Log Message
Cherry-pick r227145. rdar://problem/36722475
Modified Paths
Added Paths
Diff
Modified: branches/safari-605-branch/LayoutTests/ChangeLog (227305 => 227306)
--- branches/safari-605-branch/LayoutTests/ChangeLog 2018-01-22 17:57:15 UTC (rev 227305)
+++ branches/safari-605-branch/LayoutTests/ChangeLog 2018-01-22 17:57:18 UTC (rev 227306)
@@ -1,5 +1,20 @@
2018-01-22 Jason Marcell <jmarc...@apple.com>
+ Cherry-pick r227145. rdar://problem/36722475
+
+ 2018-01-18 Antti Koivisto <an...@apple.com>
+
+ REGRESSION (r223604): Setting :before/after pseudo element on <noscript> asserts
+ https://bugs.webkit.org/show_bug.cgi?id=181795
+ <rdar://problem/36334524>
+
+ Reviewed by David Kilzer.
+
+ * fast/css-generated-content/noscript-pseudo-anim-crash-expected.txt: Added.
+ * fast/css-generated-content/noscript-pseudo-anim-crash.html: Added.
+
+2018-01-22 Jason Marcell <jmarc...@apple.com>
+
Cherry-pick r227141. rdar://problem/36722585
2018-01-17 Per Arne Vollan <pvol...@apple.com>
Added: branches/safari-605-branch/LayoutTests/fast/css-generated-content/noscript-pseudo-anim-crash-expected.txt (0 => 227306)
--- branches/safari-605-branch/LayoutTests/fast/css-generated-content/noscript-pseudo-anim-crash-expected.txt (rev 0)
+++ branches/safari-605-branch/LayoutTests/fast/css-generated-content/noscript-pseudo-anim-crash-expected.txt 2018-01-22 17:57:18 UTC (rev 227306)
@@ -0,0 +1 @@
+This test passes if it doesn't assert or crash
Added: branches/safari-605-branch/LayoutTests/fast/css-generated-content/noscript-pseudo-anim-crash.html (0 => 227306)
--- branches/safari-605-branch/LayoutTests/fast/css-generated-content/noscript-pseudo-anim-crash.html (rev 0)
+++ branches/safari-605-branch/LayoutTests/fast/css-generated-content/noscript-pseudo-anim-crash.html 2018-01-22 17:57:18 UTC (rev 227306)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<style>
+:before {
+ -webkit-animation-name: name1;
+ -webkit-animation-duration: 8s;
+ -webkit-animation-timing-function: ease-in ! important;
+ @-webkit-keyframes name1 {
+ from {
+ margin-bottom: auto;
+ }
+ to {
+ margin-bottom: 256in;
+ }
+ }
+};
+</style>
+<body>
+<noscript></noscript>
+<script>
+if (window.testRunner) {
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
+ setTimeout(() => testRunner.notifyDone(), 50);
+}
+document.body.offsetLeft;
+document.body.innerHTML = "This test passes if it doesn't assert or crash";
+</script>
Modified: branches/safari-605-branch/Source/WebCore/ChangeLog (227305 => 227306)
--- branches/safari-605-branch/Source/WebCore/ChangeLog 2018-01-22 17:57:15 UTC (rev 227305)
+++ branches/safari-605-branch/Source/WebCore/ChangeLog 2018-01-22 17:57:18 UTC (rev 227306)
@@ -1,5 +1,30 @@
2018-01-22 Jason Marcell <jmarc...@apple.com>
+ Cherry-pick r227145. rdar://problem/36722475
+
+ 2018-01-18 Antti Koivisto <an...@apple.com>
+
+ REGRESSION (r223604): Setting :before/after pseudo element on <noscript> asserts
+ https://bugs.webkit.org/show_bug.cgi?id=181795
+ <rdar://problem/36334524>
+
+ Reviewed by David Kilzer.
+
+ <noscript> disallows renderer generation outside CSS mechanisms, however we would still construct
+ PseudoElements for them during style resolution. These were never removed properly because the
+ pseudo element removal was tied to render tree teardown. Without proper removal the associated
+ animations were also not canceled.
+
+ Test: fast/css-generated-content/noscript-pseudo-anim-crash.html
+
+ * dom/Element.cpp:
+ (WebCore::Element::removedFromAncestor):
+
+ Take care to get rid of PseudoElements when the element is removed from the tree.
+ This also cancels any associated animations.
+
+2018-01-22 Jason Marcell <jmarc...@apple.com>
+
Cherry-pick r227141. rdar://problem/36722585
2018-01-17 Per Arne Vollan <pvol...@apple.com>
Modified: branches/safari-605-branch/Source/WebCore/dom/Element.cpp (227305 => 227306)
--- branches/safari-605-branch/Source/WebCore/dom/Element.cpp 2018-01-22 17:57:15 UTC (rev 227305)
+++ branches/safari-605-branch/Source/WebCore/dom/Element.cpp 2018-01-22 17:57:18 UTC (rev 227306)
@@ -1746,6 +1746,9 @@
shadowRoot->hostChildElementDidChange(*this);
}
+ clearBeforePseudoElement();
+ clearAfterPseudoElement();
+
ContainerNode::removedFromAncestor(removalType, oldParentOfRemovedTree);
if (hasPendingResources())
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
