[webkit-changes] [227688] branches/safari-605-branch

Fri, 26 Jan 2018 12:17:45 -0800

Title: [227688] branches/safari-605-branch

Diff

Modified: branches/safari-605-branch/LayoutTests/ChangeLog (227687 => 227688)


--- branches/safari-605-branch/LayoutTests/ChangeLog	2018-01-26 20:15:02 UTC (rev 227687)
+++ branches/safari-605-branch/LayoutTests/ChangeLog	2018-01-26 20:16:51 UTC (rev 227688)
@@ -1,3 +1,20 @@
+2018-01-26  Jason Marcell  <[email protected]>
+
+        Cherry-pick r227570. rdar://problem/36873398
+
+    2018-01-24  Antti Koivisto  <[email protected]>
+
+            Assertion failure in RenderMultiColumnSet::requiresBalancing() on fast/multicol/spanner-crash-when-adding-summary.html
+            https://bugs.webkit.org/show_bug.cgi?id=179308
+            <rdar://problem/34592771>
+
+            Reviewed by Zalan Bujtas.
+
+            Unskip fast/multicol/spanner-crash-when-adding-summary.html
+
+            * platform/ios/TestExpectations:
+            * platform/mac/TestExpectations:
+
 2018-01-26  Ryan Haddad  <[email protected]>
 
         Cherry-pick r227426. rdar://problem/36837397

Modified: branches/safari-605-branch/LayoutTests/platform/ios/TestExpectations (227687 => 227688)


--- branches/safari-605-branch/LayoutTests/platform/ios/TestExpectations	2018-01-26 20:15:02 UTC (rev 227687)
+++ branches/safari-605-branch/LayoutTests/platform/ios/TestExpectations	2018-01-26 20:16:51 UTC (rev 227688)
@@ -3025,8 +3025,6 @@
 
 webkit.org/b/172052 [ Release ] imported/w3c/web-platform-tests/html/webappapis/timers/type-long-setinterval.html [ Pass Failure ]
 
-webkit.org/b/176878 [ Debug ] fast/multicol/spanner-crash-when-adding-summary.html [ Crash ]
-
 # <rdar://problem/32542437> REGRESSION (iOS 11): LayoutTest fast/events/ios/before-input-events-prevent-candidate-insertion.html is timing out
 fast/events/ios/before-input-events-prevent-candidate-insertion.html [ Timeout ]

Modified: branches/safari-605-branch/LayoutTests/platform/mac/TestExpectations (227687 => 227688)


--- branches/safari-605-branch/LayoutTests/platform/mac/TestExpectations	2018-01-26 20:15:02 UTC (rev 227687)
+++ branches/safari-605-branch/LayoutTests/platform/mac/TestExpectations	2018-01-26 20:16:51 UTC (rev 227688)
@@ -1578,8 +1578,6 @@
 
 webkit.org/b/172052 [ Debug ] imported/w3c/web-platform-tests/html/webappapis/timers/type-long-setinterval.html [ Pass Failure ]
 
-webkit.org/b/176878 [ Debug ] fast/multicol/spanner-crash-when-adding-summary.html [ Crash ]
-
 # <rdar://problem/29031509> REGRESSION? (FontParser-195): svg/W3C-SVG-1.1/fonts-elem-* and svg/W3C-SVG-1.1/text-intro-* tests failing
 [ HighSierra+ ] svg/W3C-SVG-1.1/fonts-elem-01-t.svg [ Failure ]
 [ HighSierra+ ] svg/W3C-SVG-1.1/fonts-elem-02-t.svg [ Failure ]

Modified: branches/safari-605-branch/Source/WebCore/ChangeLog (227687 => 227688)


--- branches/safari-605-branch/Source/WebCore/ChangeLog	2018-01-26 20:15:02 UTC (rev 227687)
+++ branches/safari-605-branch/Source/WebCore/ChangeLog	2018-01-26 20:16:51 UTC (rev 227688)
@@ -1,3 +1,27 @@
+2018-01-26  Jason Marcell  <[email protected]>
+
+        Cherry-pick r227570. rdar://problem/36873398
+
+    2018-01-24  Antti Koivisto  <[email protected]>
+
+            Assertion failure in RenderMultiColumnSet::requiresBalancing() on fast/multicol/spanner-crash-when-adding-summary.html
+            https://bugs.webkit.org/show_bug.cgi?id=179308
+            <rdar://problem/34592771>
+
+            Reviewed by Zalan Bujtas.
+
+            The issue here is that we fail to tear down render tree for a summary element because adding another summary element
+            takes it out of the composed tree. This leaves behind renderers that break some multicolumn assumptions.
+
+            * rendering/updating/RenderTreeUpdater.cpp:
+            (WebCore::RenderTreeUpdater::tearDownRenderers):
+            (WebCore::RenderTreeUpdater::tearDownLeftoverShadowHostChildren):
+
+            When tearing down renderers go through the real children of the shadow hosts at the end and see if we left any renderers behind.
+            If so, tear them down too.
+
+            * rendering/updating/RenderTreeUpdater.h:
+
 2018-01-25  Jason Marcell  <[email protected]>
 
         Cherry-pick r227612. rdar://problem/36873390

Modified: branches/safari-605-branch/Source/WebCore/style/RenderTreeUpdater.cpp (227687 => 227688)


--- branches/safari-605-branch/Source/WebCore/style/RenderTreeUpdater.cpp	2018-01-26 20:15:02 UTC (rev 227687)
+++ branches/safari-605-branch/Source/WebCore/style/RenderTreeUpdater.cpp	2018-01-26 20:16:51 UTC (rev 227688)
@@ -547,6 +547,11 @@
                 renderer->removeFromParentAndDestroyCleaningUpAnonymousWrappers();
                 element.setRenderer(nullptr);
             }
+
+            // Make sure we don't leave any renderers behind in nodes outside the composed tree.
+            if (element.shadowRoot())
+                tearDownLeftoverShadowHostChildren(element);
+
             if (element.hasCustomStyleResolveCallbacks())
                 element.didDetachRenderers();
         }
@@ -578,6 +583,29 @@
     text.setRenderer(nullptr);
 }
 
+void RenderTreeUpdater::tearDownLeftoverShadowHostChildren(Element& host)
+{
+    for (auto* hostChild = host.firstChild(); hostChild; hostChild = hostChild->nextSibling()) {
+        if (!hostChild->renderer())
+            continue;
+        if (is<Text>(*hostChild)) {
+            tearDownTextRenderer(downcast<Text>(*hostChild));
+            continue;
+        }
+        if (is<Element>(*hostChild))
+            tearDownRenderers(downcast<Element>(*hostChild), TeardownType::Full);
+    }
+}
+
+void RenderTreeUpdater::tearDownTextRenderer(Text& text)
+{
+    auto* renderer = text.renderer();
+    if (!renderer)
+        return;
+    renderer->removeFromParentAndDestroyCleaningUpAnonymousWrappers();
+    text.setRenderer(nullptr);
+}
+
 RenderView& RenderTreeUpdater::renderView()
 {
     return *m_document.renderView();

Modified: branches/safari-605-branch/Source/WebCore/style/RenderTreeUpdater.h (227687 => 227688)


--- branches/safari-605-branch/Source/WebCore/style/RenderTreeUpdater.h	2018-01-26 20:15:02 UTC (rev 227687)
+++ branches/safari-605-branch/Source/WebCore/style/RenderTreeUpdater.h	2018-01-26 20:16:51 UTC (rev 227688)
@@ -89,6 +89,8 @@
 
     enum class TeardownType { Full, RendererUpdate, RendererUpdateCancelingAnimations };
     static void tearDownRenderers(Element&, TeardownType);
+    static void tearDownTextRenderer(Text&);
+    static void tearDownLeftoverShadowHostChildren(Element&);
 
     RenderView& renderView();
 

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to