Diff
Modified: trunk/LayoutTests/ChangeLog (229473 => 229474)
--- trunk/LayoutTests/ChangeLog 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/LayoutTests/ChangeLog 2018-03-09 19:14:23 UTC (rev 229474)
@@ -1,3 +1,14 @@
+2018-03-09 Zalan Bujtas <[email protected]>
+
+ RenderTreeBuilder::splitAnonymousBoxesAroundChild should take multicolumn spanners into account.
+ https://bugs.webkit.org/show_bug.cgi?id=183493
+ <rdar://problem/38030461>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/multicol/adjust-beforeChild-for-spanner-crash-expected.txt: Added.
+ * fast/multicol/adjust-beforeChild-for-spanner-crash.html: Added.
+
2018-03-09 Basuke Suzuki <[email protected]>
[webkitpy, WinCairo] Launch Apache HTTPD for HTTP Tests.
Added: trunk/LayoutTests/fast/multicol/adjust-beforeChild-for-spanner-crash-expected.txt (0 => 229474)
--- trunk/LayoutTests/fast/multicol/adjust-beforeChild-for-spanner-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/adjust-beforeChild-for-spanner-crash-expected.txt 2018-03-09 19:14:23 UTC (rev 229474)
@@ -0,0 +1 @@
+Pass if no crash.
Added: trunk/LayoutTests/fast/multicol/adjust-beforeChild-for-spanner-crash.html (0 => 229474)
--- trunk/LayoutTests/fast/multicol/adjust-beforeChild-for-spanner-crash.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/adjust-beforeChild-for-spanner-crash.html 2018-03-09 19:14:23 UTC (rev 229474)
@@ -0,0 +1,16 @@
+<style>
+.container { column-count: 2; }
+.inserted { column-span: all; }
+</style>
+
+<div class=container><table id=table></table></div>
+Pass if no crash.
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+let d = document.createElement("div");
+d.className = "inserted";
+table.appendChild(d);
+document.body.offsetHeight;
+table.createCaption();
+</script>
Modified: trunk/Source/WebCore/ChangeLog (229473 => 229474)
--- trunk/Source/WebCore/ChangeLog 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/Source/WebCore/ChangeLog 2018-03-09 19:14:23 UTC (rev 229474)
@@ -1,3 +1,29 @@
+2018-03-09 Zalan Bujtas <[email protected]>
+
+ RenderTreeBuilder::splitAnonymousBoxesAroundChild should take multicolumn spanners into account.
+ https://bugs.webkit.org/show_bug.cgi?id=183493
+ <rdar://problem/38030461>
+
+ Reviewed by Antti Koivisto.
+
+ Multicolumn spanners are taken out of their original position and placed next
+ to a RenderMultiColumnSet. splitAnonymousBoxesAroundChild needs to know the original parent (in the render tree context).
+
+ Test: fast/multicol/adjust-beforeChild-for-spanner-crash.html
+
+ * rendering/updating/RenderTreeBuilder.cpp:
+ (WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):
+ * rendering/updating/RenderTreeBuilder.h:
+ * rendering/updating/RenderTreeBuilderBlock.cpp:
+ (WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation):
+ * rendering/updating/RenderTreeBuilderMultiColumn.cpp:
+ (WebCore::RenderTreeBuilder::MultiColumn::adjustBeforeChildForMultiColumnSpannerIfNeeded):
+ * rendering/updating/RenderTreeBuilderMultiColumn.h:
+ * rendering/updating/RenderTreeBuilderRuby.cpp:
+ (WebCore::RenderTreeBuilder::Ruby::moveChildrenInternal):
+ * rendering/updating/RenderTreeBuilderTable.cpp:
+ (WebCore::RenderTreeBuilder::Table::attach):
+
2018-03-09 Jer Noble <[email protected]>
Add isPictureInPictureActive messaging across WebKit process boundary
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp (229473 => 229474)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2018-03-09 19:14:23 UTC (rev 229474)
@@ -37,6 +37,7 @@
#include "RenderLineBreak.h"
#include "RenderMathMLFenced.h"
#include "RenderMenuList.h"
+#include "RenderMultiColumnFlow.h"
#include "RenderRuby.h"
#include "RenderRubyBase.h"
#include "RenderRubyRun.h"
@@ -599,8 +600,10 @@
parent.repaint();
}
-RenderObject* RenderTreeBuilder::splitAnonymousBoxesAroundChild(RenderBox& parent, RenderObject* beforeChild)
+RenderObject* RenderTreeBuilder::splitAnonymousBoxesAroundChild(RenderBox& parent, RenderObject& originalBeforeChild)
{
+ // Adjust beforeChild if it is a column spanner and has been moved out of its original position.
+ auto* beforeChild = RenderTreeBuilder::MultiColumn::adjustBeforeChildForMultiColumnSpannerIfNeeded(originalBeforeChild);
bool didSplitParentAnonymousBoxes = false;
while (beforeChild->parent() != &parent) {
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.h (229473 => 229474)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.h 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.h 2018-03-09 19:14:23 UTC (rev 229474)
@@ -80,7 +80,7 @@
void moveAllChildren(RenderBoxModelObject& from, RenderBoxModelObject& to, NormalizeAfterInsertion);
void moveAllChildren(RenderBoxModelObject& from, RenderBoxModelObject& to, RenderObject* beforeChild, NormalizeAfterInsertion);
- RenderObject* splitAnonymousBoxesAroundChild(RenderBox& parent, RenderObject* beforeChild);
+ RenderObject* splitAnonymousBoxesAroundChild(RenderBox& parent, RenderObject& originalBeforeChild);
void makeChildrenNonInline(RenderBlock& parent, RenderObject* insertionPoint = nullptr);
void removeAnonymousWrappersForInlineChildrenIfNeeded(RenderElement& parent);
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp (229473 => 229474)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp 2018-03-09 19:14:23 UTC (rev 229474)
@@ -193,7 +193,7 @@
return;
}
- beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, beforeChild);
+ beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, *beforeChild);
RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(beforeChild->parent() == &parent);
}
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp (229473 => 229474)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp 2018-03-09 19:14:23 UTC (rev 229474)
@@ -407,4 +407,23 @@
// content is added again later.
}
+RenderObject* RenderTreeBuilder::MultiColumn::adjustBeforeChildForMultiColumnSpannerIfNeeded(RenderObject& beforeChild)
+{
+ if (!is<RenderBox>(beforeChild))
+ return &beforeChild;
+
+ auto* nextSibling = beforeChild.nextSibling();
+ if (!nextSibling)
+ return &beforeChild;
+
+ if (!is<RenderMultiColumnSet>(*nextSibling))
+ return &beforeChild;
+
+ auto* multiColumnFlow = downcast<RenderMultiColumnSet>(*nextSibling).multiColumnFlow();
+ if (!multiColumnFlow)
+ return &beforeChild;
+
+ return multiColumnFlow->findColumnSpannerPlaceholder(downcast<RenderBox>(&beforeChild));
}
+
+}
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.h (229473 => 229474)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.h 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.h 2018-03-09 19:14:23 UTC (rev 229474)
@@ -43,6 +43,7 @@
RenderObject* resolveMovedChild(RenderFragmentedFlow& enclosingFragmentedFlow, RenderObject* beforeChild);
void multiColumnDescendantInserted(RenderMultiColumnFlow&, RenderObject& newDescendant);
void multiColumnRelativeWillBeRemoved(RenderMultiColumnFlow&, RenderObject& relative);
+ static RenderObject* adjustBeforeChildForMultiColumnSpannerIfNeeded(RenderObject& beforeChild);
private:
void createFragmentedFlow(RenderBlockFlow&);
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp (229473 => 229474)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp 2018-03-09 19:14:23 UTC (rev 229474)
@@ -183,7 +183,7 @@
// This function removes all children that are before (!) beforeChild
// and appends them to toBase.
if (beforeChild && beforeChild->parent() != &from)
- beforeChild = m_builder.splitAnonymousBoxesAroundChild(from, beforeChild);
+ beforeChild = m_builder.splitAnonymousBoxesAroundChild(from, *beforeChild);
if (from.childrenInline())
moveInlineChildren(from, to, beforeChild);
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp (229473 => 229474)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp 2018-03-09 19:10:37 UTC (rev 229473)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp 2018-03-09 19:14:23 UTC (rev 229474)
@@ -164,7 +164,7 @@
void RenderTreeBuilder::Table::attach(RenderTableRow& parent, RenderPtr<RenderObject> child, RenderObject* beforeChild)
{
if (beforeChild && beforeChild->parent() != &parent)
- beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, beforeChild);
+ beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, *beforeChild);
auto& newChild = *child.get();
ASSERT(!beforeChild || is<RenderTableCell>(*beforeChild));
@@ -177,7 +177,7 @@
void RenderTreeBuilder::Table::attach(RenderTableSection& parent, RenderPtr<RenderObject> child, RenderObject* beforeChild)
{
if (beforeChild && beforeChild->parent() != &parent)
- beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, beforeChild);
+ beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, *beforeChild);
// FIXME: child should always be a RenderTableRow at this point.
if (is<RenderTableRow>(*child.get()))
@@ -189,7 +189,7 @@
void RenderTreeBuilder::Table::attach(RenderTable& parent, RenderPtr<RenderObject> child, RenderObject* beforeChild)
{
if (beforeChild && beforeChild->parent() != &parent)
- beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, beforeChild);
+ beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, *beforeChild);
auto& newChild = *child.get();
if (is<RenderTableSection>(newChild))
