- Revision
- 234762
- Author
- [email protected]
- Date
- 2018-08-10 10:39:53 -0700 (Fri, 10 Aug 2018)
Log Message
Once <object> is hidden, its content won't be displayed again if its URL has fragment identifier ("#").
https://bugs.webkit.org/show_bug.cgi?id=187990
Reviewed by Simon Fraser.
Source/WebCore:
Fixes an issue where an HTML object element that behaves like an iframe and references a resource
whose URL contains a fragment would not be repainted when its CSS display property changes.
Rendering of an <object> that behaves like an iframe is handled by a widget (FrameView). When
the CSS display property for an <object> is set to "none" we detach the widget from its renderer
as part of destroying the render tree for the <object>. Subsequently changing the CSS display
to a non-"none"/"contents" value will create a new renderer for <object> R. For an <object> that
behaves like an iframe, we navigate to the resource associated with the <object> reusing the
existing Frame F object created when we first displayed the <object>. Unlike the case where
the URL of the resource does not contain a fragment, navigating to a fragment in the same document
uses a different code path that does not re-associate the FrameView of F with R before it scrolls
the view; => the FrameView of F is not in the view hierarchy. Therefore we do not paint anything
for the content of the <object> and hence the scroll is not observable. Instead we need to ensure
that the FrameView of F installed in the view hierarchy when navigating to an anchor in the same
document.
As a side benefit of this fix we now also repaint an <object> that is programmatically navigated
to a different anchor in the same document.
Tests: fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html
fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadInSameDocument):
LayoutTests:
Add tests to ensure that we repaint an <object>, whose resource URL contains a fragment, when
its CSS display property changes as well as when its navigated to a different anchor in the same
document.
* fast/repaint/object-as-iframe-hide-and-show-document-at-anchor-expected.txt: Added.
* fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html: Added.
* fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint-expected.txt: Added.
* fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html: Added.
* fast/repaint/resources/red-square-on-top-of-green-square.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (234761 => 234762)
--- trunk/LayoutTests/ChangeLog 2018-08-10 17:08:44 UTC (rev 234761)
+++ trunk/LayoutTests/ChangeLog 2018-08-10 17:39:53 UTC (rev 234762)
@@ -1,3 +1,20 @@
+2018-08-10 Daniel Bates <[email protected]>
+
+ Once <object> is hidden, its content won't be displayed again if its URL has fragment identifier ("#").
+ https://bugs.webkit.org/show_bug.cgi?id=187990
+
+ Reviewed by Simon Fraser.
+
+ Add tests to ensure that we repaint an <object>, whose resource URL contains a fragment, when
+ its CSS display property changes as well as when its navigated to a different anchor in the same
+ document.
+
+ * fast/repaint/object-as-iframe-hide-and-show-document-at-anchor-expected.txt: Added.
+ * fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html: Added.
+ * fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint-expected.txt: Added.
+ * fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html: Added.
+ * fast/repaint/resources/red-square-on-top-of-green-square.html: Added.
+
2018-08-10 Ali Juma <[email protected]>
[IntersectionObserver] Implement rootMargin parsing
Added: trunk/LayoutTests/fast/repaint/object-as-iframe-hide-and-show-document-at-anchor-expected.txt (0 => 234762)
--- trunk/LayoutTests/fast/repaint/object-as-iframe-hide-and-show-document-at-anchor-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/repaint/object-as-iframe-hide-and-show-document-at-anchor-expected.txt 2018-08-10 17:39:53 UTC (rev 234762)
@@ -0,0 +1,14 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x278
+ RenderBlock {HTML} at (0,0) size 800x278
+ RenderBody {BODY} at (8,8) size 784x262
+ RenderEmbeddedObject {OBJECT} at (0,0) size 258x258 [border: (1px solid #000000)]
+ layer at (0,0) size 256x512
+ RenderView at (0,0) size 241x241
+ layer at (0,0) size 241x512
+ RenderBlock {HTML} at (0,0) size 241x512
+ RenderBody {BODY} at (0,0) size 241x512
+ RenderBlock {DIV} at (0,0) size 256x256 [bgcolor=#FF0000]
+ RenderBlock {DIV} at (0,256) size 256x256 [bgcolor=#008000]
+ RenderText {#text} at (0,0) size 0x0
Added: trunk/LayoutTests/fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html (0 => 234762)
--- trunk/LayoutTests/fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html (rev 0)
+++ trunk/LayoutTests/fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html 2018-08-10 17:39:53 UTC (rev 234762)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+object {
+ border: 1px solid black;
+}
+</style>
+<script>
+function runTest()
+{
+ let testElement = document.getElementById("test");
+ testElement.style.display = "none";
+ testElement.style.display = "inline";
+}
+</script>
+</head>
+<body>
+<!-- This test verifies that we paint the contents of an HTML object for a URL with a fragment after setting its CSS display property to "none" and then "inline" (in that order). This test PASSED if you see a green square. Otherwise, it FAILED. -->
+<object id="test" data="" width="256" height="256" _onload_="runTest()"></object>
+</body>
+</html>
Added: trunk/LayoutTests/fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint-expected.txt (0 => 234762)
--- trunk/LayoutTests/fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint-expected.txt 2018-08-10 17:39:53 UTC (rev 234762)
@@ -0,0 +1,14 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x278
+ RenderBlock {HTML} at (0,0) size 800x278
+ RenderBody {BODY} at (8,8) size 784x262
+ RenderEmbeddedObject {OBJECT} at (0,0) size 258x258 [border: (1px solid #000000)]
+ layer at (0,0) size 256x512
+ RenderView at (0,0) size 241x241
+ layer at (0,0) size 241x512
+ RenderBlock {HTML} at (0,0) size 241x512
+ RenderBody {BODY} at (0,0) size 241x512
+ RenderBlock {DIV} at (0,0) size 256x256 [bgcolor=#FF0000]
+ RenderBlock {DIV} at (0,256) size 256x256 [bgcolor=#008000]
+ RenderText {#text} at (0,0) size 0x0
Added: trunk/LayoutTests/fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html (0 => 234762)
--- trunk/LayoutTests/fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html (rev 0)
+++ trunk/LayoutTests/fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html 2018-08-10 17:39:53 UTC (rev 234762)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+object {
+ border: 1px solid black;
+}
+</style>
+<script>
+function changeURLFragment(objectElement)
+{
+ objectElement.data = "" + "#green";
+}
+</script>
+</head>
+<body>
+<!-- This test verifies that we paint the contents of an HTML object that is programmatically navigated to an anchor in the same document. This test PASSED if you see a green square. Otherwise, it FAILED. -->
+<object data="" width="256" height="256" _onload_="changeURLFragment(this)"></object>
+</body>
+</html>
Added: trunk/LayoutTests/fast/repaint/resources/red-square-on-top-of-green-square.html (0 => 234762)
--- trunk/LayoutTests/fast/repaint/resources/red-square-on-top-of-green-square.html (rev 0)
+++ trunk/LayoutTests/fast/repaint/resources/red-square-on-top-of-green-square.html 2018-08-10 17:39:53 UTC (rev 234762)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+body {
+ margin: 0;
+ padding: 0;
+}
+
+.square {
+ height: 256px;
+ width: 256px;
+}
+</style>
+</head>
+<body>
+<div class="square" style="background-color: red" id="red"></div>
+<div class="square" style="background-color: green" id="green"></div>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (234761 => 234762)
--- trunk/Source/WebCore/ChangeLog 2018-08-10 17:08:44 UTC (rev 234761)
+++ trunk/Source/WebCore/ChangeLog 2018-08-10 17:39:53 UTC (rev 234762)
@@ -1,3 +1,35 @@
+2018-08-10 Daniel Bates <[email protected]>
+
+ Once <object> is hidden, its content won't be displayed again if its URL has fragment identifier ("#").
+ https://bugs.webkit.org/show_bug.cgi?id=187990
+
+ Reviewed by Simon Fraser.
+
+ Fixes an issue where an HTML object element that behaves like an iframe and references a resource
+ whose URL contains a fragment would not be repainted when its CSS display property changes.
+
+ Rendering of an <object> that behaves like an iframe is handled by a widget (FrameView). When
+ the CSS display property for an <object> is set to "none" we detach the widget from its renderer
+ as part of destroying the render tree for the <object>. Subsequently changing the CSS display
+ to a non-"none"/"contents" value will create a new renderer for <object> R. For an <object> that
+ behaves like an iframe, we navigate to the resource associated with the <object> reusing the
+ existing Frame F object created when we first displayed the <object>. Unlike the case where
+ the URL of the resource does not contain a fragment, navigating to a fragment in the same document
+ uses a different code path that does not re-associate the FrameView of F with R before it scrolls
+ the view; => the FrameView of F is not in the view hierarchy. Therefore we do not paint anything
+ for the content of the <object> and hence the scroll is not observable. Instead we need to ensure
+ that the FrameView of F installed in the view hierarchy when navigating to an anchor in the same
+ document.
+
+ As a side benefit of this fix we now also repaint an <object> that is programmatically navigated
+ to a different anchor in the same document.
+
+ Tests: fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html
+ fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html
+
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::loadInSameDocument):
+
2018-08-10 Ali Juma <[email protected]>
[IntersectionObserver] Implement rootMargin parsing
Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (234761 => 234762)
--- trunk/Source/WebCore/loader/FrameLoader.cpp 2018-08-10 17:08:44 UTC (rev 234761)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp 2018-08-10 17:39:53 UTC (rev 234762)
@@ -1149,6 +1149,13 @@
// Otherwise, the parent frame may think we never finished loading.
started();
+ if (auto* ownerElement = m_frame.ownerElement()) {
+ auto* ownerRenderer = ownerElement->renderer();
+ auto* view = m_frame.view();
+ if (is<RenderWidget>(ownerRenderer) && view)
+ downcast<RenderWidget>(*ownerRenderer).setWidget(view);
+ }
+
// We need to scroll to the fragment whether or not a hash change occurred, since
// the user might have scrolled since the previous navigation.
scrollToFragmentWithParentBoundary(url, isNewNavigation);
