Title: [243331] trunk
- Revision
- 243331
- Author
- [email protected]
- Date
- 2019-03-21 14:43:14 -0700 (Thu, 21 Mar 2019)
Log Message
Do not insert the first-letter anonymous container until after we've constructed the first-letter renderer.
https://bugs.webkit.org/show_bug.cgi?id=195919
<rdar://problem/48573434>
Reviewed by Brent Fulgham.
Source/WebCore:
When the container is injected too early, we might end up removing it as part of the collapsing logic
while the text renderer is being removed (replaced with the first letter + remaining text).
Test: fast/css/first-letter-and-float-crash.html
* rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::createRenderers):
LayoutTests:
* fast/css/first-letter-and-float-crash-expected.txt: Added.
* fast/css/first-letter-and-float-crash.html: Added.
* platform/mac/TestExpectations:
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (243330 => 243331)
--- trunk/LayoutTests/ChangeLog 2019-03-21 21:36:26 UTC (rev 243330)
+++ trunk/LayoutTests/ChangeLog 2019-03-21 21:43:14 UTC (rev 243331)
@@ -1,3 +1,15 @@
+2019-03-21 Zalan Bujtas <[email protected]>
+
+ Do not insert the first-letter anonymous container until after we've constructed the first-letter renderer.
+ https://bugs.webkit.org/show_bug.cgi?id=195919
+ <rdar://problem/48573434>
+
+ Reviewed by Brent Fulgham.
+
+ * fast/css/first-letter-and-float-crash-expected.txt: Added.
+ * fast/css/first-letter-and-float-crash.html: Added.
+ * platform/mac/TestExpectations:
+
2019-03-21 Eric Carlson <[email protected]>
Add UI process WebRTC runtime logging.
Modified: trunk/LayoutTests/TestExpectations (243330 => 243331)
--- trunk/LayoutTests/TestExpectations 2019-03-21 21:36:26 UTC (rev 243330)
+++ trunk/LayoutTests/TestExpectations 2019-03-21 21:43:14 UTC (rev 243331)
@@ -3059,3 +3059,5 @@
imported/w3c/web-platform-tests/css/css-lists/counter-reset-inside-display-contents.html [ ImageOnlyFailure ]
imported/w3c/web-platform-tests/css/css-lists/list-marker-with-lineheight-and-overflow-hidden-001.html [ ImageOnlyFailure ]
imported/w3c/web-platform-tests/css/css-lists/list-with-image-display-changed-001.html [ ImageOnlyFailure ]
+
+[ Debug ] fast/css/first-letter-and-float-crash.html [ Skip ]
Added: trunk/LayoutTests/fast/css/first-letter-and-float-crash-expected.txt (0 => 243331)
--- trunk/LayoutTests/fast/css/first-letter-and-float-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/first-letter-and-float-crash-expected.txt 2019-03-21 21:43:14 UTC (rev 243331)
@@ -0,0 +1 @@
+Pass if no crash
Added: trunk/LayoutTests/fast/css/first-letter-and-float-crash.html (0 => 243331)
--- trunk/LayoutTests/fast/css/first-letter-and-float-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/first-letter-and-float-crash.html 2019-03-21 21:43:14 UTC (rev 243331)
@@ -0,0 +1,11 @@
+<style>
+:matches(foobar, .inlineContainer .floatContainer)::first-letter {
+ font-size: 10px;
+}
+</style>
+
+<span class=inlineContainer><div style="float: left" class=floatContainer>Pass if no crash</div></span>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (243330 => 243331)
--- trunk/Source/WebCore/ChangeLog 2019-03-21 21:36:26 UTC (rev 243330)
+++ trunk/Source/WebCore/ChangeLog 2019-03-21 21:43:14 UTC (rev 243331)
@@ -1,3 +1,19 @@
+2019-03-21 Zalan Bujtas <[email protected]>
+
+ Do not insert the first-letter anonymous container until after we've constructed the first-letter renderer.
+ https://bugs.webkit.org/show_bug.cgi?id=195919
+ <rdar://problem/48573434>
+
+ Reviewed by Brent Fulgham.
+
+ When the container is injected too early, we might end up removing it as part of the collapsing logic
+ while the text renderer is being removed (replaced with the first letter + remaining text).
+
+ Test: fast/css/first-letter-and-float-crash.html
+
+ * rendering/updating/RenderTreeBuilderFirstLetter.cpp:
+ (WebCore::RenderTreeBuilder::FirstLetter::createRenderers):
+
2019-03-21 Eric Carlson <[email protected]>
Add UI process WebRTC runtime logging.
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp (243330 => 243331)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp 2019-03-21 21:36:26 UTC (rev 243330)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp 2019-03-21 21:43:14 UTC (rev 243331)
@@ -217,9 +217,6 @@
newFirstLetter->initializeStyle();
newFirstLetter->setIsFirstLetter();
- auto& firstLetter = *newFirstLetter;
- m_builder.attach(*firstLetterContainer, WTFMove(newFirstLetter), ¤tTextChild);
-
// The original string is going to be either a generated content string or a DOM node's
// string. We want the original string before it got transformed in case first-letter has
// no text-transform or a different text-transform applied to it.
@@ -253,6 +250,8 @@
auto* textNode = currentTextChild.textNode();
auto* beforeChild = currentTextChild.nextSibling();
+ auto inlineWrapperForDisplayContents = makeWeakPtr(currentTextChild.inlineWrapperForDisplayContents());
+ auto hasInlineWrapperForDisplayContents = inlineWrapperForDisplayContents.get();
m_builder.destroy(currentTextChild);
// Construct a text fragment for the text after the first letter.
@@ -265,13 +264,18 @@
newRemainingText = createRenderer<RenderTextFragment>(firstLetterBlock.document(), oldText, length, oldText.length() - length);
RenderTextFragment& remainingText = *newRemainingText;
+ ASSERT_UNUSED(hasInlineWrapperForDisplayContents, hasInlineWrapperForDisplayContents == inlineWrapperForDisplayContents.get());
+ remainingText.setInlineWrapperForDisplayContents(inlineWrapperForDisplayContents.get());
m_builder.attach(*textContentParent, WTFMove(newRemainingText), beforeChild);
+
+ // FIXME: Make attach the final step so that we don't need to keep firstLetter around.
+ auto& firstLetter = *newFirstLetter;
remainingText.setFirstLetter(firstLetter);
firstLetter.setFirstLetterRemainingText(remainingText);
+ m_builder.attach(*firstLetterContainer, WTFMove(newFirstLetter), &remainingText);
- // construct text fragment for the first letter
+ // Construct text fragment for the first letter.
auto letter = createRenderer<RenderTextFragment>(firstLetterBlock.document(), oldText, 0, length);
-
m_builder.attach(firstLetter, WTFMove(letter));
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
