Title: [243593] branches/safari-607-branch
- Revision
- 243593
- Author
- alanc...@apple.com
- Date
- 2019-03-27 16:56:26 -0700 (Wed, 27 Mar 2019)
Log Message
Cherry-pick r242943. rdar://problem/49307995
Cleanup inline boxes when list marker gets blockified
https://bugs.webkit.org/show_bug.cgi?id=195746
<rdar://problem/48049175>
Reviewed by Antti Koivisto.
Source/WebCore:
Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
change does not require a new renderer.
This patch takes care of destroying the inline boxtree when the marker gains block display type.
Test: fast/block/float/list-marker-is-float-crash.html
* rendering/RenderListMarker.cpp:
(WebCore::RenderListMarker::styleDidChange):
LayoutTests:
* fast/block/float/list-marker-is-float-crash-expected.txt: Added.
* fast/block/float/list-marker-is-float-crash.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (243592 => 243593)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-03-27 23:52:44 UTC (rev 243592)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-03-27 23:56:26 UTC (rev 243593)
@@ -1,5 +1,45 @@
2019-03-27 Alan Coon <alanc...@apple.com>
+ Cherry-pick r242943. rdar://problem/49307995
+
+ Cleanup inline boxes when list marker gets blockified
+ https://bugs.webkit.org/show_bug.cgi?id=195746
+ <rdar://problem/48049175>
+
+ Reviewed by Antti Koivisto.
+
+ Source/WebCore:
+
+ Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
+ During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
+ change does not require a new renderer.
+ This patch takes care of destroying the inline boxtree when the marker gains block display type.
+
+ Test: fast/block/float/list-marker-is-float-crash.html
+
+ * rendering/RenderListMarker.cpp:
+ (WebCore::RenderListMarker::styleDidChange):
+
+ LayoutTests:
+
+ * fast/block/float/list-marker-is-float-crash-expected.txt: Added.
+ * fast/block/float/list-marker-is-float-crash.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-14 Zalan Bujtas <za...@apple.com>
+
+ Cleanup inline boxes when list marker gets blockified
+ https://bugs.webkit.org/show_bug.cgi?id=195746
+ <rdar://problem/48049175>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/block/float/list-marker-is-float-crash-expected.txt: Added.
+ * fast/block/float/list-marker-is-float-crash.html: Added.
+
+2019-03-27 Alan Coon <alanc...@apple.com>
+
Cherry-pick r243506. rdar://problem/49307987
vertexAttribPointer must restrict offset parameter
Added: branches/safari-607-branch/LayoutTests/fast/block/float/list-marker-is-float-crash-expected.txt (0 => 243593)
--- branches/safari-607-branch/LayoutTests/fast/block/float/list-marker-is-float-crash-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/block/float/list-marker-is-float-crash-expected.txt 2019-03-27 23:56:26 UTC (rev 243593)
@@ -0,0 +1,2 @@
+PASS if no crash.
+
Added: branches/safari-607-branch/LayoutTests/fast/block/float/list-marker-is-float-crash.html (0 => 243593)
--- branches/safari-607-branch/LayoutTests/fast/block/float/list-marker-is-float-crash.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/block/float/list-marker-is-float-crash.html 2019-03-27 23:56:26 UTC (rev 243593)
@@ -0,0 +1,14 @@
+PASS if no crash.
+<li>
+<video src=""
AAAQAAAAAAQAABgAAAAABAAACAAAAABxzdHNjAAAAAAAAAAEAAAABAAAAAwAAAAEAAAAgc3RzegAAAAAAAAAAAAAAAwAAA3MAAAAMAAAADAAAABRzdGNvAAAAAAAAAAEAAAAwAAAAYnVkdGEAAABabWV0YQAAAAAAAAAhaGRscgAAAAAAAAAAbWRpcmFwcGwAAAAAAAAAAAAAAAAtaWxzdAAAACWpdG9vAAAAHWRhdGEAAAABAAAAAExhdmY1Ni40MC4xMDE=" controls="controls">
+<style>
+:matches(::marker, |*) {
+ float: left;
+}
+</style>
+
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.body.style.columnCount = "2";
+</script>
\ No newline at end of file
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (243592 => 243593)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-03-27 23:52:44 UTC (rev 243592)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-03-27 23:56:26 UTC (rev 243593)
@@ -1,5 +1,52 @@
2019-03-27 Alan Coon <alanc...@apple.com>
+ Cherry-pick r242943. rdar://problem/49307995
+
+ Cleanup inline boxes when list marker gets blockified
+ https://bugs.webkit.org/show_bug.cgi?id=195746
+ <rdar://problem/48049175>
+
+ Reviewed by Antti Koivisto.
+
+ Source/WebCore:
+
+ Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
+ During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
+ change does not require a new renderer.
+ This patch takes care of destroying the inline boxtree when the marker gains block display type.
+
+ Test: fast/block/float/list-marker-is-float-crash.html
+
+ * rendering/RenderListMarker.cpp:
+ (WebCore::RenderListMarker::styleDidChange):
+
+ LayoutTests:
+
+ * fast/block/float/list-marker-is-float-crash-expected.txt: Added.
+ * fast/block/float/list-marker-is-float-crash.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-14 Zalan Bujtas <za...@apple.com>
+
+ Cleanup inline boxes when list marker gets blockified
+ https://bugs.webkit.org/show_bug.cgi?id=195746
+ <rdar://problem/48049175>
+
+ Reviewed by Antti Koivisto.
+
+ Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
+ During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
+ change does not require a new renderer.
+ This patch takes care of destroying the inline boxtree when the marker gains block display type.
+
+ Test: fast/block/float/list-marker-is-float-crash.html
+
+ * rendering/RenderListMarker.cpp:
+ (WebCore::RenderListMarker::styleDidChange):
+
+2019-03-27 Alan Coon <alanc...@apple.com>
+
Cherry-pick r242964. rdar://problem/49359851
Storing a Node in Ref/RefPtr inside its destructor results in double delete
Modified: branches/safari-607-branch/Source/WebCore/rendering/RenderListMarker.cpp (243592 => 243593)
--- branches/safari-607-branch/Source/WebCore/rendering/RenderListMarker.cpp 2019-03-27 23:52:44 UTC (rev 243592)
+++ branches/safari-607-branch/Source/WebCore/rendering/RenderListMarker.cpp 2019-03-27 23:56:26 UTC (rev 243593)
@@ -1145,8 +1145,14 @@
{
RenderBox::styleDidChange(diff, oldStyle);
- if (oldStyle && (style().listStylePosition() != oldStyle->listStylePosition() || style().listStyleType() != oldStyle->listStyleType()))
- setNeedsLayoutAndPrefWidthsRecalc();
+ if (oldStyle) {
+ if (style().listStylePosition() != oldStyle->listStylePosition() || style().listStyleType() != oldStyle->listStyleType())
+ setNeedsLayoutAndPrefWidthsRecalc();
+ if (oldStyle->isDisplayInlineType() && !style().isDisplayInlineType()) {
+ delete m_inlineBoxWrapper;
+ m_inlineBoxWrapper = nullptr;
+ }
+ }
if (m_image != style().listStyleImage()) {
if (m_image)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
