[webkit-changes] [244013] releases/WebKitGTK/webkit-2.24

Mon, 08 Apr 2019 05:40:34 -0700

Title: [244013] releases/WebKitGTK/webkit-2.24
Revision
244013
Author
[email protected]
Date
2019-04-08 05:39:39 -0700 (Mon, 08 Apr 2019)

Log Message

Merge r243331 - Do not insert the first-letter anonymous container until after we've constructed the first-letter renderer.
https://bugs.webkit.org/show_bug.cgi?id=195919
<rdar://problem/48573434>

Reviewed by Brent Fulgham.

Source/WebCore:

When the container is injected too early, we might end up removing it as part of the collapsing logic
while the text renderer is being removed (replaced with the first letter + remaining text).

Test: fast/css/first-letter-and-float-crash.html

* rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::createRenderers):

LayoutTests:

* fast/css/first-letter-and-float-crash-expected.txt: Added.
* fast/css/first-letter-and-float-crash.html: Added.
* platform/mac/TestExpectations:

Modified Paths

Added Paths

Diff

Modified: releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog (244012 => 244013)


--- releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog	2019-04-08 12:39:34 UTC (rev 244012)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog	2019-04-08 12:39:39 UTC (rev 244013)
@@ -1,3 +1,15 @@
+2019-03-21  Zalan Bujtas  <[email protected]>
+
+        Do not insert the first-letter anonymous container until after we've constructed the first-letter renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=195919
+        <rdar://problem/48573434>
+
+        Reviewed by Brent Fulgham.
+
+        * fast/css/first-letter-and-float-crash-expected.txt: Added.
+        * fast/css/first-letter-and-float-crash.html: Added.
+        * platform/mac/TestExpectations:
+
 2019-03-19  Ryosuke Niwa  <[email protected]>
 
         appendChild should throw when inserting an ancestor of a template into its content adopted to another document

Modified: releases/WebKitGTK/webkit-2.24/LayoutTests/TestExpectations (244012 => 244013)


--- releases/WebKitGTK/webkit-2.24/LayoutTests/TestExpectations	2019-04-08 12:39:34 UTC (rev 244012)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/TestExpectations	2019-04-08 12:39:39 UTC (rev 244013)
@@ -2904,3 +2904,5 @@
 imported/w3c/web-platform-tests/css/css-lists/counter-reset-inside-display-contents.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-lists/list-marker-with-lineheight-and-overflow-hidden-001.html [ ImageOnlyFailure ]
 imported/w3c/web-platform-tests/css/css-lists/list-with-image-display-changed-001.html [ ImageOnlyFailure ]
+
+[ Debug ] fast/css/first-letter-and-float-crash.html [ Skip ]

Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/css/first-letter-and-float-crash-expected.txt (0 => 244013)


--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/css/first-letter-and-float-crash-expected.txt	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/css/first-letter-and-float-crash-expected.txt	2019-04-08 12:39:39 UTC (rev 244013)
@@ -0,0 +1 @@
+Pass if no crash

Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/css/first-letter-and-float-crash.html (0 => 244013)


--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/css/first-letter-and-float-crash.html	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/css/first-letter-and-float-crash.html	2019-04-08 12:39:39 UTC (rev 244013)
@@ -0,0 +1,11 @@
+<style>
+:matches(foobar, .inlineContainer .floatContainer)::first-letter {
+ font-size: 10px;
+}
+</style>
+
+<span class=inlineContainer><div style="float: left" class=floatContainer>Pass if no crash</div></span>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
\ No newline at end of file

Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog (244012 => 244013)


--- releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog	2019-04-08 12:39:34 UTC (rev 244012)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog	2019-04-08 12:39:39 UTC (rev 244013)
@@ -1,3 +1,19 @@
+2019-03-21  Zalan Bujtas  <[email protected]>
+
+        Do not insert the first-letter anonymous container until after we've constructed the first-letter renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=195919
+        <rdar://problem/48573434>
+
+        Reviewed by Brent Fulgham.
+
+        When the container is injected too early, we might end up removing it as part of the collapsing logic
+        while the text renderer is being removed (replaced with the first letter + remaining text).
+
+        Test: fast/css/first-letter-and-float-crash.html
+
+        * rendering/updating/RenderTreeBuilderFirstLetter.cpp:
+        (WebCore::RenderTreeBuilder::FirstLetter::createRenderers):
+
 2019-03-19  Ryosuke Niwa  <[email protected]>
 
         appendChild should throw when inserting an ancestor of a template into its content adopted to another document

Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp (244012 => 244013)


--- releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp	2019-04-08 12:39:34 UTC (rev 244012)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp	2019-04-08 12:39:39 UTC (rev 244013)
@@ -217,9 +217,6 @@
     newFirstLetter->initializeStyle();
     newFirstLetter->setIsFirstLetter();
 
-    auto& firstLetter = *newFirstLetter;
-    m_builder.attach(*firstLetterContainer, WTFMove(newFirstLetter), &currentTextChild);
-
     // The original string is going to be either a generated content string or a DOM node's
     // string. We want the original string before it got transformed in case first-letter has
     // no text-transform or a different text-transform applied to it.
@@ -253,6 +250,8 @@
 
         auto* textNode = currentTextChild.textNode();
         auto* beforeChild = currentTextChild.nextSibling();
+        auto inlineWrapperForDisplayContents = makeWeakPtr(currentTextChild.inlineWrapperForDisplayContents());
+        auto hasInlineWrapperForDisplayContents = inlineWrapperForDisplayContents.get();
         m_builder.destroy(currentTextChild);
 
         // Construct a text fragment for the text after the first letter.
@@ -265,13 +264,18 @@
             newRemainingText = createRenderer<RenderTextFragment>(firstLetterBlock.document(), oldText, length, oldText.length() - length);
 
         RenderTextFragment& remainingText = *newRemainingText;
+        ASSERT_UNUSED(hasInlineWrapperForDisplayContents, hasInlineWrapperForDisplayContents == inlineWrapperForDisplayContents.get());
+        remainingText.setInlineWrapperForDisplayContents(inlineWrapperForDisplayContents.get());
         m_builder.attach(*textContentParent, WTFMove(newRemainingText), beforeChild);
+
+        // FIXME: Make attach the final step so that we don't need to keep firstLetter around.
+        auto& firstLetter = *newFirstLetter;
         remainingText.setFirstLetter(firstLetter);
         firstLetter.setFirstLetterRemainingText(remainingText);
+        m_builder.attach(*firstLetterContainer, WTFMove(newFirstLetter), &remainingText);
 
-        // construct text fragment for the first letter
+        // Construct text fragment for the first letter.
         auto letter = createRenderer<RenderTextFragment>(firstLetterBlock.document(), oldText, 0, length);
-
         m_builder.attach(firstLetter, WTFMove(letter));
     }
 }

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to