Title: [257720] trunk
- Revision
- 257720
- Author
- [email protected]
- Date
- 2020-03-02 11:10:53 -0800 (Mon, 02 Mar 2020)
Log Message
ASSERT(m_column != unsetColumnIndex) in RenderTable::cellBefore
https://bugs.webkit.org/show_bug.cgi?id=208397
Patch by Doug Kelly <[email protected]> on 2020-03-02
Reviewed by Zalan Bujtas.
Source/WebCore:
When inserting a cell into a table row which is not visible, this can lead to attempting to compute the repaint
rects during tree building. Instead, mark the layer as dirty using dirtyVisibleContentStatus(), and the visibility
will be recomputed at a later time.
Test: fast/table/insert-cell-invisible-parent.html
* rendering/RenderElement.cpp:
(WebCore::RenderElement::insertedIntoTree):
LayoutTests:
* fast/table/insert-cell-invisible-parent-expected.txt: Added.
* fast/table/insert-cell-invisible-parent.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (257719 => 257720)
--- trunk/LayoutTests/ChangeLog 2020-03-02 18:53:39 UTC (rev 257719)
+++ trunk/LayoutTests/ChangeLog 2020-03-02 19:10:53 UTC (rev 257720)
@@ -1,3 +1,13 @@
+2020-03-02 Doug Kelly <[email protected]>
+
+ ASSERT(m_column != unsetColumnIndex) in RenderTable::cellBefore
+ https://bugs.webkit.org/show_bug.cgi?id=208397
+
+ Reviewed by Zalan Bujtas.
+
+ * fast/table/insert-cell-invisible-parent-expected.txt: Added.
+ * fast/table/insert-cell-invisible-parent.html: Added.
+
2020-03-02 Jason Lawrence <[email protected]>
[ Mac ] webanimations/accelerated-animation-renderer-change.html is flaky failing.
Added: trunk/LayoutTests/fast/table/insert-cell-invisible-parent-expected.txt (0 => 257720)
--- trunk/LayoutTests/fast/table/insert-cell-invisible-parent-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/table/insert-cell-invisible-parent-expected.txt 2020-03-02 19:10:53 UTC (rev 257720)
@@ -0,0 +1 @@
+Tests if a newly-inserted cell is properly added when parent element is not visible. Test passes if WebKit does not crash. PASS
Added: trunk/LayoutTests/fast/table/insert-cell-invisible-parent.html (0 => 257720)
--- trunk/LayoutTests/fast/table/insert-cell-invisible-parent.html (rev 0)
+++ trunk/LayoutTests/fast/table/insert-cell-invisible-parent.html 2020-03-02 19:10:53 UTC (rev 257720)
@@ -0,0 +1,16 @@
+<style>
+ td { visibility: initial; }
+ #row { visibility: collapse; -webkit-backface-visibility: hidden; }
+</style>
+<table rules="none">
+<tr id="row">
+<script>
+document.body.offsetHeight;
+window.scrollBy();
+row.insertCell();
+document.body.offsetWidth;
+if (window.testRunner) {
+ document.body.innerText = "Tests if a newly-inserted cell is properly added when parent element is not visible. Test passes if WebKit does not crash. PASS";
+ testRunner.dumpAsText();
+}
+</script>
Modified: trunk/Source/WebCore/ChangeLog (257719 => 257720)
--- trunk/Source/WebCore/ChangeLog 2020-03-02 18:53:39 UTC (rev 257719)
+++ trunk/Source/WebCore/ChangeLog 2020-03-02 19:10:53 UTC (rev 257720)
@@ -1,3 +1,19 @@
+2020-03-02 Doug Kelly <[email protected]>
+
+ ASSERT(m_column != unsetColumnIndex) in RenderTable::cellBefore
+ https://bugs.webkit.org/show_bug.cgi?id=208397
+
+ Reviewed by Zalan Bujtas.
+
+ When inserting a cell into a table row which is not visible, this can lead to attempting to compute the repaint
+ rects during tree building. Instead, mark the layer as dirty using dirtyVisibleContentStatus(), and the visibility
+ will be recomputed at a later time.
+
+ Test: fast/table/insert-cell-invisible-parent.html
+
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::insertedIntoTree):
+
2020-03-02 Zalan Bujtas <[email protected]>
[BFC][MarginCollapsing] Sometimes precomputed margin values are just plain wrong.
Modified: trunk/Source/WebCore/rendering/RenderElement.cpp (257719 => 257720)
--- trunk/Source/WebCore/rendering/RenderElement.cpp 2020-03-02 18:53:39 UTC (rev 257719)
+++ trunk/Source/WebCore/rendering/RenderElement.cpp 2020-03-02 19:10:53 UTC (rev 257720)
@@ -885,7 +885,7 @@
if (!layer)
layer = parent()->enclosingLayer();
if (layer)
- layer->setHasVisibleContent();
+ layer->dirtyVisibleContentStatus();
}
RenderObject::insertedIntoTree();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
