Title: [258466] trunk
- Revision
- 258466
- Author
- [email protected]
- Date
- 2020-03-14 05:57:36 -0700 (Sat, 14 Mar 2020)
Log Message
[Tree building] Reset the fragmented flow status before calling child.willBeRemovedFromTree.
https://bugs.webkit.org/show_bug.cgi?id=209100
<rdar://problem/60434672>
Reviewed by Simon Fraser.
Source/WebCore:
::willBeRemovedFromTree() assumes all the cleanup has happened and it's the final step before calling d'tor.
It clears m_fragmentList that resetFragmentedFlowStateOnRemoval() later checks for consistency (m_fragmentList.contains(fragment)).
Test: fast/multicol/reparent-fragment-flow-content.html
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::detachFromRenderElement):
LayoutTests:
* fast/multicol/reparent-fragment-flow-content-expected.txt: Added.
* fast/multicol/reparent-fragment-flow-content.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (258465 => 258466)
--- trunk/LayoutTests/ChangeLog 2020-03-14 10:22:51 UTC (rev 258465)
+++ trunk/LayoutTests/ChangeLog 2020-03-14 12:57:36 UTC (rev 258466)
@@ -1,3 +1,14 @@
+2020-03-14 Zalan Bujtas <[email protected]>
+
+ [Tree building] Reset the fragmented flow status before calling child.willBeRemovedFromTree.
+ https://bugs.webkit.org/show_bug.cgi?id=209100
+ <rdar://problem/60434672>
+
+ Reviewed by Simon Fraser.
+
+ * fast/multicol/reparent-fragment-flow-content-expected.txt: Added.
+ * fast/multicol/reparent-fragment-flow-content.html: Added.
+
2020-03-14 Rob Buis <[email protected]>
Set Origin header value to null rather than omitting it
Added: trunk/LayoutTests/fast/multicol/reparent-fragment-flow-content-expected.txt (0 => 258466)
--- trunk/LayoutTests/fast/multicol/reparent-fragment-flow-content-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/reparent-fragment-flow-content-expected.txt 2020-03-14 12:57:36 UTC (rev 258466)
@@ -0,0 +1,2 @@
+PASS if no crash or assert in debug.
+
Added: trunk/LayoutTests/fast/multicol/reparent-fragment-flow-content.html (0 => 258466)
--- trunk/LayoutTests/fast/multicol/reparent-fragment-flow-content.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/reparent-fragment-flow-content.html 2020-03-14 12:57:36 UTC (rev 258466)
@@ -0,0 +1,8 @@
+PASS if no crash or assert in debug.
+<summary id=summary></summary><details id=details style="overflow: -webkit-paged-y"></details>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.body.offsetHeight;
+details.appendChild(summary);
+</script>
Modified: trunk/Source/WebCore/ChangeLog (258465 => 258466)
--- trunk/Source/WebCore/ChangeLog 2020-03-14 10:22:51 UTC (rev 258465)
+++ trunk/Source/WebCore/ChangeLog 2020-03-14 12:57:36 UTC (rev 258466)
@@ -1,3 +1,19 @@
+2020-03-14 Zalan Bujtas <[email protected]>
+
+ [Tree building] Reset the fragmented flow status before calling child.willBeRemovedFromTree.
+ https://bugs.webkit.org/show_bug.cgi?id=209100
+ <rdar://problem/60434672>
+
+ Reviewed by Simon Fraser.
+
+ ::willBeRemovedFromTree() assumes all the cleanup has happened and it's the final step before calling d'tor.
+ It clears m_fragmentList that resetFragmentedFlowStateOnRemoval() later checks for consistency (m_fragmentList.contains(fragment)).
+
+ Test: fast/multicol/reparent-fragment-flow-content.html
+
+ * rendering/updating/RenderTreeBuilder.cpp:
+ (WebCore::RenderTreeBuilder::detachFromRenderElement):
+
2020-03-14 Rob Buis <[email protected]>
Set Origin header value to null rather than omitting it
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp (258465 => 258466)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2020-03-14 10:22:51 UTC (rev 258465)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2020-03-14 12:57:36 UTC (rev 258466)
@@ -873,11 +873,11 @@
if (!parent.renderTreeBeingDestroyed() && child.isSelectionBorder())
parent.frame().selection().setNeedsSelectionUpdate();
+ child.resetFragmentedFlowStateOnRemoval();
+
if (!parent.renderTreeBeingDestroyed())
child.willBeRemovedFromTree();
- child.resetFragmentedFlowStateOnRemoval();
-
// WARNING: There should be no code running between willBeRemovedFromTree() and the actual removal below.
// This is needed to avoid race conditions where willBeRemovedFromTree() would dirty the tree's structure
// and the code running here would force an untimely rebuilding, leaving |child| dangling.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
