Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104060 => 104061)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 20:03:35 UTC (rev 104060)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-04 20:06:10 UTC (rev 104061)
@@ -1,5 +1,21 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 95462
+
+ 2011-09-19 Abhishek Arya <[email protected]>
+
+ Issues with merging ruby bases.
+ https://bugs.webkit.org/show_bug.cgi?id=67240
+
+ Reviewed by James Robinson.
+
+ ASSERTION FAILED: !needsLayout() in RenderRubyRun::getOverhang.
+
+ * fast/ruby/ruby-overhang-crash-expected.txt: Added.
+ * fast/ruby/ruby-overhang-crash.html: Added.
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95461
2011-09-16 Abhishek Arya <[email protected]>
Copied: branches/safari-534.54-branch/LayoutTests/fast/ruby/ruby-overhang-crash-expected.txt (from rev 95462, trunk/LayoutTests/fast/ruby/ruby-overhang-crash-expected.txt) (0 => 104061)
--- branches/safari-534.54-branch/LayoutTests/fast/ruby/ruby-overhang-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/ruby/ruby-overhang-crash-expected.txt 2012-01-04 20:06:10 UTC (rev 104061)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Copied: branches/safari-534.54-branch/LayoutTests/fast/ruby/ruby-overhang-crash.html (from rev 95462, trunk/LayoutTests/fast/ruby/ruby-overhang-crash.html) (0 => 104061)
--- branches/safari-534.54-branch/LayoutTests/fast/ruby/ruby-overhang-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/ruby/ruby-overhang-crash.html 2012-01-04 20:06:10 UTC (rev 104061)
@@ -0,0 +1,23 @@
+<html>
+<body>
+Test passes if it does not crash.
+<ruby><svg><table><span><div><tr></tr><rt id="test"></rt></ruby>
+<script>
+function runTest()
+{
+ var child = document.getElementById('test');
+ child.parentNode.removeChild(child);
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+setTimeout("runTest()", 0);
+</script>
+</body>
+</html>
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104060 => 104061)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 20:03:35 UTC (rev 104060)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-04 20:06:10 UTC (rev 104061)
@@ -1,5 +1,35 @@
2011-1-4 Lucas Forschler <[email protected]>
+ Merge 95462
+
+ 2011-09-19 Abhishek Arya <[email protected]>
+
+ Issues with merging ruby bases.
+ https://bugs.webkit.org/show_bug.cgi?id=67240
+
+ Reviewed by James Robinson.
+
+ 1) Change fromBeforeChild to beforeChild to match
+ webkit rendering naming conventions.
+ 2) Add assert to verify ruby base is indeed emptied
+ after collecting all children in a single base.
+ 3) Fix condition in mergeBlockChildren to bail out only
+ when we have no children and there is no work to merge
+ children to toBase.
+
+ Test: fast/ruby/ruby-overhang-crash.html
+
+ * rendering/RenderRubyBase.cpp:
+ (WebCore::RenderRubyBase::moveChildren):
+ (WebCore::RenderRubyBase::moveInlineChildren):
+ (WebCore::RenderRubyBase::moveBlockChildren):
+ (WebCore::RenderRubyBase::mergeBlockChildren):
+ * rendering/RenderRubyBase.h:
+ * rendering/RenderRubyRun.cpp:
+ (WebCore::RenderRubyRun::removeChild):
+
+2011-1-4 Lucas Forschler <[email protected]>
+
Merge 95461
2011-09-16 Abhishek Arya <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyBase.cpp (104060 => 104061)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyBase.cpp 2012-01-04 20:03:35 UTC (rev 104060)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyBase.cpp 2012-01-04 20:06:10 UTC (rev 104061)
@@ -65,7 +65,7 @@
return true;
}
-void RenderRubyBase::moveChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild)
+void RenderRubyBase::moveChildren(RenderRubyBase* toBase, RenderObject* beforeChild)
{
// This function removes all children that are before (!) beforeChild
// and appends them to toBase.
@@ -75,19 +75,19 @@
// Inline children might be wrapped in an anonymous block if there's a continuation.
// Theoretically, in ruby bases, this can happen with only the first such a child,
// so it should be OK to just climb the tree.
- while (fromBeforeChild && fromBeforeChild->parent() != this)
- fromBeforeChild = fromBeforeChild->parent();
+ while (beforeChild && beforeChild->parent() != this)
+ beforeChild = beforeChild->parent();
if (childrenInline())
- moveInlineChildren(toBase, fromBeforeChild);
+ moveInlineChildren(toBase, beforeChild);
else
- moveBlockChildren(toBase, fromBeforeChild);
+ moveBlockChildren(toBase, beforeChild);
setNeedsLayoutAndPrefWidthsRecalc();
toBase->setNeedsLayoutAndPrefWidthsRecalc();
}
-void RenderRubyBase::moveInlineChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild)
+void RenderRubyBase::moveInlineChildren(RenderRubyBase* toBase, RenderObject* beforeChild)
{
RenderBlock* toBlock;
@@ -106,17 +106,17 @@
}
}
// Move our inline children into the target block we determined above.
- moveChildrenTo(toBlock, firstChild(), fromBeforeChild);
+ moveChildrenTo(toBlock, firstChild(), beforeChild);
}
-void RenderRubyBase::moveBlockChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild)
+void RenderRubyBase::moveBlockChildren(RenderRubyBase* toBase, RenderObject* beforeChild)
{
if (toBase->childrenInline()) {
// First check whether we move only wrapped inline objects.
- if (hasOnlyWrappedInlineChildren(fromBeforeChild)) {
+ if (hasOnlyWrappedInlineChildren(beforeChild)) {
// The reason why the base is in block flow must be after beforeChild.
// We therefore can extract the inline objects and move them to toBase.
- for (RenderObject* child = firstChild(); child != fromBeforeChild; child = firstChild()) {
+ for (RenderObject* child = firstChild(); child != beforeChild; child = firstChild()) {
if (child->isAnonymousBlock()) {
RenderBlock* anonBlock = toRenderBlock(child);
ASSERT(anonBlock->childrenInline());
@@ -133,7 +133,7 @@
// Moving block children -> have to set toBase as block flow
toBase->makeChildrenNonInline();
// Move children, potentially collapsing anonymous block wrappers.
- mergeBlockChildren(toBase, fromBeforeChild);
+ mergeBlockChildren(toBase, beforeChild);
// Now we need to check if the leftover children are all inline.
// If so, make this base inline again.
@@ -157,24 +157,24 @@
}
}
} else
- mergeBlockChildren(toBase, fromBeforeChild);
+ mergeBlockChildren(toBase, beforeChild);
}
-void RenderRubyBase::mergeBlockChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild)
+void RenderRubyBase::mergeBlockChildren(RenderRubyBase* toBase, RenderObject* beforeChild)
{
- // This function removes all children that are before fromBeforeChild and appends them to toBase.
+ // This function removes all children that are before beforeChild and appends them to toBase.
ASSERT(!childrenInline());
ASSERT(toBase);
ASSERT(!toBase->childrenInline());
// Quick check whether we have anything to do, to simplify the following code.
- if (fromBeforeChild != firstChild())
+ if (!firstChild())
return;
// If an anonymous block would be put next to another such block, then merge those.
RenderObject* firstChildHere = firstChild();
RenderObject* lastChildThere = toBase->lastChild();
- if (firstChildHere && firstChildHere->isAnonymousBlock() && firstChildHere->childrenInline()
+ if (firstChildHere->isAnonymousBlock() && firstChildHere->childrenInline()
&& lastChildThere && lastChildThere->isAnonymousBlock() && lastChildThere->childrenInline()) {
RenderBlock* anonBlockHere = toRenderBlock(firstChildHere);
RenderBlock* anonBlockThere = toRenderBlock(lastChildThere);
@@ -183,7 +183,7 @@
anonBlockHere->destroy();
}
// Move all remaining children normally.
- moveChildrenTo(toBase, firstChild(), fromBeforeChild);
+ moveChildrenTo(toBase, firstChild(), beforeChild);
}
RenderRubyRun* RenderRubyBase::rubyRun() const
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyBase.h (104060 => 104061)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyBase.h 2012-01-04 20:03:35 UTC (rev 104060)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyBase.h 2012-01-04 20:06:10 UTC (rev 104061)
@@ -54,10 +54,10 @@
bool hasOnlyWrappedInlineChildren(RenderObject* beforeChild = 0) const;
- void moveChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild = 0);
- void moveInlineChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild = 0);
- void moveBlockChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild = 0);
- void mergeBlockChildren(RenderRubyBase* toBase, RenderObject* fromBeforeChild = 0);
+ void moveChildren(RenderRubyBase* toBase, RenderObject* beforeChild = 0);
+ void moveInlineChildren(RenderRubyBase* toBase, RenderObject* beforeChild = 0);
+ void moveBlockChildren(RenderRubyBase* toBase, RenderObject* beforeChild = 0);
+ void mergeBlockChildren(RenderRubyBase* toBase, RenderObject* beforeChild = 0);
RenderRubyRun* rubyRun() const;
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyRun.cpp (104060 => 104061)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyRun.cpp 2012-01-04 20:03:35 UTC (rev 104060)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderRubyRun.cpp 2012-01-04 20:06:10 UTC (rev 104061)
@@ -167,6 +167,7 @@
moveChildTo(rightRun, base);
rightRun->moveChildTo(this, rightBase);
// The now empty ruby base will be removed below.
+ ASSERT(!rubyBase()->firstChild());
}
}
}
