Diff
Modified: branches/safari-534.54-branch/LayoutTests/ChangeLog (104496 => 104497)
--- branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/LayoutTests/ChangeLog 2012-01-09 23:16:09 UTC (rev 104497)
@@ -1,3 +1,23 @@
+2011-1-6 Lucas Forschler <[email protected]>
+
+ Merge 100630
+
+ 2011-11-17 Ken Buchanan <[email protected]>
+
+ Crash from nested tables with generated content
+ https://bugs.webkit.org/show_bug.cgi?id=68811
+
+ Reviewed by David Hyatt.
+
+ Layout test for nesting tables with generated content and forcing a
+ style recalculation.
+
+ * fast/css-generated-content/nested-tables-with-before-after-content-crash.html: Added
+ * platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png: Added
+ * platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt: Added
+ * platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png: Added
+ * platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt: Added
+
2011-1-5 Lucas Forschler <[email protected]>
Merge 100203
Copied: branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/nested-tables-with-before-after-content-crash.html (from rev 100630, trunk/LayoutTests/fast/css-generated-content/nested-tables-with-before-after-content-crash.html) (0 => 104497)
--- branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/nested-tables-with-before-after-content-crash.html (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/fast/css-generated-content/nested-tables-with-before-after-content-crash.html 2012-01-09 23:16:09 UTC (rev 104497)
@@ -0,0 +1,18 @@
+<!DOCTYPE>
+<html style="font: 1em/1 Ahem, sans-serif;">
+<style type="text/css">
+.c1 { display: inline-table; color: blue}
+.c1:before { overflow: hidden; content: counter(section); color: red}
+.c1:nth-child(2n) { text-decoration: overline; }
+</style>
+<body>
+<div class="c1" id="div1"><q style="display:inline-table"></q></div>
+</body>
+<script>
+ function runTest() {
+ document.getElementById('div1').setAttribute('class', 'c1');
+ document.body.offsetTop;
+ }
+ window._onload_ = runTest;
+</script>
+</html>
Copied: branches/safari-534.54-branch/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png (from rev 100630, trunk/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png)
(Binary files differ)
Copied: branches/safari-534.54-branch/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (from rev 100630, trunk/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt) (0 => 104497)
--- branches/safari-534.54-branch/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt 2012-01-09 23:16:09 UTC (rev 104497)
@@ -0,0 +1,24 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,8) size 784x584
+ RenderTable {DIV} at (0,0) size 48x19 [color=#0000FF]
+ RenderTableSection (anonymous) at (0,0) size 48x19
+ RenderTableRow (anonymous) at (0,0) size 48x19
+ RenderTableCell (anonymous) at (0,0) size 48x19 [r=0 c=0 rs=1 cs=1]
+ RenderInline (generated) at (0,0) size 16x16 [color=#FF0000]
+ RenderCounter at (0,3) size 16x16
+ text run at (0,3) width 16: "0"
+ RenderTable {Q} at (16,0) size 32x16
+ RenderTableSection (anonymous) at (0,0) size 32x16
+ RenderTableRow (anonymous) at (0,0) size 32x16
+ RenderTableCell (anonymous) at (0,0) size 32x16 [r=0 c=0 rs=1 cs=1]
+ RenderInline (generated) at (0,0) size 16x16
+ RenderQuote at (0,0) size 16x16
+ text run at (0,0) width 16: "\""
+ RenderInline (generated) at (0,0) size 16x16
+ RenderQuote at (16,0) size 16x16
+ text run at (16,0) width 16: "\""
+ RenderText {#text} at (0,0) size 0x0
+ RenderText {#text} at (0,0) size 0x0
Copied: branches/safari-534.54-branch/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png (from rev 100630, trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png)
(Binary files differ)
Copied: branches/safari-534.54-branch/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (from rev 100630, trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt) (0 => 104497)
--- branches/safari-534.54-branch/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (rev 0)
+++ branches/safari-534.54-branch/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt 2012-01-09 23:16:09 UTC (rev 104497)
@@ -0,0 +1,24 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,8) size 784x584
+ RenderTable {DIV} at (0,0) size 48x19 [color=#0000FF]
+ RenderTableSection (anonymous) at (0,0) size 48x19
+ RenderTableRow (anonymous) at (0,0) size 48x19
+ RenderTableCell (anonymous) at (0,0) size 48x19 [r=0 c=0 rs=1 cs=1]
+ RenderInline (generated) at (0,0) size 16x16 [color=#FF0000]
+ RenderCounter at (0,3) size 16x16
+ text run at (0,3) width 16: "0"
+ RenderTable {Q} at (16,0) size 32x16
+ RenderTableSection (anonymous) at (0,0) size 32x16
+ RenderTableRow (anonymous) at (0,0) size 32x16
+ RenderTableCell (anonymous) at (0,0) size 32x16 [r=0 c=0 rs=1 cs=1]
+ RenderInline (generated) at (0,0) size 16x16
+ RenderQuote at (0,0) size 16x16
+ text run at (0,0) width 16: "\""
+ RenderInline (generated) at (0,0) size 16x16
+ RenderQuote at (16,0) size 16x16
+ text run at (16,0) width 16: "\""
+ RenderText {#text} at (0,0) size 0x0
+ RenderText {#text} at (0,0) size 0x0
Modified: branches/safari-534.54-branch/Source/WebCore/ChangeLog (104496 => 104497)
--- branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/Source/WebCore/ChangeLog 2012-01-09 23:16:09 UTC (rev 104497)
@@ -1,5 +1,42 @@
2011-1-6 Lucas Forschler <[email protected]>
+ Merge 100630
+
+ 2011-11-17 Ken Buchanan <[email protected]>
+
+ Crash from nested tables with generated content
+ https://bugs.webkit.org/show_bug.cgi?id=68811
+
+ Reviewed by David Hyatt.
+
+ When adding a child to a table that has generated content, this change
+ ensures that we leave alone any generated content renderers that belong
+ to descendants in the tree. They don't need to be touched, and doing so
+ can create confusion about who the content belongs to.
+
+ This patch also simplifies some existing code for finding pseudoelement
+ renderers.
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::addChild):
+ (WebCore::RenderObject::isBeforeAfterContentGeneratedByAncestor): Added
+ * rendering/RenderObject.h:
+ (WebCore::RenderObject::findAfterContentRenderer): Deleted
+ (WebCore::RenderObject::findBeforeContentRenderer): Deleted
+ * rendering/RenderObjectChildList.cpp:
+ (WebCore::RenderObjectChildList::beforePseudoElementRenderer):
+ (WebCore::RenderObjectChildList::afterPseudoElementRenderer):
+ * rendering/RenderTable.cpp:
+ (WebCore::RenderTable::addChild):
+ * rendering/RenderTableRow.cpp:
+ (WebCore::RenderTableRow::addChild):
+ * rendering/RenderTableSection.cpp:
+ (WebCore::RenderTableSection::addChild):
+
+2011-1-6 Lucas Forschler <[email protected]>
+
Merge 100343
2011-11-15 Jessie Berlin <[email protected]>
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp (104496 => 104497)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-01-09 23:16:09 UTC (rev 104497)
@@ -668,7 +668,7 @@
{
// Make sure we don't append things after :after-generated content if we have it.
if (!beforeChild)
- beforeChild = findAfterContentRenderer();
+ beforeChild = afterPseudoElementRenderer();
// If the requested beforeChild is not one of our children, then this is because
// there is an anonymous container within this object that contains the beforeChild.
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderObject.cpp (104496 => 104497)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderObject.cpp 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderObject.cpp 2012-01-09 23:16:09 UTC (rev 104497)
@@ -263,6 +263,16 @@
return node() && node()->renderer() == this && node()->hasTagName(marqueeTag);
}
+static bool isBeforeAfterContentGeneratedByAncestor(RenderObject* renderer, RenderObject* beforeAfterContent)
+{
+ while (renderer) {
+ if (renderer->generatingNode() == beforeAfterContent->generatingNode())
+ return true;
+ renderer = renderer->parent();
+ }
+ return false;
+}
+
void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
{
RenderObjectChildList* children = virtualChildren();
@@ -273,9 +283,9 @@
RenderObject* beforeContent = 0;
bool beforeChildHasBeforeAndAfterContent = false;
if (beforeChild && (beforeChild->isTable() || beforeChild->isTableSection() || beforeChild->isTableRow() || beforeChild->isTableCell())) {
- beforeContent = beforeChild->findBeforeContentRenderer();
- RenderObject* afterContent = beforeChild->findAfterContentRenderer();
- if (beforeContent && afterContent) {
+ beforeContent = beforeChild->beforePseudoElementRenderer();
+ RenderObject* afterContent = beforeChild->afterPseudoElementRenderer();
+ if (beforeContent && afterContent && isBeforeAfterContentGeneratedByAncestor(this, beforeContent)) {
beforeChildHasBeforeAndAfterContent = true;
beforeContent->destroy();
}
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderObject.h (104496 => 104497)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderObject.h 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderObject.h 2012-01-09 23:16:09 UTC (rev 104497)
@@ -333,18 +333,6 @@
static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
static inline bool isBeforeOrAfterContent(const RenderObject* obj) { return obj && obj->isBeforeOrAfterContent(); }
- inline RenderObject* findBeforeContentRenderer() const
- {
- RenderObject* renderer = beforePseudoElementRenderer();
- return isBeforeContent(renderer) ? renderer : 0;
- }
-
- inline RenderObject* findAfterContentRenderer() const
- {
- RenderObject* renderer = afterPseudoElementRenderer();
- return isAfterContent(renderer) ? renderer : 0;
- }
-
inline RenderObject* anonymousContainer(RenderObject* child)
{
RenderObject* container = child;
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderObjectChildList.cpp (104496 => 104497)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderObjectChildList.cpp 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderObjectChildList.cpp 2012-01-09 23:16:09 UTC (rev 104497)
@@ -282,7 +282,7 @@
if (!first)
return 0;
- if (first->style()->styleType() == BEFORE)
+ if (first->isBeforeContent())
return first;
// Check for a possible generated run-in, using run-in positioning rules.
@@ -294,7 +294,7 @@
// We still need to skip any list markers that could exist before the run-in.
while (first && first->isListMarker())
first = first->nextSibling();
- if (first && first->style()->styleType() == BEFORE && first->isRenderInline() && first->isRunIn())
+ if (first && first->isBeforeContent() && first->isRenderInline() && first->isRunIn())
return first;
return 0;
@@ -306,7 +306,7 @@
do {
last = last->lastChild();
} while (last && last->isAnonymous() && last->style()->styleType() == NOPSEUDO && !last->isListMarker());
- if (last && last->style()->styleType() != AFTER)
+ if (last && !last->isAfterContent())
return 0;
return last;
}
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderTable.cpp (104496 => 104497)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderTable.cpp 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderTable.cpp 2012-01-09 23:16:09 UTC (rev 104497)
@@ -107,7 +107,7 @@
{
// Make sure we don't append things after :after-generated content if we have it.
if (!beforeChild)
- beforeChild = findAfterContentRenderer();
+ beforeChild = afterPseudoElementRenderer();
bool wrapInAnonymousSection = !child->isPositioned();
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderTableRow.cpp (104496 => 104497)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderTableRow.cpp 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderTableRow.cpp 2012-01-09 23:16:09 UTC (rev 104497)
@@ -84,7 +84,7 @@
{
// Make sure we don't append things after :after-generated content if we have it.
if (!beforeChild)
- beforeChild = findAfterContentRenderer();
+ beforeChild = afterPseudoElementRenderer();
if (!child->isTableCell()) {
RenderObject* last = beforeChild;
Modified: branches/safari-534.54-branch/Source/WebCore/rendering/RenderTableSection.cpp (104496 => 104497)
--- branches/safari-534.54-branch/Source/WebCore/rendering/RenderTableSection.cpp 2012-01-09 23:14:47 UTC (rev 104496)
+++ branches/safari-534.54-branch/Source/WebCore/rendering/RenderTableSection.cpp 2012-01-09 23:16:09 UTC (rev 104497)
@@ -96,7 +96,7 @@
{
// Make sure we don't append things after :after-generated content if we have it.
if (!beforeChild)
- beforeChild = findAfterContentRenderer();
+ beforeChild = afterPseudoElementRenderer();
if (!child->isTableRow()) {
RenderObject* last = beforeChild;
