Title: [270309] branches/safari-610-branch/Source/WebCore
- Revision
- 270309
- Author
- [email protected]
- Date
- 2020-12-01 09:59:02 -0800 (Tue, 01 Dec 2020)
Log Message
Cherry-pick r269954. rdar://problem/71836563
RenderTreeBuilderBlock using an incorrect anonymous parent to attach a new renderer
https://bugs.webkit.org/show_bug.cgi?id=218505
Reviewed by Antti Koivisto.
Let's consider the following simplified render tree:
PARENT
|___beforeChildAnonymousContainer
|___hierarchy of anonymous blocks
|___beforeChild
When RenderTreeBuilderBlock is attaching a new renderer given PARENT and beforeChild, it first tries to attach it to the PARENT
if beforeChild is a direct child of PARENT. Otherwise it assumes that beforeChild is the direct child of an anonymous block which is
in between PARENT and beforeChild. However in some cases, as the one presented above, beforeChild might have a whole hierarchy of
anonymous blocks in between. That's why we cannot assume that beforeChild->parent() is a direct child of PARENT. Instead we should use
beforeChildAnonymousContainer as the parent of the new renderer.
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation): Use beforeChildAnonymousContainer instead of beforeChild->parent().
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@269954 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-610-branch/Source/WebCore/ChangeLog (270308 => 270309)
--- branches/safari-610-branch/Source/WebCore/ChangeLog 2020-12-01 17:58:46 UTC (rev 270308)
+++ branches/safari-610-branch/Source/WebCore/ChangeLog 2020-12-01 17:59:02 UTC (rev 270309)
@@ -1,5 +1,55 @@
2020-12-01 Alan Coon <[email protected]>
+ Cherry-pick r269954. rdar://problem/71836563
+
+ RenderTreeBuilderBlock using an incorrect anonymous parent to attach a new renderer
+ https://bugs.webkit.org/show_bug.cgi?id=218505
+
+ Reviewed by Antti Koivisto.
+
+ Let's consider the following simplified render tree:
+
+ PARENT
+ |___beforeChildAnonymousContainer
+ |___hierarchy of anonymous blocks
+ |___beforeChild
+
+ When RenderTreeBuilderBlock is attaching a new renderer given PARENT and beforeChild, it first tries to attach it to the PARENT
+ if beforeChild is a direct child of PARENT. Otherwise it assumes that beforeChild is the direct child of an anonymous block which is
+ in between PARENT and beforeChild. However in some cases, as the one presented above, beforeChild might have a whole hierarchy of
+ anonymous blocks in between. That's why we cannot assume that beforeChild->parent() is a direct child of PARENT. Instead we should use
+ beforeChildAnonymousContainer as the parent of the new renderer.
+
+ * rendering/updating/RenderTreeBuilderBlock.cpp:
+ (WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation): Use beforeChildAnonymousContainer instead of beforeChild->parent().
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@269954 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2020-11-17 Sergio Villar Senin <[email protected]>
+
+ RenderTreeBuilderBlock using an incorrect anonymous parent to attach a new renderer
+ https://bugs.webkit.org/show_bug.cgi?id=218505
+
+ Reviewed by Antti Koivisto.
+
+ Let's consider the following simplified render tree:
+
+ PARENT
+ |___beforeChildAnonymousContainer
+ |___hierarchy of anonymous blocks
+ |___beforeChild
+
+ When RenderTreeBuilderBlock is attaching a new renderer given PARENT and beforeChild, it first tries to attach it to the PARENT
+ if beforeChild is a direct child of PARENT. Otherwise it assumes that beforeChild is the direct child of an anonymous block which is
+ in between PARENT and beforeChild. However in some cases, as the one presented above, beforeChild might have a whole hierarchy of
+ anonymous blocks in between. That's why we cannot assume that beforeChild->parent() is a direct child of PARENT. Instead we should use
+ beforeChildAnonymousContainer as the parent of the new renderer.
+
+ * rendering/updating/RenderTreeBuilderBlock.cpp:
+ (WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation): Use beforeChildAnonymousContainer instead of beforeChild->parent().
+
+2020-12-01 Alan Coon <[email protected]>
+
Cherry-pick r269695. rdar://problem/71836652
Protect ScheduledURLNavigation member
Modified: branches/safari-610-branch/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp (270308 => 270309)
--- branches/safari-610-branch/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp 2020-12-01 17:58:46 UTC (rev 270308)
+++ branches/safari-610-branch/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp 2020-12-01 17:59:02 UTC (rev 270309)
@@ -186,8 +186,8 @@
#endif
) {
// Insert the child into the anonymous block box instead of here.
- if (child->isInline() || beforeChild->parent()->firstChild() != beforeChild)
- m_builder.attach(*beforeChild->parent(), WTFMove(child), beforeChild);
+ if (child->isInline() || beforeChildAnonymousContainer->firstChild() != beforeChild)
+ m_builder.attach(*beforeChildAnonymousContainer, WTFMove(child), beforeChild);
else
m_builder.attach(parent, WTFMove(child), beforeChild->parent());
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
