Title: [274039] trunk
- Revision
- 274039
- Author
- [email protected]
- Date
- 2021-03-06 10:21:25 -0800 (Sat, 06 Mar 2021)
Log Message
[RenderTreeBuilder] Invalidate beforeChild when parent changes to RubyBase
https://bugs.webkit.org/show_bug.cgi?id=222862
<rdar://problem/73659871>
Reviewed by Antti Koivisto.
Source/WebCore:
The beforeChild value becomes invalid when the ruby subtree requires a ruby base and the child is going to
be attached under this newly constrcuted ruby base (the child and the beforeChild will not end up in the same subtree).
Test: fast/ruby/crash-when-attaching-to-base.html
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::attach):
LayoutTests:
* fast/ruby/crash-when-attaching-to-base-expected.txt: Added.
* fast/ruby/crash-when-attaching-to-base.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (274038 => 274039)
--- trunk/LayoutTests/ChangeLog 2021-03-06 16:28:25 UTC (rev 274038)
+++ trunk/LayoutTests/ChangeLog 2021-03-06 18:21:25 UTC (rev 274039)
@@ -1,3 +1,14 @@
+2021-03-06 Zalan Bujtas <[email protected]>
+
+ [RenderTreeBuilder] Invalidate beforeChild when parent changes to RubyBase
+ https://bugs.webkit.org/show_bug.cgi?id=222862
+ <rdar://problem/73659871>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/ruby/crash-when-attaching-to-base-expected.txt: Added.
+ * fast/ruby/crash-when-attaching-to-base.html: Added.
+
2021-03-06 Antoine Quint <[email protected]>
Improve blending of Length and other Length-related types
Added: trunk/LayoutTests/fast/ruby/crash-when-attaching-to-base-expected.txt (0 => 274039)
--- trunk/LayoutTests/fast/ruby/crash-when-attaching-to-base-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/ruby/crash-when-attaching-to-base-expected.txt 2021-03-06 18:21:25 UTC (rev 274039)
@@ -0,0 +1 @@
+PASS if no crash or assert
Added: trunk/LayoutTests/fast/ruby/crash-when-attaching-to-base.html (0 => 274039)
--- trunk/LayoutTests/fast/ruby/crash-when-attaching-to-base.html (rev 0)
+++ trunk/LayoutTests/fast/ruby/crash-when-attaching-to-base.html 2021-03-06 18:21:25 UTC (rev 274039)
@@ -0,0 +1,19 @@
+<style>
+rt, embed {
+ height: 4px;
+ line-height: 100vh;
+}
+</style>
+
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+window.addEventListener("load", function () {
+ document.body.offsetHeight;
+ document.all[6].appendChild(rt);
+ document.body.offsetHeight;
+ appendToThis.appendChild(rt);
+});
+</script><rt id=rt>PASS if no crash or assert</rt><ruby id=foo><span id=appendToThis></span><embed type="unspecified"></embed>
+</ruby>
Modified: trunk/Source/WebCore/ChangeLog (274038 => 274039)
--- trunk/Source/WebCore/ChangeLog 2021-03-06 16:28:25 UTC (rev 274038)
+++ trunk/Source/WebCore/ChangeLog 2021-03-06 18:21:25 UTC (rev 274039)
@@ -1,3 +1,19 @@
+2021-03-06 Zalan Bujtas <[email protected]>
+
+ [RenderTreeBuilder] Invalidate beforeChild when parent changes to RubyBase
+ https://bugs.webkit.org/show_bug.cgi?id=222862
+ <rdar://problem/73659871>
+
+ Reviewed by Antti Koivisto.
+
+ The beforeChild value becomes invalid when the ruby subtree requires a ruby base and the child is going to
+ be attached under this newly constrcuted ruby base (the child and the beforeChild will not end up in the same subtree).
+
+ Test: fast/ruby/crash-when-attaching-to-base.html
+
+ * rendering/updating/RenderTreeBuilderRuby.cpp:
+ (WebCore::RenderTreeBuilder::Ruby::attach):
+
2021-03-06 Antoine Quint <[email protected]>
Improve blending of Length and other Length-related types
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp (274038 => 274039)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp 2021-03-06 16:28:25 UTC (rev 274038)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp 2021-03-06 18:21:25 UTC (rev 274039)
@@ -240,9 +240,14 @@
return;
}
// child is not a text -> insert it into the base
- // (append it instead if beforeChild is the ruby text)
- if (beforeChild && beforeChild->isRubyText())
+ if (beforeChild && beforeChild->isRubyText()) {
+ // Append it instead if beforeChild is the ruby text.
beforeChild = nullptr;
+ }
+ if (!parent.hasRubyBase()) {
+ // Child is going to be attached to the newly constructed ruby base.
+ beforeChild = nullptr;
+ }
m_builder.attach(rubyBaseSafe(parent), WTFMove(child), beforeChild);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
