Title: [274630] trunk/Source/WebCore
- Revision
- 274630
- Author
- [email protected]
- Date
- 2021-03-18 03:10:14 -0700 (Thu, 18 Mar 2021)
Log Message
Invalidate RenderTreePosition's next sibling with display:contents
https://bugs.webkit.org/show_bug.cgi?id=218578
Reviewed by Antti Koivisto.
When inserting elements in the tree from JS it might happen that the renderTreePosition() in the RenderTreeUpdater
caches a nextSibling() value which is only temporarily correct because we sequentially process the descendants of a
given root node in RenderTreeUpdater::updateRenderTree(). One of those potentially incorrect scenarios is when
using display:contents. We can detect those cases because we would leave a parent element in RenderTreeUpdater::popParent()
without changing renderingParent() and so without changing renderTreePosition(). Once we are in that situation we
must invalidate the cached position so the next sibling is recomputed.
* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::popParent): Invalidate the render tree position's next sibling if the parent element is not
the renderingParent().
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (274629 => 274630)
--- trunk/Source/WebCore/ChangeLog 2021-03-18 09:49:36 UTC (rev 274629)
+++ trunk/Source/WebCore/ChangeLog 2021-03-18 10:10:14 UTC (rev 274630)
@@ -1,3 +1,21 @@
+2021-02-26 Sergio Villar Senin <[email protected]>
+
+ Invalidate RenderTreePosition's next sibling with display:contents
+ https://bugs.webkit.org/show_bug.cgi?id=218578
+
+ Reviewed by Antti Koivisto.
+
+ When inserting elements in the tree from JS it might happen that the renderTreePosition() in the RenderTreeUpdater
+ caches a nextSibling() value which is only temporarily correct because we sequentially process the descendants of a
+ given root node in RenderTreeUpdater::updateRenderTree(). One of those potentially incorrect scenarios is when
+ using display:contents. We can detect those cases because we would leave a parent element in RenderTreeUpdater::popParent()
+ without changing renderingParent() and so without changing renderTreePosition(). Once we are in that situation we
+ must invalidate the cached position so the next sibling is recomputed.
+
+ * rendering/updating/RenderTreeUpdater.cpp:
+ (WebCore::RenderTreeUpdater::popParent): Invalidate the render tree position's next sibling if the parent element is not
+ the renderingParent().
+
2021-03-18 Carlos Garcia Campos <[email protected]>
Pagination mode: Increase the amount of recursions allowed by RenderTable::layout()
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp (274629 => 274630)
--- trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2021-03-18 09:49:36 UTC (rev 274629)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp 2021-03-18 10:10:14 UTC (rev 274630)
@@ -237,6 +237,9 @@
if (parent.element)
updateAfterDescendants(*parent.element, parent.updates);
+ if (&parent != &renderingParent())
+ renderTreePosition().invalidateNextSibling();
+
m_parentStack.removeLast();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
