Title: [275761] trunk/Source/WebCore
- Revision
- 275761
- Author
- [email protected]
- Date
- 2021-04-09 06:48:31 -0700 (Fri, 09 Apr 2021)
Log Message
[RenderTreeBuilder] Cleanup the inline box wrappers when moving subtrees
https://bugs.webkit.org/show_bug.cgi?id=224342
<rdar://76349279>
Reviewed by Antti Koivisto.
When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should release its inline box wrapper. This inline box wrapper (e.g. InlineFlowBox)
will eventually be destroy during the subsequent line layout of the original BFC.
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::move):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (275760 => 275761)
--- trunk/Source/WebCore/ChangeLog 2021-04-09 13:25:32 UTC (rev 275760)
+++ trunk/Source/WebCore/ChangeLog 2021-04-09 13:48:31 UTC (rev 275761)
@@ -1,3 +1,17 @@
+2021-04-09 Zalan Bujtas <[email protected]>
+
+ [RenderTreeBuilder] Cleanup the inline box wrappers when moving subtrees
+ https://bugs.webkit.org/show_bug.cgi?id=224342
+ <rdar://76349279>
+
+ Reviewed by Antti Koivisto.
+
+ When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should release its inline box wrapper. This inline box wrapper (e.g. InlineFlowBox)
+ will eventually be destroy during the subsequent line layout of the original BFC.
+
+ * rendering/updating/RenderTreeBuilder.cpp:
+ (WebCore::RenderTreeBuilder::move):
+
2021-04-09 Carlos Garcia Campos <[email protected]>
[GTK][WPE] Bump libsoup3 version to 2.99.3
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp (275760 => 275761)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2021-04-09 13:25:32 UTC (rev 275760)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2021-04-09 13:48:31 UTC (rev 275761)
@@ -486,6 +486,12 @@
auto childToMove = detachFromRenderElement(from, child, WillBeDestroyed::No, RenderObject::IsInternalMove::Yes);
attachToRenderElementInternal(to, WTFMove(childToMove), beforeChild, RenderObject::IsInternalMove::Yes);
}
+ if (is<RenderInline>(child)) {
+ // When moving a subtree out of a BFC we need to make sure that the line boxes generated for the inline tree are not accessible anymore from the renderers.
+ // They eventually get destroyed during the inline layout of the original BFC.
+ for (auto& descendant : descendantsOfType<RenderBox>(downcast<RenderInline>(child)))
+ descendant.setInlineBoxWrapper(nullptr);
+ }
}
void RenderTreeBuilder::move(RenderBoxModelObject& from, RenderBoxModelObject& to, RenderObject& child, NormalizeAfterInsertion normalizeAfterInsertion)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
