Title: [282506] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 282506
- Author
- [email protected]
- Date
- 2021-09-16 01:31:45 -0700 (Thu, 16 Sep 2021)
Log Message
Merge r276014 - [RenderTreeBuilder] Cleanup the inline tree when moving subtrees
https://bugs.webkit.org/show_bug.cgi?id=224342
<rdar://76349279>
Reviewed by Antti Koivisto.
When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should be invalidated. The safest way to do this is
to destroy the inline tree (the "subtree moving" will eventually be replaced by "destroy followed by construct" activity).
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::move):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (282505 => 282506)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 08:26:42 UTC (rev 282505)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 08:31:45 UTC (rev 282506)
@@ -1,3 +1,17 @@
+2021-04-15 Zalan Bujtas <[email protected]>
+
+ [RenderTreeBuilder] Cleanup the inline tree when moving subtrees
+ https://bugs.webkit.org/show_bug.cgi?id=224342
+ <rdar://76349279>
+
+ Reviewed by Antti Koivisto.
+
+ When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should be invalidated. The safest way to do this is
+ to destroy the inline tree (the "subtree moving" will eventually be replaced by "destroy followed by construct" activity).
+
+ * rendering/updating/RenderTreeBuilder.cpp:
+ (WebCore::RenderTreeBuilder::move):
+
2021-04-15 Carlos Garcia Campos <[email protected]>
REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp (282505 => 282506)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2021-09-16 08:26:42 UTC (rev 282505)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2021-09-16 08:31:45 UTC (rev 282506)
@@ -484,6 +484,22 @@
auto childToMove = detachFromRenderElement(from, child);
attachToRenderElementInternal(to, WTFMove(childToMove), beforeChild, ReinsertAfterMove::Yes);
}
+
+ auto findBFCRootAndDestroyInlineTree = [&] {
+ auto* containingBlock = &from;
+ while (containingBlock) {
+ containingBlock->setNeedsLayout();
+ if (is<RenderBlockFlow>(*containingBlock)) {
+ downcast<RenderBlockFlow>(*containingBlock).deleteLines();
+ break;
+ }
+ containingBlock = containingBlock->containingBlock();
+ }
+ };
+ // When moving a subtree out of a BFC we need to make sure that the line boxes generated for the inline tree are not accessible anymore from the renderers.
+ // Let's find the BFC root and nuke the inline tree (At some point we are going to destroy the subtree instead of moving these renderers around.)
+ if (is<RenderInline>(child))
+ findBFCRootAndDestroyInlineTree();
}
void RenderTreeBuilder::move(RenderBoxModelObject& from, RenderBoxModelObject& to, RenderObject& child, NormalizeAfterInsertion normalizeAfterInsertion)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
