Diff
Modified: trunk/LayoutTests/ChangeLog (107612 => 107613)
--- trunk/LayoutTests/ChangeLog 2012-02-13 22:25:37 UTC (rev 107612)
+++ trunk/LayoutTests/ChangeLog 2012-02-13 22:26:29 UTC (rev 107613)
@@ -1,3 +1,13 @@
+2012-02-13 Abhishek Arya <[email protected]>
+
+ Incorrect children placement in multi-column layout.
+ https://bugs.webkit.org/show_bug.cgi?id=78160
+
+ Reviewed by David Hyatt.
+
+ * fast/multicol/span/clone-before-after-content-crash-expected.txt: Added.
+ * fast/multicol/span/clone-before-after-content-crash.html: Added.
+
2012-02-13 Stephen White <[email protected]>
Unskip the css3/filters tests, so we can get some baselines off the
Added: trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash-expected.txt (0 => 107613)
--- trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash-expected.txt 2012-02-13 22:26:29 UTC (rev 107613)
@@ -0,0 +1,2 @@
+Test passes if it does not crash.
+
Added: trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash.html (0 => 107613)
--- trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash.html 2012-02-13 22:26:29 UTC (rev 107613)
@@ -0,0 +1,34 @@
+<html>
+ <head>
+ <style>
+ #test1 { -webkit-column-count: 1; }
+ #test2 { display: block; }
+ #test3::after { display: block; content: "A"; }
+ #test4 { -webkit-column-span: all; }
+ </style>
+ <script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+ function runTest(){
+ test1 = document.createElement('div');
+ test1.setAttribute('id', 'test1');
+ document.body.appendChild(test1);
+ test2 = document.createElement('div');
+ test2.setAttribute('id', 'test2');
+ test1.appendChild(test2);
+ test3 = document.createElement('div');
+ test3.setAttribute('id', 'test3');
+ test2.appendChild(test3);
+ test4 = document.createElement('span');
+ test4.setAttribute('id', 'test4');
+ test3.appendChild(test4);
+ document.body.offsetTop;
+ test4.style.display='block';
+ }
+ window._onload_ = runTest
+ </script>
+ </head>
+ <body>
+ Test passes if it does not crash.
+ </body>
+</html>
Property changes on: trunk/LayoutTests/fast/multicol/span/clone-before-after-content-crash.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (107612 => 107613)
--- trunk/Source/WebCore/ChangeLog 2012-02-13 22:25:37 UTC (rev 107612)
+++ trunk/Source/WebCore/ChangeLog 2012-02-13 22:26:29 UTC (rev 107613)
@@ -1,3 +1,29 @@
+2012-02-13 Abhishek Arya <[email protected]>
+
+ Incorrect children placement in multi-column layout.
+ https://bugs.webkit.org/show_bug.cgi?id=78160
+
+ Reviewed by David Hyatt.
+
+ Test: fast/multicol/span/clone-before-after-content-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::clone): no longer need to take care of making
+ children noninline (remove fix r105769) since moveChild functions take
+ care of adding the child properly if type of children differ. this
+ function just makes sure to set the right value of childrenInline property.
+ (WebCore::RenderBlock::splitBlocks): similar to moveChild functions below.
+ (WebCore::RenderBlock::moveChildTo): when child is fullRemoveInsert (across
+ different parents, e.g clones), we should use addChild function to make sure
+ it handles the case of different type of children between fromBlock and
+ toBlock correctly (specifically making children non-inline/wrapping inline
+ children under anonymous blocks.).
+ (WebCore::RenderBlock::moveChildrenTo):
+ * rendering/RenderBlock.h:
+ (RenderBlock):
+ (WebCore::RenderBlock::moveAllChildrenTo): Rename to->toBlock.
+ (WebCore::RenderBlock::moveChildrenTo): Rename to->toBlock.
+
2012-02-13 Stephen White <[email protected]>
[chromium] Implement Brightness and Contrast filters on composited
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (107612 => 107613)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-02-13 22:25:37 UTC (rev 107612)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-02-13 22:26:29 UTC (rev 107613)
@@ -447,15 +447,19 @@
RenderBlock* RenderBlock::clone() const
{
RenderBlock* cloneBlock;
- if (isAnonymousBlock())
+ if (isAnonymousBlock()) {
cloneBlock = createAnonymousBlock();
+ cloneBlock->setChildrenInline(childrenInline());
+ }
else {
cloneBlock = new (renderArena()) RenderBlock(node());
cloneBlock->setStyle(style());
- if (!childrenInline() && cloneBlock->firstChild() && cloneBlock->firstChild()->isInline())
- cloneBlock->makeChildrenNonInline();
+
+ // This takes care of setting the right value of childrenInline in case
+ // generated content is added to cloneBlock and 'this' does not have
+ // generated content added yet.
+ cloneBlock->setChildrenInline(cloneBlock->firstChild() ? cloneBlock->firstChild()->isInline() : childrenInline());
}
- cloneBlock->setChildrenInline(childrenInline());
return cloneBlock;
}
@@ -494,7 +498,7 @@
cloneBlock = blockCurr->clone();
// Insert our child clone as the first child.
- cloneBlock->children()->appendChildNode(cloneBlock, cloneChild);
+ cloneBlock->addChildIgnoringContinuation(cloneChild, 0);
// Hook the clone up as a continuation of |curr|. Note we do encounter
// anonymous blocks possibly as we walk up the block chain. When we split an
@@ -885,21 +889,31 @@
return rootBox;
}
-void RenderBlock::moveChildTo(RenderBlock* to, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
+void RenderBlock::moveChildTo(RenderBlock* toBlock, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
{
ASSERT(this == child->parent());
- ASSERT(!beforeChild || to == beforeChild->parent());
- to->children()->insertChildNode(to, children()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
+ ASSERT(!beforeChild || toBlock == beforeChild->parent());
+ if (fullRemoveInsert) {
+ // Takes care of adding the new child correctly if toBlock and fromBlock
+ // have different kind of children (block vs inline).
+ toBlock->addChildIgnoringContinuation(children()->removeChildNode(this, child), beforeChild);
+ } else
+ toBlock->children()->insertChildNode(toBlock, children()->removeChildNode(this, child, false), beforeChild, false);
}
-void RenderBlock::moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
+void RenderBlock::moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert)
{
- ASSERT(!beforeChild || to == beforeChild->parent());
+ ASSERT(!beforeChild || toBlock == beforeChild->parent());
RenderObject* nextChild = startChild;
while (nextChild && nextChild != endChild) {
RenderObject* child = nextChild;
nextChild = child->nextSibling();
- to->children()->insertChildNode(to, children()->removeChildNode(this, child, fullRemoveInsert), beforeChild, fullRemoveInsert);
+ if (fullRemoveInsert) {
+ // Takes care of adding the new child correctly if toBlock and fromBlock
+ // have different kind of children (block vs inline).
+ toBlock->addChildIgnoringContinuation(children()->removeChildNode(this, child), beforeChild);
+ } else
+ toBlock->children()->insertChildNode(toBlock, children()->removeChildNode(this, child, false), beforeChild, false);
if (child == endChild)
return;
}
Modified: trunk/Source/WebCore/rendering/RenderBlock.h (107612 => 107613)
--- trunk/Source/WebCore/rendering/RenderBlock.h 2012-02-13 22:25:37 UTC (rev 107612)
+++ trunk/Source/WebCore/rendering/RenderBlock.h 2012-02-13 22:26:29 UTC (rev 107613)
@@ -365,22 +365,22 @@
{
return moveChildTo(to, child, 0, fullRemoveInsert);
}
- void moveChildTo(RenderBlock* to, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
- void moveAllChildrenTo(RenderBlock* to, bool fullRemoveInsert = false)
+ void moveChildTo(RenderBlock* toBlock, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert = false);
+ void moveAllChildrenTo(RenderBlock* toBlock, bool fullRemoveInsert = false)
{
- return moveAllChildrenTo(to, 0, fullRemoveInsert);
+ return moveAllChildrenTo(toBlock, 0, fullRemoveInsert);
}
- void moveAllChildrenTo(RenderBlock* to, RenderObject* beforeChild, bool fullRemoveInsert = false)
+ void moveAllChildrenTo(RenderBlock* toBlock, RenderObject* beforeChild, bool fullRemoveInsert = false)
{
- return moveChildrenTo(to, firstChild(), 0, beforeChild, fullRemoveInsert);
+ return moveChildrenTo(toBlock, firstChild(), 0, beforeChild, fullRemoveInsert);
}
// Move all of the kids from |startChild| up to but excluding |endChild|. 0 can be passed as the endChild to denote
// that all the kids from |startChild| onwards should be added.
- void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
+ void moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, bool fullRemoveInsert = false)
{
- return moveChildrenTo(to, startChild, endChild, 0, fullRemoveInsert);
+ return moveChildrenTo(toBlock, startChild, endChild, 0, fullRemoveInsert);
}
- void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
+ void moveChildrenTo(RenderBlock* toBlock, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
LayoutUnit maxPositiveMarginBefore() const { return m_rareData ? m_rareData->m_margins.positiveMarginBefore() : RenderBlockRareData::positiveMarginBeforeDefault(this); }
LayoutUnit maxNegativeMarginBefore() const { return m_rareData ? m_rareData->m_margins.negativeMarginBefore() : RenderBlockRareData::negativeMarginBeforeDefault(this); }
