Title: [294736] trunk
- Revision
- 294736
- Author
- [email protected]
- Date
- 2022-05-23 23:00:48 -0700 (Mon, 23 May 2022)
Log Message
REGRESSION (r294291): Another nullptr crash with ::first-letter
https://bugs.webkit.org/show_bug.cgi?id=240795
<rdar://93645746>
Reviewed by Alan Bujtas.
* LayoutTests/fast/css/first-letter-remove-crash-expected.txt: Added.
* LayoutTests/fast/css/first-letter-remove-crash.html: Added.
* LayoutTests/fast/css/first-letter-removed-added-expected.txt:
* Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::updateStyle):
We should always find :first-letter style when we get here.
* Source/WebCore/style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::resolveElement):
Rebuild the renderer subtree if ::first-letter pseudo-class stops applying.
Canonical link: https://commits.webkit.org/250908@main
Modified Paths
Added Paths
Diff
Added: trunk/LayoutTests/fast/css/first-letter-remove-crash-expected.txt (0 => 294736)
--- trunk/LayoutTests/fast/css/first-letter-remove-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css/first-letter-remove-crash-expected.txt 2022-05-24 06:00:48 UTC (rev 294736)
@@ -0,0 +1 @@
+aa
Added: trunk/LayoutTests/fast/css/first-letter-remove-crash.html (0 => 294736)
--- trunk/LayoutTests/fast/css/first-letter-remove-crash.html (rev 0)
+++ trunk/LayoutTests/fast/css/first-letter-remove-crash.html 2022-05-24 06:00:48 UTC (rev 294736)
@@ -0,0 +1,17 @@
+<style>
+ html::first-letter {
+ width: 0;
+ }
+</style>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ _onload_ = () => {
+ document.execCommand('SelectAll');
+ document.body.append('aa');
+ document.documentElement.append('');
+ document.body.offsetTop;
+ document.body.style.overflow = 'clip';
+ };
+</script>
+
Modified: trunk/LayoutTests/fast/css/first-letter-removed-added-expected.txt (294735 => 294736)
--- trunk/LayoutTests/fast/css/first-letter-removed-added-expected.txt 2022-05-24 05:38:14 UTC (rev 294735)
+++ trunk/LayoutTests/fast/css/first-letter-removed-added-expected.txt 2022-05-24 06:00:48 UTC (rev 294736)
@@ -34,7 +34,7 @@
FAIL document.getElementById('test4').offsetWidth == document.getElementById('ref4').offsetWidth should be true. Was false.
PASS document.getElementById('test5').offsetWidth == document.getElementById('ref5').offsetWidth is true
PASS document.getElementById('test6').offsetWidth == document.getElementById('ref6').offsetWidth is true
-FAIL document.getElementById('test7').offsetWidth == document.getElementById('ref7').offsetWidth should be true. Was false.
+PASS document.getElementById('test7').offsetWidth == document.getElementById('ref7').offsetWidth is true
PASS document.getElementById('test8').offsetWidth == document.getElementById('ref8').offsetWidth is true
PASS successfullyParsed is true
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp (294735 => 294736)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp 2022-05-24 05:38:14 UTC (rev 294735)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp 2022-05-24 06:00:48 UTC (rev 294736)
@@ -175,7 +175,7 @@
auto pseudoStyle = styleForFirstLetter(firstLetterContainer);
if (!pseudoStyle) {
- m_builder.destroy(*firstLetter, CanCollapseAnonymousBlock::No);
+ ASSERT_NOT_REACHED();
return;
}
Modified: trunk/Source/WebCore/style/StyleTreeResolver.cpp (294735 => 294736)
--- trunk/Source/WebCore/style/StyleTreeResolver.cpp 2022-05-24 05:38:14 UTC (rev 294735)
+++ trunk/Source/WebCore/style/StyleTreeResolver.cpp 2022-05-24 06:00:48 UTC (rev 294736)
@@ -261,10 +261,17 @@
auto resolveAndAddPseudoElementStyle = [&](PseudoId pseudoId) {
auto pseudoElementUpdate = resolvePseudoElement(element, pseudoId, update);
+ auto pseudoElementChange = [&] {
+ if (pseudoElementUpdate)
+ return pseudoElementUpdate->change == Change::None ? Change::None : Change::NonInherited;
+ if (!existingStyle || !existingStyle->getCachedPseudoStyle(pseudoId))
+ return Change::None;
+ // If ::first-letter goes aways rebuild the renderers.
+ return pseudoId == PseudoId::FirstLetter ? Change::Renderer : Change::NonInherited;
+ }();
+ update.change = std::max(update.change, pseudoElementChange);
if (!pseudoElementUpdate)
- return Change::None;
- if (pseudoElementUpdate->change != Change::None)
- update.change = std::max(update.change, Change::NonInherited);
+ return pseudoElementChange;
if (pseudoElementUpdate->recompositeLayer)
update.recompositeLayer = true;
update.style->addCachedPseudoStyle(WTFMove(pseudoElementUpdate->style));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
