Title: [295191] branches/safari-613-branch
- Revision
- 295191
- Author
- [email protected]
- Date
- 2022-06-02 23:45:49 -0700 (Thu, 02 Jun 2022)
Log Message
Cherry-pick e9396cf1b69b. rdar://problem/92390285
Assertion in RenderTreeBuilder::attachToRenderElementInternal
https://bugs.webkit.org/show_bug.cgi?id=239823
<rdar://92390285>
Reviewed by Alan Bujtas.
* LayoutTests/fast/css/display-content-with-pending-stylesheet-crash-expected.txt: Added.
* LayoutTests/fast/css/display-content-with-pending-stylesheet-crash.html: Added.
* Source/WebCore/style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::resolveElement):
We can't skip resolution for elements that we have already computed style for. This includes elements with display:contents.
Canonical link: https://commits.webkit.org/251178@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@295083 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Added: branches/safari-613-branch/LayoutTests/fast/css/display-content-with-pending-stylesheet-crash-expected.txt (0 => 295191)
--- branches/safari-613-branch/LayoutTests/fast/css/display-content-with-pending-stylesheet-crash-expected.txt (rev 0)
+++ branches/safari-613-branch/LayoutTests/fast/css/display-content-with-pending-stylesheet-crash-expected.txt 2022-06-03 06:45:49 UTC (rev 295191)
@@ -0,0 +1,2 @@
+This test passes if it doesn't crash.
+
Added: branches/safari-613-branch/LayoutTests/fast/css/display-content-with-pending-stylesheet-crash.html (0 => 295191)
--- branches/safari-613-branch/LayoutTests/fast/css/display-content-with-pending-stylesheet-crash.html (rev 0)
+++ branches/safari-613-branch/LayoutTests/fast/css/display-content-with-pending-stylesheet-crash.html 2022-06-03 06:45:49 UTC (rev 295191)
@@ -0,0 +1,28 @@
+<style>
+ :nth-last-child(odd) {
+ display: contents;
+ }
+</style>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ _onload_ = () => {
+ let q0 = document.createElement('q');
+ document.body.append(q0);
+ let span0 = document.createElement('span');
+ q0.append(span0);
+ q0.append(document.createElement('div'));
+ span0.append(document.createElement('div'));
+ span0.append(document.createElement('div'));
+ document.body.offsetTop;
+ document.styleSheets[0].insertRule(`xx { yy: zz; }`);
+ let link0 = document.createElement('link');
+ link0.href = ""
+ link0.rel = 'stylesheet';
+ document.head.append(link0);
+ document.body.append(document.createElement('div'));
+ };
+</script>
+<body>
+This test passes if it doesn't crash.
+</body>
Modified: branches/safari-613-branch/Source/WebCore/style/StyleTreeResolver.cpp (295190 => 295191)
--- branches/safari-613-branch/Source/WebCore/style/StyleTreeResolver.cpp 2022-06-03 06:45:46 UTC (rev 295190)
+++ branches/safari-613-branch/Source/WebCore/style/StyleTreeResolver.cpp 2022-06-03 06:45:49 UTC (rev 295191)
@@ -199,7 +199,7 @@
ElementUpdates TreeResolver::resolveElement(Element& element)
{
- if (m_didSeePendingStylesheet && !element.renderer() && !m_document.isIgnoringPendingStylesheets()) {
+ if (m_didSeePendingStylesheet && !element.renderOrDisplayContentsStyle() && !m_document.isIgnoringPendingStylesheets()) {
m_document.setHasNodesWithMissingStyle();
return { };
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
