Title: [126063] trunk
- Revision
- 126063
- Author
- [email protected]
- Date
- 2012-08-20 14:02:32 -0700 (Mon, 20 Aug 2012)
Log Message
Line boxes not being dirtied correctly during inline removal
https://bugs.webkit.org/show_bug.cgi?id=93156
Reviewed by David Hyatt.
Source/WebCore:
When two inline objects were being removed from different lineboxes
in an ancestral RenderBlock, the way the RenderBlock was being marked
prevented the second linebox from being marked dirty. This causes
it to not get layout in the subsequent layout pass.
This patch causes only the descendants corresponding to actual changed
lineboxes to have their ancestorLineBoxDirty bit set, rather than
the RenderBlock that contains the lineboxes themselves.
* rendering/RenderLineBoxList.cpp:
(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
LayoutTests:
Test exercising crashing condition for bug 93156.
* fast/block/line-layout/double-line-break-obj-removal-crash.html: Added
* fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt: Added
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (126062 => 126063)
--- trunk/LayoutTests/ChangeLog 2012-08-20 20:59:47 UTC (rev 126062)
+++ trunk/LayoutTests/ChangeLog 2012-08-20 21:02:32 UTC (rev 126063)
@@ -1,3 +1,14 @@
+2012-08-20 Ken Buchanan <[email protected]>
+ Line boxes not being dirtied correctly during inline removal
+ https://bugs.webkit.org/show_bug.cgi?id=93156
+
+ Reviewed by David Hyatt.
+
+ Test exercising crashing condition for bug 93156.
+
+ * fast/block/line-layout/double-line-break-obj-removal-crash.html: Added
+ * fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt: Added
+
2012-08-20 Bruno de Oliveira Abinader <[email protected]>
[css3-text] Add getComputedStyle tests for -webkit-text-decoration-line
Added: trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt (0 => 126063)
--- trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash-expected.txt 2012-08-20 21:02:32 UTC (rev 126063)
@@ -0,0 +1 @@
+PASS if no crash or assert in debug
Added: trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html (0 => 126063)
--- trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html (rev 0)
+++ trunk/LayoutTests/fast/block/line-layout/double-line-break-obj-removal-crash.html 2012-08-20 21:02:32 UTC (rev 126063)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<multicol id=multicolElem style="margin: 0em 61692em 21850.5357359em 47804em; "></multicol><emph><a id=anchorElem><bdo id=tCF30></a><tdx>a b c</tdx><media><span id=spanElem></media><fig style='right: 5174624300.52mm; float:right;'></fig><dt><body style='border: 2270.47629379in dashed cadetblue; '><summary id=summaryElem></body>
+
+<script>
+window._onload_ = function() {
+ document.body.offsetTop;
+ multicolElem.style.display = "table"
+ summaryElem.appendChild(anchorElem);
+ tCF30.appendChild(spanElem);
+ document.body.offsetTop;
+ multicolElem.parentNode.removeChild(multicolElem);
+ document.body.offsetTop;
+ document.body.innerHTML = 'PASS if no crash or assert in debug';
+ if (window.testRunner)
+ testRunner.dumpAsText();
+}
+</script>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (126062 => 126063)
--- trunk/Source/WebCore/ChangeLog 2012-08-20 20:59:47 UTC (rev 126062)
+++ trunk/Source/WebCore/ChangeLog 2012-08-20 21:02:32 UTC (rev 126063)
@@ -1,3 +1,21 @@
+2012-08-20 Ken Buchanan <[email protected]>
+ Line boxes not being dirtied correctly during inline removal
+ https://bugs.webkit.org/show_bug.cgi?id=93156
+
+ Reviewed by David Hyatt.
+
+ When two inline objects were being removed from different lineboxes
+ in an ancestral RenderBlock, the way the RenderBlock was being marked
+ prevented the second linebox from being marked dirty. This causes
+ it to not get layout in the subsequent layout pass.
+
+ This patch causes only the descendants corresponding to actual changed
+ lineboxes to have their ancestorLineBoxDirty bit set, rather than
+ the RenderBlock that contains the lineboxes themselves.
+
+ * rendering/RenderLineBoxList.cpp:
+ (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+
2012-08-20 John Mellor <[email protected]>
Text Autosizing: Only take into account block width <= document layout width.
Modified: trunk/Source/WebCore/rendering/RenderLineBoxList.cpp (126062 => 126063)
--- trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2012-08-20 20:59:47 UTC (rev 126062)
+++ trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2012-08-20 21:02:32 UTC (rev 126063)
@@ -321,7 +321,7 @@
if (!firstBox) {
// For an empty inline, go ahead and propagate the check up to our parent, unless the parent
// is already dirty.
- if (container->isInline() && !container->parent()->ancestorLineBoxDirty()) {
+ if (container->isInline() && !container->ancestorLineBoxDirty()) {
container->parent()->dirtyLinesFromChangedChild(container);
container->setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
}
@@ -361,7 +361,7 @@
// we won't find a previous sibling, but firstBox can be pointing to a following sibling.
// This isn't good enough, since we won't locate the root line box that encloses the removed
// <br>. We have to just over-invalidate a bit and go up to our parent.
- if (!inlineContainer->parent()->ancestorLineBoxDirty()) {
+ if (!inlineContainer->ancestorLineBoxDirty()) {
inlineContainer->parent()->dirtyLinesFromChangedChild(inlineContainer);
inlineContainer->setAncestorLineBoxDirty(); // Mark the container to avoid dirtying the same lines again across multiple destroy() calls of the same subtree.
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
