- Revision
- 126071
- Author
- [email protected]
- Date
- 2012-08-20 14:32:03 -0700 (Mon, 20 Aug 2012)
Log Message
RenderGrid children should always be RenderBoxes
https://bugs.webkit.org/show_bug.cgi?id=94305
Reviewed by Abhishek Arya.
Source/WebCore:
During RenderGrid::layout, we assume all the children are RenderBoxes.
When removing children, if the last child is an anonymous block, we don't
want to remove the anonymous block for grids. Ensure this doesn't happen
by adding canCollapseAnonymousBlockChild to RenderBlock (flexboxen and
grid can override this method).
Test: fast/css-grid-layout/should-not-collapse-anonymous-blocks.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::removeChild): Check canCollapseAnonymousBlockChild().
* rendering/RenderBlock.h:
(WebCore::RenderBlock::canCollapseAnonymousBlockChild):
(RenderBlock):
* rendering/RenderDeprecatedFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
* rendering/RenderFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
* rendering/RenderGrid.h: canCollapseAnonymousBlockChild returns false.
LayoutTests:
Add test case from fuzzer.
* fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt: Added.
* fast/css-grid-layout/should-not-collapse-anonymous-blocks.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (126070 => 126071)
--- trunk/LayoutTests/ChangeLog 2012-08-20 21:30:38 UTC (rev 126070)
+++ trunk/LayoutTests/ChangeLog 2012-08-20 21:32:03 UTC (rev 126071)
@@ -1,3 +1,15 @@
+2012-08-20 Tony Chang <[email protected]>
+
+ RenderGrid children should always be RenderBoxes
+ https://bugs.webkit.org/show_bug.cgi?id=94305
+
+ Reviewed by Abhishek Arya.
+
+ Add test case from fuzzer.
+
+ * fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt: Added.
+ * fast/css-grid-layout/should-not-collapse-anonymous-blocks.html: Added.
+
2012-08-20 Kenneth Russell <[email protected]>
Unreviewed, rolling out r126026.
Added: trunk/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt (0 => 126071)
--- trunk/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt 2012-08-20 21:32:03 UTC (rev 126071)
@@ -0,0 +1,3 @@
+This test passes if it does not crash.
+
+
Added: trunk/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks.html (0 => 126071)
--- trunk/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks.html (rev 0)
+++ trunk/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks.html 2012-08-20 21:32:03 UTC (rev 126071)
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.testRunner) {
+ testRunner.overridePreference("WebKitCSSGridLayoutEnabled", 1);
+ testRunner.dumpAsText();
+}
+</script>
+<style>
+#a:nth-last-child(-n+2) {
+ -webkit-flow-into: body;
+}
+</style>
+<body>
+<p>This test passes if it does not crash.</p>
+<div style="display: -webkit-grid;">
+ <div id=a></div>
+ <div style="display: inline; "></div>
+</div>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (126070 => 126071)
--- trunk/Source/WebCore/ChangeLog 2012-08-20 21:30:38 UTC (rev 126070)
+++ trunk/Source/WebCore/ChangeLog 2012-08-20 21:32:03 UTC (rev 126071)
@@ -1,3 +1,27 @@
+2012-08-20 Tony Chang <[email protected]>
+
+ RenderGrid children should always be RenderBoxes
+ https://bugs.webkit.org/show_bug.cgi?id=94305
+
+ Reviewed by Abhishek Arya.
+
+ During RenderGrid::layout, we assume all the children are RenderBoxes.
+ When removing children, if the last child is an anonymous block, we don't
+ want to remove the anonymous block for grids. Ensure this doesn't happen
+ by adding canCollapseAnonymousBlockChild to RenderBlock (flexboxen and
+ grid can override this method).
+
+ Test: fast/css-grid-layout/should-not-collapse-anonymous-blocks.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::removeChild): Check canCollapseAnonymousBlockChild().
+ * rendering/RenderBlock.h:
+ (WebCore::RenderBlock::canCollapseAnonymousBlockChild):
+ (RenderBlock):
+ * rendering/RenderDeprecatedFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
+ * rendering/RenderFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
+ * rendering/RenderGrid.h: canCollapseAnonymousBlockChild returns false.
+
2012-08-20 Kenneth Russell <[email protected]>
Unreviewed, rolling out r126026.
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (126070 => 126071)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-08-20 21:30:38 UTC (rev 126070)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-08-20 21:32:03 UTC (rev 126071)
@@ -1213,12 +1213,12 @@
RenderBox::removeChild(oldChild);
RenderObject* child = prev ? prev : next;
- if (canMergeAnonymousBlocks && child && !child->previousSibling() && !child->nextSibling() && !isFlexibleBoxIncludingDeprecated()) {
+ if (canMergeAnonymousBlocks && child && !child->previousSibling() && !child->nextSibling() && canCollapseAnonymousBlockChild()) {
// The removal has knocked us down to containing only a single anonymous
// box. We can go ahead and pull the content right back up into our
// box.
collapseAnonymousBoxChild(this, child);
- } else if (((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) && !isFlexibleBoxIncludingDeprecated()) {
+ } else if (((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) && canCollapseAnonymousBlockChild()) {
// It's possible that the removal has knocked us down to a single anonymous
// block with pseudo-style element siblings (e.g. first-letter). If these
// are floating, then we need to pull the content up also.
Modified: trunk/Source/WebCore/rendering/RenderBlock.h (126070 => 126071)
--- trunk/Source/WebCore/rendering/RenderBlock.h 2012-08-20 21:30:38 UTC (rev 126070)
+++ trunk/Source/WebCore/rendering/RenderBlock.h 2012-08-20 21:32:03 UTC (rev 126071)
@@ -985,6 +985,8 @@
virtual bool recomputeLogicalWidth();
+ virtual bool canCollapseAnonymousBlockChild() const { return true; }
+
public:
LayoutUnit offsetFromLogicalTopOfFirstPage() const;
RenderRegion* regionAtBlockOffset(LayoutUnit) const;
Modified: trunk/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h (126070 => 126071)
--- trunk/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h 2012-08-20 21:30:38 UTC (rev 126070)
+++ trunk/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h 2012-08-20 21:32:03 UTC (rev 126071)
@@ -47,9 +47,9 @@
void layoutVerticalBox(bool relayoutChildren);
virtual bool avoidsFloats() const { return true; }
-
virtual bool isDeprecatedFlexibleBox() const { return true; }
virtual bool isStretchingChildren() const { return m_stretchingChildren; }
+ virtual bool canCollapseAnonymousBlockChild() const OVERRIDE { return false; }
void placeChild(RenderBox* child, const LayoutPoint& location);
Modified: trunk/Source/WebCore/rendering/RenderFlexibleBox.h (126070 => 126071)
--- trunk/Source/WebCore/rendering/RenderFlexibleBox.h 2012-08-20 21:30:38 UTC (rev 126070)
+++ trunk/Source/WebCore/rendering/RenderFlexibleBox.h 2012-08-20 21:32:03 UTC (rev 126071)
@@ -45,6 +45,7 @@
virtual bool isFlexibleBox() const OVERRIDE { return true; }
virtual bool avoidsFloats() const OVERRIDE { return true; }
+ virtual bool canCollapseAnonymousBlockChild() const OVERRIDE { return false; }
virtual void computePreferredLogicalWidths() OVERRIDE;
virtual void layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight = 0) OVERRIDE;
Modified: trunk/Source/WebCore/rendering/RenderGrid.h (126070 => 126071)
--- trunk/Source/WebCore/rendering/RenderGrid.h 2012-08-20 21:30:38 UTC (rev 126070)
+++ trunk/Source/WebCore/rendering/RenderGrid.h 2012-08-20 21:32:03 UTC (rev 126071)
@@ -41,6 +41,7 @@
virtual void computePreferredLogicalWidths() OVERRIDE;
virtual bool avoidsFloats() const OVERRIDE { return true; }
+ virtual bool canCollapseAnonymousBlockChild() const OVERRIDE { return false; }
private:
class GridTrack;
