Diff
Modified: branches/safari-536.28-branch/LayoutTests/ChangeLog (133071 => 133072)
--- branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-10-31 20:45:46 UTC (rev 133072)
@@ -1,5 +1,31 @@
2012-10-31 Lucas Forschler <[email protected]>
+ Merge r117865
+
+ 2012-05-21 Abhishek Arya <[email protected]>
+
+ Regression(r117482): Run-in crashes relating to generated content and inline line box clearing.
+ https://bugs.webkit.org/show_bug.cgi?id=86879
+
+ Reviewed by Julien Chaffraix.
+
+ These tests need to show dump render tree to show the correct location of run-in placement. All
+ renderings match IE and Opera.
+
+ * fast/lists/parent-box-not-box-crash-expected.txt: Rebaselined, since now run-in functions correctly
+ by being the first child before list marker.
+ * fast/runin/generated-content-crash-expected.png: Added.
+ * fast/runin/generated-content-crash-expected.txt: Added.
+ * fast/runin/generated-content-crash.html: Added.
+ * fast/runin/move-run-in-original-position-crash-expected.png: Added.
+ * fast/runin/move-run-in-original-position-crash-expected.txt: Added.
+ * fast/runin/move-run-in-original-position-crash.html: Added.
+ * fast/runin/runin-between-list-marker-and-before-content-expected.png:
+ * fast/runin/runin-between-list-marker-and-before-content-expected.txt: Rebaselined, since now run-in
+ functions correctly by being the first child before list marker.
+
+2012-10-31 Lucas Forschler <[email protected]>
+
Merge r117482
2012-05-17 Abhishek Arya <[email protected]>
@@ -10430,3 +10456,4 @@
.
.
.
+.
Modified: branches/safari-536.28-branch/LayoutTests/fast/lists/parent-box-not-box-crash-expected.txt (133071 => 133072)
--- branches/safari-536.28-branch/LayoutTests/fast/lists/parent-box-not-box-crash-expected.txt 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/LayoutTests/fast/lists/parent-box-not-box-crash-expected.txt 2012-10-31 20:45:46 UTC (rev 133072)
@@ -1,2 +1,2 @@
-PASS
+PASS
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash-expected.png (from rev 117865, trunk/LayoutTests/fast/runin/generated-content-crash-expected.png) (0 => 133072)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash-expected.png (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash-expected.png 2012-10-31 20:45:46 UTC (rev 133072)
@@ -0,0 +1,7 @@
+\x89PNG
+
+
+IHDR X \x9Av\x82p )tEXtchecksum 9e08b63e880aa71dd703fd69ad12c26e\x99?\xC5 \xB3IDATx\x9C\xED\xDD1r\xC2@ A\xCB\xC5W\xFCN\x8Ew\xF2\x98u\xE81¨;V\xDDm)\x9B\xDA\x99/ \x80\xC0\xF7\xD1 \xE7!@ \x80\x8C 2 \xC8 #@ \x80\x8C 2\x97G ܶ[1\xC7\xE9]\xE7z\xF4 \xF0r6 @F\x80 d \x90 @F\x80 d \x90 @\xE6\xE1K\xE8\xCFZk\xEDu\xD4G\xF1_ \xE0\x8F
+ \x90 @F\x80 d \x90 @F\x80 d \x90\xD9\xED%\xF4g\xCDO}\xE3kl\xF7\xA3' \x80\xFF\xC7 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8\\xEA \xB7{}# \xF0.l@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\xCCn/\xA1\xAF\xB5\xF6:
+ \xF8P6 @F\x80 d \x90 @F\x80 d \x90 @f\x9B\x999z \xE0 l@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\x8C 2 \xC8 #@ \x80\xCC/\xA1\xE9
+>L; IEND\xAEB`\x82
\ No newline at end of file
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash-expected.txt (from rev 117865, trunk/LayoutTests/fast/runin/generated-content-crash-expected.txt) (0 => 133072)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash-expected.txt 2012-10-31 20:45:46 UTC (rev 133072)
@@ -0,0 +1,11 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x106
+ RenderBlock {HTML} at (0,0) size 800x106
+ RenderBody {BODY} at (8,8) size 784x90
+ RenderBlock {DIV} at (0,0) size 90x90 [border: (10px solid #800080)]
+ RenderBlock {DIV} at (10,10) size 70x70 [border: (10px solid #008000)]
+ RenderInline (generated) at (0,0) size 50x50 [color=#FFA500]
+ RenderText at (10,10) size 50x50
+ text run at (10,10) width 50: "A"
+ RenderText {#text} at (0,0) size 0x0
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash.html (from rev 117865, trunk/LayoutTests/fast/runin/generated-content-crash.html) (0 => 133072)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash.html (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/generated-content-crash.html 2012-10-31 20:45:46 UTC (rev 133072)
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html style="font-family: ahem; font-size: 50px; -webkit-font-smoothing: none;">
+<!-- 'A' orange box should be inside the green box, which in turn is inside the purple box. -->
+<body>
+<style>
+#div1:before {
+ display: run-in;
+ content: 'A';
+ color: orange;
+}
+</style>
+<div id="div1" style="display: inline-block; border: 10px solid purple">
+<div style="border: 10px solid green"></div>
+</div>
+</body>
+</html>
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/move-run-in-original-position-crash-expected.png (from rev 117865, trunk/LayoutTests/fast/runin/move-run-in-original-position-crash-expected.png)
(Binary files differ)
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/move-run-in-original-position-crash-expected.txt (from rev 117865, trunk/LayoutTests/fast/runin/move-run-in-original-position-crash-expected.txt) (0 => 133072)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/move-run-in-original-position-crash-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/move-run-in-original-position-crash-expected.txt 2012-10-31 20:45:46 UTC (rev 133072)
@@ -0,0 +1,15 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x116
+ RenderBlock {HTML} at (0,0) size 800x116
+ RenderBody {BODY} at (8,8) size 784x100
+ RenderBlock (run-in) {LI} at (0,0) size 784x50 [color=#FFA500]
+ RenderText {#text} at (0,0) size 50x50
+ text run at (0,0) width 50: "A"
+ RenderBlock {DIV} at (0,50) size 784x50
+ RenderTable at (0,0) size 50x50
+ RenderTableSection (anonymous) at (0,0) size 50x50
+ RenderTableRow (anonymous) at (0,0) size 50x50 [color=#800080]
+ RenderTableCell (anonymous) at (0,0) size 50x50 [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 50x50
+ text run at (0,0) width 50: "B"
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/move-run-in-original-position-crash.html (from rev 117865, trunk/LayoutTests/fast/runin/move-run-in-original-position-crash.html) (0 => 133072)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/move-run-in-original-position-crash.html (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/move-run-in-original-position-crash.html 2012-10-31 20:45:46 UTC (rev 133072)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html style="font-family: ahem; font-size: 50px; -webkit-font-smoothing: none;">
+<!-- 'A' orange box followed by 'B' purple box in next line. -->
+<body>
+<style>
+.li1 { display: run-in; color: orange; }
+.div1::before { display: table-row; content: 'B'; color: purple; }
+</style>
+<script>
+document.body.offsetTop;
+li1 = document.createElement('li');
+li1.setAttribute('class', 'li1');
+li1.appendChild(document.createTextNode('A'));
+document.body.appendChild(li1);
+div1 = document.createElement('div');
+document.body.appendChild(div1);
+document.body.offsetTop;
+div1.setAttribute('class', 'div1');
+</script>
+</body>
+</html>
Modified: branches/safari-536.28-branch/LayoutTests/fast/runin/runin-between-list-marker-and-before-content-expected.png
(Binary files differ)
Modified: branches/safari-536.28-branch/LayoutTests/fast/runin/runin-between-list-marker-and-before-content-expected.txt (133071 => 133072)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/runin-between-list-marker-and-before-content-expected.txt 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/runin-between-list-marker-and-before-content-expected.txt 2012-10-31 20:45:46 UTC (rev 133072)
@@ -1,15 +1,15 @@
layer at (0,0) size 800x600
RenderView at (0,0) size 800x600
-layer at (0,0) size 800x56
- RenderBlock {HTML} at (0,0) size 800x56
- RenderBody {BODY} at (8,8) size 784x40
- RenderListItem {LI} at (0,0) size 784x40 [color=#0000FF]
- RenderListMarker at (-1,0) size 13x40: bullet
- RenderInline (run-in) {DIV} at (0,0) size 200x40 [color=#008000]
- RenderText {#text} at (32,0) size 200x40
- text run at (32,0) width 200: "RUNIN"
- RenderInline (generated) at (0,0) size 80x40
- RenderText at (232,0) size 80x40
- text run at (232,0) width 80: "AB"
- RenderText {#text} at (312,0) size 80x40
- text run at (312,0) width 80: "CD"
+layer at (0,0) size 800x66
+ RenderBlock {HTML} at (0,0) size 800x66
+ RenderBody {BODY} at (8,8) size 784x50
+ RenderListItem {LI} at (0,0) size 784x50 [color=#FFA500]
+ RenderInline (run-in) {DIV} at (0,0) size 250x50 [color=#008000]
+ RenderText {#text} at (0,0) size 250x50
+ text run at (0,0) width 250: "RUNIN"
+ RenderListMarker at (249,0) size 15x50: bullet
+ RenderInline (generated) at (0,0) size 100x50
+ RenderText at (290,0) size 100x50
+ text run at (290,0) width 100: "AB"
+ RenderText {#text} at (390,0) size 100x50
+ text run at (390,0) width 100: "CD"
Modified: branches/safari-536.28-branch/LayoutTests/fast/runin/runin-between-list-marker-and-before-content.html (133071 => 133072)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/runin-between-list-marker-and-before-content.html 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/runin-between-list-marker-and-before-content.html 2012-10-31 20:45:46 UTC (rev 133072)
@@ -1,15 +1,14 @@
<!DOCTYPE html>
-<!-- Test passes if you see RUNIN between list marker and ABCD. All text should be of same 40px size. -->
-<html>
-<body style="font-family: ahem; font-size: 10px; -webkit-font-smoothing: none;">
+<html style="font-family: ahem; font-size: 10px; -webkit-font-smoothing: none;">
+<!-- Test passes if you see RUNIN, followed by list marker and ABCD. All text should be of same 50px size. -->
<style>
li:before { content: "AB"; }
</style>
<div style="display: run-in; color: green">RUNIN</div>
-<li style="color: blue">CD</li>
+<li style="color: orange">CD</li>
<script>
document.body.offsetTop;
-document.body.style.fontSize = "40px";
+document.body.style.fontSize = "50px";
</script>
</body>
</html>
Deleted: branches/safari-536.28-branch/LayoutTests/platform/chromium-mac/fast/runin/runin-between-list-marker-and-before-content-expected.png
(Binary files differ)
Deleted: branches/safari-536.28-branch/LayoutTests/platform/chromium-win/fast/runin/runin-between-list-marker-and-before-content-expected.png
(Binary files differ)
Deleted: branches/safari-536.28-branch/LayoutTests/platform/gtk/fast/runin/runin-between-list-marker-and-before-content-expected.txt (133071 => 133072)
--- branches/safari-536.28-branch/LayoutTests/platform/gtk/fast/runin/runin-between-list-marker-and-before-content-expected.txt 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/LayoutTests/platform/gtk/fast/runin/runin-between-list-marker-and-before-content-expected.txt 2012-10-31 20:45:46 UTC (rev 133072)
@@ -1,15 +0,0 @@
-layer at (0,0) size 800x600
- RenderView at (0,0) size 800x600
-layer at (0,0) size 800x56
- RenderBlock {HTML} at (0,0) size 800x56
- RenderBody {BODY} at (8,8) size 784x40
- RenderListItem {LI} at (0,0) size 784x40 [color=#0000FF]
- RenderListMarker at (-1,0) size 13x40: bullet
- RenderInline (run-in) {DIV} at (0,0) size 200x40 [color=#008000]
- RenderText {#text} at (32,0) size 200x40
- text run at (32,0) width 200: "RUNIN"
- RenderInline (generated) at (0,0) size 80x40
- RenderText at (232,0) size 80x40
- text run at (232,0) width 80: "AB"
- RenderText {#text} at (312,0) size 80x40
- text run at (312,0) width 80: "CD"
Modified: branches/safari-536.28-branch/Source/WebCore/ChangeLog (133071 => 133072)
--- branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-10-31 20:45:46 UTC (rev 133072)
@@ -1,5 +1,43 @@
2012-10-31 Lucas Forschler <[email protected]>
+ Merge r117865
+
+ 2012-05-21 Abhishek Arya <[email protected]>
+
+ Regression(r117482): Run-in crashes relating to generated content and inline line box clearing.
+ https://bugs.webkit.org/show_bug.cgi?id=86879
+
+ Reviewed by Julien Chaffraix.
+
+ Tests: fast/runin/generated-content-crash.html
+ fast/runin/move-run-in-original-position-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks): Use the new helper
+ placeRunInIfNeeded. Do not place the run-in if it is a generated container since
+ the caller such as updateBeforeAfterContent might be keeping a reference to it
+ and adding children to it later.
+ (WebCore::destroyRunIn): Add ability to clear line box tree for inlines.
+ (WebCore::RenderBlock::placeRunInIfNeeded): Helper to place run-in. Add an
+ argument to not modify generated content during addChild, it should be moved
+ only at end of updateBeforeAfterContent.
+ (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):
+ (WebCore::RenderBlock::runInIsPlacedIntoSiblingBlock): helper to tell if this run-in
+ is actually placed into the next sibling block.
+ (WebCore::RenderBlock::moveRunInToOriginalPosition):
+ * rendering/RenderInline.cpp:
+ (WebCore::RenderInline::deleteLineBoxTree): like RenderBlock, add a helper
+ for deleteLineBoxTree. Virtualizing this might not be good, since this is
+ the only call site for inline line box tree clearing and RenderBlock::deleteLineBoxTree
+ is called a lot.
+ * rendering/RenderObjectChildList.cpp:
+ (WebCore::createRendererForBeforeAfterContent): fix a typo.
+ (WebCore::RenderObjectChildList::updateBeforeAfterContent): If insertBefore is equal
+ to the intruded run-in, then set it to next sibling so that new child will come after it. At
+ the end, place the generatedContainer if it is a run-in.
+
+2012-10-31 Lucas Forschler <[email protected]>
+
Merge r117482
2012-05-17 Abhishek Arya <[email protected]>
@@ -205440,3 +205478,4 @@
.
.
.
+.
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.cpp (133071 => 133072)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-10-31 20:45:46 UTC (rev 133072)
@@ -857,6 +857,10 @@
}
}
+ // Nothing goes before the intruded run-in.
+ if (beforeChild && beforeChild->isRunIn() && runInIsPlacedIntoSiblingBlock(beforeChild))
+ beforeChild = beforeChild->nextSibling();
+
// Check for a spanning element in columns.
RenderBlock* columnsBlockAncestor = columnsBlockForSpanningElement(newChild);
if (columnsBlockAncestor) {
@@ -938,13 +942,8 @@
RenderBox::addChild(newChild, beforeChild);
- // Handle positioning of run-ins.
- if (newChild->isRunIn())
- moveRunInUnderSiblingBlockIfNeeded(newChild);
- else if (RenderObject* prevSibling = newChild->previousSibling()) {
- if (prevSibling->isRunIn())
- moveRunInUnderSiblingBlockIfNeeded(prevSibling);
- }
+ // Handle placement of run-ins.
+ placeRunInIfNeeded(newChild, DoNotPlaceGeneratedRunIn);
if (madeBoxesNonInline && parent() && isAnonymousBlock() && parent()->isRenderBlock())
toRenderBlock(parent())->removeLeftoverAnonymousBlock(this);
@@ -1051,6 +1050,8 @@
if (!child)
return;
+ deleteLineBoxTree();
+
// Since we are going to have block children, we have to move
// back the run-in to its original place.
if (child->isRunIn()) {
@@ -1058,8 +1059,6 @@
child = firstChild();
}
- deleteLineBoxTree();
-
while (child) {
RenderObject *inlineRunStart, *inlineRunEnd;
getInlineRun(child, insertionPoint, inlineRunStart, inlineRunEnd);
@@ -1773,13 +1772,28 @@
ASSERT(runIn->isRunIn());
ASSERT(!runIn->firstChild());
- // If it is a block run-in, delete its line box tree as well. This is needed as our
- // children got moved and our line box tree is no longer valid.
+ // Delete our line box tree. This is needed as our children got moved
+ // and our line box tree is no longer valid.
if (runIn->isRenderBlock())
toRenderBlock(runIn)->deleteLineBoxTree();
+ else if (runIn->isRenderInline())
+ toRenderInline(runIn)->deleteLineBoxTree();
+ else
+ ASSERT_NOT_REACHED();
+
runIn->destroy();
}
+void RenderBlock::placeRunInIfNeeded(RenderObject* newChild, PlaceGeneratedRunInFlag flag)
+{
+ if (newChild->isRunIn() && (flag == PlaceGeneratedRunIn || !newChild->isBeforeOrAfterContent()))
+ moveRunInUnderSiblingBlockIfNeeded(newChild);
+ else if (RenderObject* prevSibling = newChild->previousSibling()) {
+ if (prevSibling->isRunIn() && (flag == PlaceGeneratedRunIn || !newChild->isBeforeOrAfterContent()))
+ moveRunInUnderSiblingBlockIfNeeded(prevSibling);
+ }
+}
+
RenderBoxModelObject* RenderBlock::createReplacementRunIn(RenderBoxModelObject* runIn)
{
ASSERT(runIn->isRunIn());
@@ -1859,19 +1873,31 @@
// since it handles correct placement of the children, especially where we cannot insert
// anything before the first child. e.g. details tag. See https://bugs.webkit.org/show_bug.cgi?id=58228.
curr->addChild(newRunIn, curr->firstChild());
+
+ // Make sure that |this| get a layout since its run-in child moved.
+ curr->setNeedsLayoutAndPrefWidthsRecalc();
}
-void RenderBlock::moveRunInToOriginalPosition(RenderObject* runIn)
+bool RenderBlock::runInIsPlacedIntoSiblingBlock(RenderObject* runIn)
{
ASSERT(runIn->isRunIn());
- // If we don't have a parent, there is nothing to move. This might
- // happen if |this| got detached from parent after |runIn| run into |this|.
+ // If we don't have a parent, we can't be moved into our sibling block.
if (!parent())
- return;
+ return false;
// An intruded run-in needs to be an inline.
if (!runIn->isRenderInline())
+ return false;
+
+ return true;
+}
+
+void RenderBlock::moveRunInToOriginalPosition(RenderObject* runIn)
+{
+ ASSERT(runIn->isRunIn());
+
+ if (!runInIsPlacedIntoSiblingBlock(runIn))
return;
RenderBoxModelObject* oldRunIn = toRenderBoxModelObject(runIn);
@@ -1880,6 +1906,9 @@
// Add the run-in block as our previous sibling.
parent()->addChild(newRunIn, this);
+
+ // Make sure that the parent holding the new run-in gets layout.
+ parent()->setNeedsLayoutAndPrefWidthsRecalc();
}
LayoutUnit RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.h (133071 => 133072)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.h 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.h 2012-10-31 20:45:46 UTC (rev 133072)
@@ -376,6 +376,9 @@
LayoutUnit computeStartPositionDeltaForChildAvoidingFloats(const RenderBox* child, LayoutUnit childMarginStart, RenderRegion* = 0, LayoutUnit offsetFromLogicalTopOfFirstPage = 0);
+ void placeRunInIfNeeded(RenderObject* newChild, PlaceGeneratedRunInFlag);
+ bool runInIsPlacedIntoSiblingBlock(RenderObject* runIn);
+
#ifndef NDEBUG
void showLineTreeAndMark(const InlineBox* = 0, const char* = 0, const InlineBox* = 0, const char* = 0, const RenderObject* = 0) const;
#endif
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderInline.cpp (133071 => 133072)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderInline.cpp 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderInline.cpp 2012-10-31 20:45:46 UTC (rev 133072)
@@ -1285,6 +1285,11 @@
m_lineBoxes.dirtyLineBoxes();
}
+void RenderInline::deleteLineBoxTree()
+{
+ m_lineBoxes.deleteLineBoxTree(renderArena());
+}
+
InlineFlowBox* RenderInline::createInlineFlowBox()
{
return new (renderArena()) InlineFlowBox(this);
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderInline.h (133071 => 133072)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderInline.h 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderInline.h 2012-10-31 20:45:46 UTC (rev 133072)
@@ -57,6 +57,7 @@
InlineFlowBox* createAndAppendInlineFlowBox();
void dirtyLineBoxes(bool fullLayout);
+ void deleteLineBoxTree();
RenderLineBoxList* lineBoxes() { return &m_lineBoxes; }
const RenderLineBoxList* lineBoxes() const { return &m_lineBoxes; }
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.h (133071 => 133072)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.h 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.h 2012-10-31 20:45:46 UTC (rev 133072)
@@ -104,6 +104,11 @@
MarkContainingBlockChain,
};
+enum PlaceGeneratedRunInFlag {
+ PlaceGeneratedRunIn,
+ DoNotPlaceGeneratedRunIn
+};
+
const int caretWidth = 1;
#if ENABLE(DASHBOARD_SUPPORT)
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderObjectChildList.cpp (133071 => 133072)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderObjectChildList.cpp 2012-10-31 20:42:43 UTC (rev 133071)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderObjectChildList.cpp 2012-10-31 20:45:46 UTC (rev 133072)
@@ -397,7 +397,7 @@
}
}
-static RenderObject* createRenderForBeforeAfterContent(RenderObject* owner, const ContentData* content, RenderStyle* pseudoElementStyle)
+static RenderObject* createRendererForBeforeAfterContent(RenderObject* owner, const ContentData* content, RenderStyle* pseudoElementStyle)
{
RenderObject* renderer = 0;
switch (content->type()) {
@@ -514,13 +514,18 @@
insertBefore = insertBefore->firstChild();
}
+ // Nothing goes before the intruded run-in, not even generated content.
+ if (insertBefore && insertBefore->isRunIn() && owner->isRenderBlock()
+ && toRenderBlock(owner)->runInIsPlacedIntoSiblingBlock(insertBefore))
+ insertBefore = insertBefore->nextSibling();
+
// Generated content consists of a single container that houses multiple children (specified
// by the content property). This generated content container gets the pseudo-element style set on it.
RenderObject* generatedContentContainer = 0;
// Walk our list of generated content and create render objects for each.
for (const ContentData* content = pseudoElementStyle->contentData(); content; content = content->next()) {
- RenderObject* renderer = createRenderForBeforeAfterContent(owner, content, pseudoElementStyle);
+ RenderObject* renderer = createRendererForBeforeAfterContent(owner, content, pseudoElementStyle);
if (renderer) {
if (!generatedContentContainer) {
@@ -552,6 +557,14 @@
renderer->destroy();
}
}
+
+ if (!generatedContentContainer)
+ return;
+
+ // Handle placement of run-ins. We do the run-in placement at the end since generatedContentContainer can get destroyed.
+ RenderObject* generatedContentContainerImmediateParent = generatedContentContainer->parent();
+ if (generatedContentContainerImmediateParent->isRenderBlock())
+ toRenderBlock(generatedContentContainerImmediateParent)->placeRunInIfNeeded(generatedContentContainer, PlaceGeneratedRunIn);
}
} // namespace WebCore
