Diff
Modified: branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog (180732 => 180733)
--- branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog 2015-02-27 07:26:23 UTC (rev 180732)
+++ branches/safari-600.1.4.15-branch/LayoutTests/ChangeLog 2015-02-27 08:03:24 UTC (rev 180733)
@@ -1,5 +1,19 @@
2015-02-26 Babak Shafiei <[email protected]>
+ Merge r173806.
+
+ 2014-09-22 Mihnea Ovidenie <[email protected]>
+
+ [CSS Regions] Assertion failure and null dereference crash when using animations and regions
+ https://bugs.webkit.org/show_bug.cgi?id=136918
+
+ Reviewed by Andrei Bucur.
+
+ * fast/regions/animated-image-in-region-expected.txt: Added.
+ * fast/regions/animated-image-in-region.html: Added.
+
+2015-02-26 Babak Shafiei <[email protected]>
+
Merge patch for r180129, r180133.
2015-02-26 Said Abou-Hallawa <[email protected]>
Copied: branches/safari-600.1.4.15-branch/LayoutTests/fast/regions/animated-image-in-region-expected.txt (from rev 180095, branches/safari-600.5-branch/LayoutTests/fast/regions/animated-image-in-region-expected.txt) (0 => 180733)
--- branches/safari-600.1.4.15-branch/LayoutTests/fast/regions/animated-image-in-region-expected.txt (rev 0)
+++ branches/safari-600.1.4.15-branch/LayoutTests/fast/regions/animated-image-in-region-expected.txt 2015-02-27 08:03:24 UTC (rev 180733)
@@ -0,0 +1,7 @@
+Test that an animated image displayed in a region is correctly animated.
+
+On success, you should see an image of an iPad displayed inside a black border box and no crash.
+
+PASS
+
+
Copied: branches/safari-600.1.4.15-branch/LayoutTests/fast/regions/animated-image-in-region.html (from rev 180095, branches/safari-600.5-branch/LayoutTests/fast/regions/animated-image-in-region.html) (0 => 180733)
--- branches/safari-600.1.4.15-branch/LayoutTests/fast/regions/animated-image-in-region.html (rev 0)
+++ branches/safari-600.1.4.15-branch/LayoutTests/fast/regions/animated-image-in-region.html 2015-02-27 08:03:24 UTC (rev 180733)
@@ -0,0 +1,44 @@
+
+<!DOCTYPE html>
+
+<html>
+ <head>
+ <style>
+ .region {
+ -webkit-flow-from: flow;
+ width: 320px;
+ height: 320px;
+ border: 5px solid black;
+ }
+
+ #img {
+ -webkit-flow-into: flow;
+ width: 300px;
+ height: 300px;
+ }
+
+ .spin {
+ -webkit-animation-name: spin;
+ -webkit-animation-duration: 0.1s;
+ -webkit-animation-timing-function: linear;
+ }
+
+ @-webkit-keyframes spin {
+ from { -webkit-transform: rotateZ(0deg);}
+ to { -webkit-transform: rotateZ(360deg); }
+ }
+ </style>
+ </head>
+
+ <body>
+ <p>Test that an animated image displayed in a region is correctly animated.</p>
+ <p>On success, you should see an image of an iPad displayed inside a black border box and no crash.</p>
+ <p>PASS</p>
+ <div class="region"></div>
+ <img id="img" class="spin" src="" />
+ <script>
+ if (window.testRunner)
+ window.testRunner.dumpAsText();
+ </script>
+ </body>
+</html>
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog (180732 => 180733)
--- branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog 2015-02-27 07:26:23 UTC (rev 180732)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/ChangeLog 2015-02-27 08:03:24 UTC (rev 180733)
@@ -1,5 +1,42 @@
2015-02-26 Babak Shafiei <[email protected]>
+ Merge r173806.
+
+ 2014-09-22 Mihnea Ovidenie <[email protected]>
+
+ [CSS Regions] Assertion failure and null dereference crash when using animations and regions
+ https://bugs.webkit.org/show_bug.cgi?id=136918
+
+ Reviewed by Andrei Bucur.
+
+ In some situations, for instance when an image has an attached animation, the style change caused by the animation
+ triggers a geometry update for the backing store associated with the image's layer. This may occur before
+ the layout for the image has finished.
+
+ Moreover, if the image in such situation - having a composited layer - is displayed in a region,
+ sicne the layout did not finish yet, the mappings between the layers of the elements collected in the named flow
+ and the regions associated with the named flow are not updated and cannot be used.
+
+ Therefore in those situations, we have to bail out early and use these mappings only after the layout has finished.
+
+ This patch also changes RenderLayerBacking method updateAfterDescendents -> updateAfterDescendants.
+
+ Test: fast/regions/animated-image-in-region.html
+
+ * rendering/RenderFlowThread.cpp:
+ (WebCore::RenderFlowThread::cachedRegionForCompositedLayer):
+ * rendering/RenderLayer.cpp:
+ (WebCore::RenderLayer::calculateClipRects):
+ * rendering/RenderLayerBacking.cpp:
+ (WebCore::RenderLayerBacking::updateAfterDescendants):
+ * rendering/RenderLayerBacking.h:
+ * rendering/RenderLayerCompositor.cpp:
+ (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+ (WebCore::RenderLayerCompositor::updateLayerTreeGeometry):
+ (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry):
+
+2015-02-26 Babak Shafiei <[email protected]>
+
Merge patch for r180129, r180133.
2015-02-26 Said Abou-Hallawa <[email protected]>
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderFlowThread.cpp (180732 => 180733)
--- branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderFlowThread.cpp 2015-02-27 07:26:23 UTC (rev 180732)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderFlowThread.cpp 2015-02-27 08:03:24 UTC (rev 180733)
@@ -251,7 +251,12 @@
RenderNamedFlowFragment* RenderFlowThread::cachedRegionForCompositedLayer(RenderLayer& childLayer) const
{
- ASSERT(m_layerToRegionMap);
+ if (!m_layerToRegionMap) {
+ ASSERT(needsLayout());
+ ASSERT(m_layersToRegionMappingsDirty);
+ return nullptr;
+ }
+
RenderNamedFlowFragment* namedFlowFragment = m_layerToRegionMap->get(&childLayer);
ASSERT(!namedFlowFragment || m_regionList.contains(namedFlowFragment));
return namedFlowFragment;
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerBacking.cpp (180732 => 180733)
--- branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerBacking.cpp 2015-02-27 07:26:23 UTC (rev 180732)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerBacking.cpp 2015-02-27 08:03:24 UTC (rev 180733)
@@ -964,7 +964,7 @@
compositor().updateScrollCoordinatedStatus(m_owningLayer);
}
-void RenderLayerBacking::updateAfterDescendents()
+void RenderLayerBacking::updateAfterDescendants()
{
bool didUpdateContentsRect = false;
bool isSimpleContainer = isSimpleContainerCompositingLayer();
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerBacking.h (180732 => 180733)
--- branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerBacking.h 2015-02-27 07:26:23 UTC (rev 180732)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerBacking.h 2015-02-27 08:03:24 UTC (rev 180733)
@@ -80,7 +80,7 @@
void updateGeometry();
// Update state the requires that descendant layers have been updated.
- void updateAfterDescendents();
+ void updateAfterDescendants();
// Update contents and clipping structure.
void updateDrawsContent();
Modified: branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerCompositor.cpp (180732 => 180733)
--- branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerCompositor.cpp 2015-02-27 07:26:23 UTC (rev 180732)
+++ branches/safari-600.1.4.15-branch/Source/WebCore/rendering/RenderLayerCompositor.cpp 2015-02-27 08:03:24 UTC (rev 180733)
@@ -900,7 +900,7 @@
else if (layer.isComposited()) {
// FIXME: updating geometry here is potentially harmful, because layout is not up-to-date.
layer.backing()->updateGeometry();
- layer.backing()->updateAfterDescendents();
+ layer.backing()->updateAfterDescendants();
}
}
@@ -1599,7 +1599,7 @@
}
if (RenderLayerBacking* layerBacking = layer.backing())
- layerBacking->updateAfterDescendents();
+ layerBacking->updateAfterDescendants();
}
void RenderLayerCompositor::rebuildRegionCompositingLayerTree(RenderNamedFlowFragment* region, Vector<GraphicsLayer*>& childList, int depth)
@@ -1836,7 +1836,7 @@
}
if (RenderLayerBacking* layerBacking = layer.backing())
- layerBacking->updateAfterDescendents();
+ layerBacking->updateAfterDescendants();
}
// Recurs down the RenderLayer tree until its finds the compositing descendants of compositingAncestor and updates their geometry.
@@ -1853,7 +1853,7 @@
layerBacking->updateGeometry();
if (compositedChildrenOnly) {
- layerBacking->updateAfterDescendents();
+ layerBacking->updateAfterDescendants();
return;
}
}
@@ -1893,7 +1893,7 @@
if (&layer != &compositingAncestor) {
if (RenderLayerBacking* layerBacking = layer.backing())
- layerBacking->updateAfterDescendents();
+ layerBacking->updateAfterDescendants();
}
}
