Title: [184077] releases/WebKitGTK/webkit-2.8
- Revision
- 184077
- Author
- [email protected]
- Date
- 2015-05-11 04:06:25 -0700 (Mon, 11 May 2015)
Log Message
Merge r182835 - Make inline continuation style change logic consistent.
https://bugs.webkit.org/show_bug.cgi?id=143737
rdar://problem/20486596
Reviewed by Simon Fraser.
Do not force RenderBlock type-casting on the first sibling of the continuation's container.
The first sibling of the container of a continuation should be handled as the rest of the siblings.
Source/WebCore:
Test: fast/inline/inline-with-column-span-and-remove-block-child-crash.html
* rendering/RenderInline.cpp:
(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):
LayoutTests:
* fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt: Added.
* fast/inline/inline-with-column-span-and-remove-block-child-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog (184076 => 184077)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-11 11:04:08 UTC (rev 184076)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-05-11 11:06:25 UTC (rev 184077)
@@ -1,3 +1,17 @@
+2015-04-14 Zalan Bujtas <[email protected]>
+
+ Make inline continuation style change logic consistent.
+ https://bugs.webkit.org/show_bug.cgi?id=143737
+ rdar://problem/20486596
+
+ Reviewed by Simon Fraser.
+
+ Do not force RenderBlock type-casting on the first sibling of the continuation's container.
+ The first sibling of the container of a continuation should be handled as the rest of the siblings.
+
+ * fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt: Added.
+ * fast/inline/inline-with-column-span-and-remove-block-child-crash.html: Added.
+
2015-04-13 Said Abou-Hallawa <[email protected]>
Fix LayoutTests/http/tests/canvas/canvas-tainted-after-draw-image.html on all bots
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt (0 => 184077)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt 2015-05-11 11:06:25 UTC (rev 184077)
@@ -0,0 +1,2 @@
+Pass if no crash or assert in debug.
+
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash.html (0 => 184077)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash.html (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash.html 2015-05-11 11:06:25 UTC (rev 184077)
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <title>This test that when the block element is removed from an inline element when column span is present, we do not crash.</title>
+ <style>
+ #container {
+ -webkit-column-count: 2;
+ }
+ #after {
+ -webkit-column-span: all;
+ }
+ </style>
+</head>
+<body>
+<div id=container>
+ <span id=outer>Pass if no crash or assert in debug.
+ <div id=removethis></div>
+ </span>
+ <div id=after></div>
+</div>
+</body>
+
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ document.execCommand("SelectAll");
+
+ var elem = document.getElementById("removethis");
+ elem.parentNode.removeChild(elem);
+
+ document.getElementById("outer").style.position = "relative";
+</script>
+</html>
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (184076 => 184077)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-11 11:04:08 UTC (rev 184076)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-11 11:06:25 UTC (rev 184077)
@@ -1,3 +1,20 @@
+2015-04-14 Zalan Bujtas <[email protected]>
+
+ Make inline continuation style change logic consistent.
+ https://bugs.webkit.org/show_bug.cgi?id=143737
+ rdar://problem/20486596
+
+ Reviewed by Simon Fraser.
+
+ Do not force RenderBlock type-casting on the first sibling of the continuation's container.
+ The first sibling of the container of a continuation should be handled as the rest of the siblings.
+
+ Test: fast/inline/inline-with-column-span-and-remove-block-child-crash.html
+
+ * rendering/RenderInline.cpp:
+ (WebCore::updateStyleOfAnonymousBlockContinuations):
+ (WebCore::RenderInline::styleDidChange):
+
2015-04-14 Brady Eidson <[email protected]>
Media elements not in a page shouldn't load.
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/RenderInline.cpp (184076 => 184077)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/RenderInline.cpp 2015-05-11 11:04:08 UTC (rev 184076)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/RenderInline.cpp 2015-05-11 11:06:25 UTC (rev 184077)
@@ -138,9 +138,10 @@
return 0;
}
-static void updateStyleOfAnonymousBlockContinuations(RenderBlock& block, const RenderStyle* newStyle, const RenderStyle* oldStyle)
+static void updateStyleOfAnonymousBlockContinuations(const RenderBlock& block, const RenderStyle* newStyle, const RenderStyle* oldStyle)
{
- for (RenderBox* box = █ box && box->isAnonymousBlock(); box = box->nextSiblingBox()) {
+ // If any descendant blocks exist then they will be in the next anonymous block and its siblings.
+ for (RenderBox* box = block.nextSiblingBox(); box && box->isAnonymousBlock(); box = box->nextSiblingBox()) {
if (box->style().position() == newStyle->position())
continue;
@@ -184,13 +185,8 @@
// If an inline's in-flow positioning has changed and it is part of an active continuation as a descendant of an anonymous containing block,
// then any descendant blocks will need to change their in-flow positioning accordingly.
// Do this by updating the position of the descendant blocks' containing anonymous blocks - there may be more than one.
- if (containingBlock()->isAnonymousBlock() && oldStyle && newStyle.position() != oldStyle->position() && (newStyle.hasInFlowPosition() || oldStyle->hasInFlowPosition())) {
- // If any descendant blocks exist then they will be in the next anonymous block and its siblings.
- ASSERT(containingBlock()->nextSibling());
- RenderBlock& block = downcast<RenderBlock>(*containingBlock()->nextSibling());
- ASSERT(block.isAnonymousBlock());
- updateStyleOfAnonymousBlockContinuations(block, &newStyle, oldStyle);
- }
+ if (containingBlock()->isAnonymousBlock() && oldStyle && newStyle.position() != oldStyle->position() && (newStyle.hasInFlowPosition() || oldStyle->hasInFlowPosition()))
+ updateStyleOfAnonymousBlockContinuations(*containingBlock(), &newStyle, oldStyle);
}
if (!alwaysCreateLineBoxes()) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
