Title: [184577] trunk
- Revision
- 184577
- Author
- [email protected]
- Date
- 2015-05-19 10:49:40 -0700 (Tue, 19 May 2015)
Log Message
Merged anonymous blocks should invalidate simple line layout path.
https://bugs.webkit.org/show_bug.cgi?id=145104
rdar://problem/20980930
Reviewed by Antti Koivisto.
When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
Source/WebCore:
Test: fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html
* rendering/RenderElement.cpp:
(WebCore::RenderElement::insertChildInternal):
LayoutTests:
* fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt: Added.
* fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (184576 => 184577)
--- trunk/LayoutTests/ChangeLog 2015-05-19 17:26:23 UTC (rev 184576)
+++ trunk/LayoutTests/ChangeLog 2015-05-19 17:49:40 UTC (rev 184577)
@@ -1,3 +1,18 @@
+2015-05-19 Zalan Bujtas <[email protected]>
+
+ Merged anonymous blocks should invalidate simple line layout path.
+ https://bugs.webkit.org/show_bug.cgi?id=145104
+ rdar://problem/20980930
+
+ Reviewed by Antti Koivisto.
+
+ When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
+ This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
+ Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
+
+ * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt: Added.
+ * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html: Added.
+
2015-05-14 Chris Fleizach <[email protected]>
AX: Select text mechanism returns results outside of text control regions
Added: trunk/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt (0 => 184577)
--- trunk/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt 2015-05-19 17:49:40 UTC (rev 184577)
@@ -0,0 +1,2 @@
+Pass if no crash or assert in debug.
+foo
Added: trunk/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html (0 => 184577)
--- trunk/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html (rev 0)
+++ trunk/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html 2015-05-19 17:49:40 UTC (rev 184577)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests when 2 anonymous blocks are merged and the 'to' block has simple line layout path.</title>
+</head>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<div>Pass if no crash or assert in debug.</div>foo<div id="removethis"></div><span>
+<script>
+ document.body.offsetWidth;
+ var elem = document.getElementById("removethis");
+ elem.parentNode.removeChild(elem);
+</script>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (184576 => 184577)
--- trunk/Source/WebCore/ChangeLog 2015-05-19 17:26:23 UTC (rev 184576)
+++ trunk/Source/WebCore/ChangeLog 2015-05-19 17:49:40 UTC (rev 184577)
@@ -1,3 +1,20 @@
+2015-05-19 Zalan Bujtas <[email protected]>
+
+ Merged anonymous blocks should invalidate simple line layout path.
+ https://bugs.webkit.org/show_bug.cgi?id=145104
+ rdar://problem/20980930
+
+ Reviewed by Antti Koivisto.
+
+ When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
+ This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
+ Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
+
+ Test: fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html
+
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::insertChildInternal):
+
2015-05-19 Beth Dakin <[email protected]>
Crash in WebCore::RenderLayer::updateScrollbarsAfterLayout
Modified: trunk/Source/WebCore/rendering/RenderElement.cpp (184576 => 184577)
--- trunk/Source/WebCore/rendering/RenderElement.cpp 2015-05-19 17:26:23 UTC (rev 184576)
+++ trunk/Source/WebCore/rendering/RenderElement.cpp 2015-05-19 17:49:40 UTC (rev 184577)
@@ -593,6 +593,8 @@
if (AXObjectCache* cache = document().axObjectCache())
cache->childrenChanged(this, newChild);
+ if (is<RenderBlockFlow>(*this))
+ downcast<RenderBlockFlow>(*this).invalidateLineLayoutPath();
}
void RenderElement::removeChildInternal(RenderObject& oldChild, NotifyChildrenType notifyChildren)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
