Title: [186317] releases/WebKitGTK/webkit-2.8
- Revision
- 186317
- Author
- [email protected]
- Date
- 2015-07-06 01:29:16 -0700 (Mon, 06 Jul 2015)
Log Message
Merge r184577 - Merged anonymous blocks should invalidate simple line layout path.
https://bugs.webkit.org/show_bug.cgi?id=145104
rdar://problem/20980930
Reviewed by Antti Koivisto.
When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
Source/WebCore:
Test: fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html
* rendering/RenderElement.cpp:
(WebCore::RenderElement::insertChildInternal):
LayoutTests:
* fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt: Added.
* fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog (186316 => 186317)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-07-06 08:27:56 UTC (rev 186316)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/ChangeLog 2015-07-06 08:29:16 UTC (rev 186317)
@@ -1,3 +1,18 @@
+2015-05-19 Zalan Bujtas <[email protected]>
+
+ Merged anonymous blocks should invalidate simple line layout path.
+ https://bugs.webkit.org/show_bug.cgi?id=145104
+ rdar://problem/20980930
+
+ Reviewed by Antti Koivisto.
+
+ When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
+ This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
+ Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
+
+ * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt: Added.
+ * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html: Added.
+
2015-05-16 Zalan Bujtas <[email protected]>
REGRESSION (Subpixel): Dashed underline is missing when box is positioned at subpixels.
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt (0 => 186317)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt 2015-07-06 08:29:16 UTC (rev 186317)
@@ -0,0 +1,2 @@
+Pass if no crash or assert in debug.
+foo
Added: releases/WebKitGTK/webkit-2.8/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html (0 => 186317)
--- releases/WebKitGTK/webkit-2.8/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html (rev 0)
+++ releases/WebKitGTK/webkit-2.8/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html 2015-07-06 08:29:16 UTC (rev 186317)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests when 2 anonymous blocks are merged and the 'to' block has simple line layout path.</title>
+</head>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<div>Pass if no crash or assert in debug.</div>foo<div id="removethis"></div><span>
+<script>
+ document.body.offsetWidth;
+ var elem = document.getElementById("removethis");
+ elem.parentNode.removeChild(elem);
+</script>
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (186316 => 186317)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-07-06 08:27:56 UTC (rev 186316)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-07-06 08:29:16 UTC (rev 186317)
@@ -1,3 +1,20 @@
+2015-05-19 Zalan Bujtas <[email protected]>
+
+ Merged anonymous blocks should invalidate simple line layout path.
+ https://bugs.webkit.org/show_bug.cgi?id=145104
+ rdar://problem/20980930
+
+ Reviewed by Antti Koivisto.
+
+ When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
+ This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
+ Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
+
+ Test: fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html
+
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::insertChildInternal):
+
2015-05-19 Beth Dakin <[email protected]>
Crash in WebCore::RenderLayer::updateScrollbarsAfterLayout
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/RenderElement.cpp (186316 => 186317)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/RenderElement.cpp 2015-07-06 08:27:56 UTC (rev 186316)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/rendering/RenderElement.cpp 2015-07-06 08:29:16 UTC (rev 186317)
@@ -594,6 +594,8 @@
if (AXObjectCache* cache = document().axObjectCache())
cache->childrenChanged(this, newChild);
+ if (is<RenderBlockFlow>(*this))
+ downcast<RenderBlockFlow>(*this).invalidateLineLayoutPath();
}
void RenderElement::removeChildInternal(RenderObject& oldChild, NotifyChildrenType notifyChildren)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
