Title: [186747] branches/safari-600.1.4.17-branch
- Revision
- 186747
- Author
- [email protected]
- Date
- 2015-07-12 21:28:34 -0700 (Sun, 12 Jul 2015)
Log Message
Merge r186474. rdar://problem/21716537
Modified Paths
Added Paths
Diff
Modified: branches/safari-600.1.4.17-branch/LayoutTests/ChangeLog (186746 => 186747)
--- branches/safari-600.1.4.17-branch/LayoutTests/ChangeLog 2015-07-13 04:07:54 UTC (rev 186746)
+++ branches/safari-600.1.4.17-branch/LayoutTests/ChangeLog 2015-07-13 04:28:34 UTC (rev 186747)
@@ -1,5 +1,29 @@
2015-07-12 David Kilzer <[email protected]>
+ Merge r186474. rdar://problem/21716537
+
+ 2015-07-07 Zalan Bujtas <[email protected]>
+
+ REGRESSION(169105): CSS Regions: renderer returns wrong selection root when it is inside a column flow.
+ https://bugs.webkit.org/show_bug.cgi?id=146529
+ rdar://problem/21613670
+
+ Reviewed by Mihnea Ovidenie and David Kilzer.
+
+ This patch ensures that RenderObject::selectionRoot() handles column flows properly while searching for the associated
+ selection root.
+ When the renderer is inside a column flow and the column flow is part of a named flow, we stop
+ traversing the ancestor chain, searching for the selection root, when we reach the column flow.
+ Since the column flow is not a selection root, we mistakenly fall back to the RenderView as selection root.
+ Instead, we should check if the column is inside a named flow and return the selection root accordingly.
+ Returning the wrong selection root confuses RenderView::splitSelectionBetweenSubtrees() logic and this particular
+ RenderObject could end up in multiple selection trees.
+
+ * fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow-expected.txt: Added.
+ * fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html: Added.
+
+2015-07-12 David Kilzer <[email protected]>
+
Merge r185572. rdar://problem/21716531
2015-06-15 Zalan Bujtas <[email protected]>
Added: branches/safari-600.1.4.17-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow-expected.txt (0 => 186747)
--- branches/safari-600.1.4.17-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow-expected.txt (rev 0)
+++ branches/safari-600.1.4.17-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow-expected.txt 2015-07-13 04:28:34 UTC (rev 186747)
@@ -0,0 +1,3 @@
+Pass if no assert or crash in debug.
+foobar
+foobar
Added: branches/safari-600.1.4.17-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html (0 => 186747)
--- branches/safari-600.1.4.17-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html (rev 0)
+++ branches/safari-600.1.4.17-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html 2015-07-13 04:28:34 UTC (rev 186747)
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that elements inside columns get their proper selection root.</title>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function test() {
+ document.designMode = "on";
+ document.execCommand("SelectAll");
+ document.getElementById('changeme').style.display = 'inline';
+}
+</script>
+<style>
+.flow {
+ -webkit-flow-into: thread;
+}
+
+.column {
+ -webkit-columns: 2;
+}
+
+.spanner {
+ -webkit-column-span: all;
+}
+</style>
+</head>
+<body _onload_="test()">
+<div class=flow>
+ <div>Pass if no assert or crash in debug.</div>
+ <div class=column>
+ <div id="changeme">foobar</div>
+ <div class=spanner>foobar</div>
+ </div>
+</div>
+</body>
+</html>
Modified: branches/safari-600.1.4.17-branch/Source/WebCore/ChangeLog (186746 => 186747)
--- branches/safari-600.1.4.17-branch/Source/WebCore/ChangeLog 2015-07-13 04:07:54 UTC (rev 186746)
+++ branches/safari-600.1.4.17-branch/Source/WebCore/ChangeLog 2015-07-13 04:28:34 UTC (rev 186747)
@@ -1,5 +1,31 @@
2015-07-12 David Kilzer <[email protected]>
+ Merge r186474. rdar://problem/21716537
+
+ 2015-07-07 Zalan Bujtas <[email protected]>
+
+ REGRESSION(169105): CSS Regions: renderer returns wrong selection root when it is inside a column flow.
+ https://bugs.webkit.org/show_bug.cgi?id=146529
+ rdar://problem/21613670
+
+ Reviewed by Mihnea Ovidenie and David Kilzer.
+
+ This patch ensures that RenderObject::selectionRoot() handles column flows properly while searching for the associated
+ selection root.
+ When the renderer is inside a column flow and the column flow is part of a named flow, we stop
+ traversing the ancestor chain, searching for the selection root, when we reach the column flow.
+ Since the column flow is not a selection root, we mistakenly fall back to the RenderView as selection root.
+ Instead, we should check if the column is inside a named flow and return the selection root accordingly.
+ Returning the wrong selection root confuses RenderView::splitSelectionBetweenSubtrees() logic and this particular
+ RenderObject could end up in multiple selection trees.
+
+ Test: fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::selectionRoot):
+
+2015-07-12 David Kilzer <[email protected]>
+
Merge r185572. rdar://problem/21716531
2015-06-15 Zalan Bujtas <[email protected]>
Modified: branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RenderObject.cpp (186746 => 186747)
--- branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RenderObject.cpp 2015-07-13 04:07:54 UTC (rev 186746)
+++ branches/safari-600.1.4.17-branch/Source/WebCore/rendering/RenderObject.cpp 2015-07-13 04:28:34 UTC (rev 186747)
@@ -53,6 +53,7 @@
#include "RenderIterator.h"
#include "RenderLayer.h"
#include "RenderLayerBacking.h"
+#include "RenderMultiColumnFlowThread.h"
#include "RenderNamedFlowFragment.h"
#include "RenderNamedFlowThread.h"
#include "RenderSVGResourceContainer.h"
@@ -1555,9 +1556,17 @@
SelectionSubtreeRoot& RenderObject::selectionRoot() const
{
RenderFlowThread* flowThread = flowThreadContainingBlock();
- if (flowThread && flowThread->isRenderNamedFlowThread())
+ if (!flowThread)
+ return view();
+
+ if (flowThread->isRenderNamedFlowThread())
return *toRenderNamedFlowThread(flowThread);
-
+ if (flowThread->isRenderMultiColumnFlowThread()) {
+ if (!flowThread->containingBlock())
+ return view();
+ return flowThread->containingBlock()->selectionRoot();
+ }
+ ASSERT_NOT_REACHED();
return view();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
