Title: [189315] branches/safari-601-branch
- Revision
- 189315
- Author
- [email protected]
- Date
- 2015-09-03 16:38:01 -0700 (Thu, 03 Sep 2015)
Log Message
Merged r188340. rdar://problem/22423150
Modified Paths
Added Paths
Diff
Modified: branches/safari-601-branch/LayoutTests/ChangeLog (189314 => 189315)
--- branches/safari-601-branch/LayoutTests/ChangeLog 2015-09-03 23:35:43 UTC (rev 189314)
+++ branches/safari-601-branch/LayoutTests/ChangeLog 2015-09-03 23:38:01 UTC (rev 189315)
@@ -1,5 +1,20 @@
2015-09-03 Babak Shafiei <[email protected]>
+ Merge r188340.
+
+ 2015-08-12 Brent Fulgham <[email protected]>
+
+ REGRESSION(r185606): ASSERT in WebCore::RenderElement::styleWillChange
+ https://bugs.webkit.org/show_bug.cgi?id=147596
+ <rdar://problem/21963355>
+
+ Reviewed by Jon Honeycutt.
+
+ * css3/scroll-snap/improper-snap-points-crash-expected.txt: Added.
+ * css3/scroll-snap/improper-snap-points-crash.html: Added.
+
+2015-09-03 Babak Shafiei <[email protected]>
+
Merge r188271.
2015-08-11 Said Abou-Hallawa <[email protected]>
Copied: branches/safari-601-branch/LayoutTests/css3/scroll-snap/improper-snap-points-crash-expected.txt (from rev 188340, trunk/LayoutTests/css3/scroll-snap/improper-snap-points-crash-expected.txt) (0 => 189315)
--- branches/safari-601-branch/LayoutTests/css3/scroll-snap/improper-snap-points-crash-expected.txt (rev 0)
+++ branches/safari-601-branch/LayoutTests/css3/scroll-snap/improper-snap-points-crash-expected.txt 2015-09-03 23:38:01 UTC (rev 189315)
@@ -0,0 +1,15 @@
+The test passes if this page renders without crashing.
+
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+Scroll-snap offsets for horizontalTarget: horizontal = { 0, 100, 200, 300, 400, 500 }
+Scroll-snap offsets for first:
+Scroll-snap offsets for second:
+Scroll-snap offsets for third:
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-601-branch/LayoutTests/css3/scroll-snap/improper-snap-points-crash.html (from rev 188340, trunk/LayoutTests/css3/scroll-snap/improper-snap-points-crash.html) (0 => 189315)
--- branches/safari-601-branch/LayoutTests/css3/scroll-snap/improper-snap-points-crash.html (rev 0)
+++ branches/safari-601-branch/LayoutTests/css3/scroll-snap/improper-snap-points-crash.html 2015-09-03 23:38:01 UTC (rev 189315)
@@ -0,0 +1,80 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <style>
+ .horizontalGallery {
+ width: 100px;
+ height: 100px;
+ overflow-y: hidden;
+ overflow-x: auto;
+ margin: 2px;
+ -webkit-overflow-scrolling: touch;
+ -webkit-scroll-snap-points-x: repeat(100%);
+ -webkit-scroll-snap-type: mandatory;
+ -webkit-scroll-snap-coordinate: 50% 50%;
+ }
+ .horizontalGalleryDrawer {
+ width: 600px;
+ height: 100px;
+ }
+ .colorBox {
+ height: 100px;
+ width: 100px;
+ float: left;
+ }
+ #item0 { background-color: red; }
+ #item1 { background-color: green; }
+ #item2 { background-color: blue; }
+ #item3 { background-color: aqua; }
+ #item4 { background-color: yellow; }
+ #item5 { background-color: fuchsia; }
+ </style>
+ <script src=""
+ <script>
+ function reportResult(horizontalTargetID)
+ {
+ var horizontalTarget = document.getElementById(horizontalTargetID);
+
+ debug("Scroll-snap offsets for " + horizontalTargetID + ": " + window.internals.scrollSnapOffsets(horizontalTarget));
+ }
+
+ function runTest()
+ {
+ reportResult('horizontalTarget');
+ reportResult('first');
+ reportResult('second');
+ reportResult('third');
+
+ finishJSTest();
+ testRunner.notifyDone();
+ }
+
+ function onLoad()
+ {
+ if (window.testRunner) {
+ window.jsTestIsAsync = true;
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ setTimeout(runTest, 0);
+ }
+ }
+ </script>
+ </head>
+ <body _onload_="onLoad();">
+ <div style="position: relative; width: 300px">
+ <div>The test passes if this page renders without crashing.</div>
+ <div class="horizontalGallery" id="horizontalTarget">
+ <div class="horizontalGalleryDrawer">
+ <div id="item0" class="colorBox"></div>
+ <div id="item1" class="colorBox"></div>
+ <div id="item2" class="colorBox"></div>
+ <br id="first" />
+ <br class="horizontalGallery" id="second" />
+ </div>
+ </div>
+ <br class="horizontalGallery" id="third" />
+ <div id="console"></div>
+ </div>
+ <script src=""
+ </body>
+</html>
Modified: branches/safari-601-branch/Source/WebCore/ChangeLog (189314 => 189315)
--- branches/safari-601-branch/Source/WebCore/ChangeLog 2015-09-03 23:35:43 UTC (rev 189314)
+++ branches/safari-601-branch/Source/WebCore/ChangeLog 2015-09-03 23:38:01 UTC (rev 189315)
@@ -1,5 +1,26 @@
2015-09-03 Babak Shafiei <[email protected]>
+ Merge r188340.
+
+ 2015-08-12 Brent Fulgham <[email protected]>
+
+ REGRESSION(r185606): ASSERT in WebCore::RenderElement::styleWillChange
+ https://bugs.webkit.org/show_bug.cgi?id=147596
+ <rdar://problem/21963355>
+
+ Reviewed by Jon Honeycutt.
+
+ Only add (or remove) a RenderElement from the container of RenderBoxes with
+ scroll snap coordinates if the element actually is a RenderBox.
+
+ Tested by css3/scroll-snap/improper-snap-points-crash.html.
+
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::styleWillChange):
+ (WebCore::RenderElement::willBeRemovedFromTree):
+
+2015-09-03 Babak Shafiei <[email protected]>
+
Merge r188271.
2015-08-11 Said Abou-Hallawa <[email protected]>
Modified: branches/safari-601-branch/Source/WebCore/rendering/RenderElement.cpp (189314 => 189315)
--- branches/safari-601-branch/Source/WebCore/rendering/RenderElement.cpp 2015-09-03 23:35:43 UTC (rev 189314)
+++ branches/safari-601-branch/Source/WebCore/rendering/RenderElement.cpp 2015-09-03 23:38:01 UTC (rev 189315)
@@ -900,11 +900,12 @@
#if ENABLE(CSS_SCROLL_SNAP)
if (!newStyle.scrollSnapCoordinates().isEmpty() || (oldStyle && !oldStyle->scrollSnapCoordinates().isEmpty())) {
- ASSERT(is<RenderBox>(this));
- if (newStyle.scrollSnapCoordinates().isEmpty())
- view().unregisterBoxWithScrollSnapCoordinates(downcast<RenderBox>(*this));
- else
- view().registerBoxWithScrollSnapCoordinates(downcast<RenderBox>(*this));
+ if (is<RenderBox>(*this)) {
+ if (newStyle.scrollSnapCoordinates().isEmpty())
+ view().unregisterBoxWithScrollSnapCoordinates(downcast<RenderBox>(*this));
+ else
+ view().registerBoxWithScrollSnapCoordinates(downcast<RenderBox>(*this));
+ }
}
#endif
@@ -1065,8 +1066,8 @@
#if ENABLE(CSS_SCROLL_SNAP)
if (!m_style->scrollSnapCoordinates().isEmpty()) {
- ASSERT(is<RenderBox>(this));
- view().unregisterBoxWithScrollSnapCoordinates(downcast<RenderBox>(*this));
+ if (is<RenderBox>(*this))
+ view().unregisterBoxWithScrollSnapCoordinates(downcast<RenderBox>(*this));
}
#endif
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
