Changeset 166650 in webkit


Ignore:
Timestamp:
Apr 2, 2014 10:21:09 AM (10 years ago)
Author:
ddkilzer@apple.com
Message:

Use outermost containing isolate when constructing bidi runs
<​http://webkit.org/b/131107>
<rdar://problem/15690021>

Reviewed by Darin Adler.

Merged from Blink (patch by ​jww@chromium.org):
​https://src.chromium.org/viewvc/blink?revision=157268&view=revision
​http://crbug.com/279277

Update containingIsolate to go back all the way to top
isolate from current root, rather than stopping at the first
isolate it finds. This works because the current root is
always updated with each isolate run.

Source/WebCore:

Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html

fast/text/international/unicode-bidi-isolate-nested-with-removes.html

  • rendering/InlineIterator.h:

(WebCore::highestContainingIsolateWithinRoot):

  • rendering/RenderBlockLineLayout.cpp:

(WebCore::constructBidiRunsForSegment):

LayoutTests:

  • fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt: Updated.
  • fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent-expected.txt: Added.
  • fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html: Added.
  • fast/text/international/unicode-bidi-isolate-nested-with-removes.html: Updated.
Location:
trunk
Files:
2 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r166649 r166650  
     12014-04-02  David Kilzer  <ddkilzer@apple.com>
     2
     3        Use outermost containing isolate when constructing bidi runs
     4        <http://webkit.org/b/131107>
     5        <rdar://problem/15690021>
     6
     7        Reviewed by Darin Adler.
     8
     9        Merged from Blink (patch by jww@chromium.org):
     10        https://src.chromium.org/viewvc/blink?revision=157268&view=revision
     11        http://crbug.com/279277
     12
     13            Update containingIsolate to go back all the way to top
     14            isolate from current root, rather than stopping at the first
     15            isolate it finds. This works because the current root is
     16            always updated with each isolate run.
     17
     18        * fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt: Updated.
     19        * fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent-expected.txt: Added.
     20        * fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html: Added.
     21        * fast/text/international/unicode-bidi-isolate-nested-with-removes.html: Updated.
     22
    1232014-04-02  Chris Fleizach  <cfleizach@apple.com>
    224

  • trunk/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt

    r166645 r166650  
    1  bar                     
    2 
    3 
    41PASS did not crash

  • trunk/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html

    r166645 r166650  
     1<!doctype html>
    12<!-- This tests for regression of https://crbug.com/265838 where adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
    23<script>
    3 function remove(node)
    4 {
    5     node.parentNode.removeChild(node);
    6 }
    7 
    84window.onload = function()
    95{
    106    document.body.offsetTop;
    11     remove(b.lastChild);
     7    b.lastChild.parentNode.removeChild(b.lastChild);
    128    document.body.offsetTop;
    13     remove(a.firstChild);
     9    a.firstChild.parentNode.removeChild(a.firstChild);
    1410    document.body.offsetTop;
    1511
    16     document.body.appendChild(document.createTextNode("PASS did not crash"));
     12    document.write("PASS did not crash");
    1713}
    1814</script>

  • trunk/Source/WebCore/ChangeLog

    r166649 r166650  
     12014-04-02  David Kilzer  <ddkilzer@apple.com>
     2
     3        Use outermost containing isolate when constructing bidi runs
     4        <http://webkit.org/b/131107>
     5        <rdar://problem/15690021>
     6
     7        Reviewed by Darin Adler.
     8
     9        Merged from Blink (patch by jww@chromium.org):
     10        https://src.chromium.org/viewvc/blink?revision=157268&view=revision
     11        http://crbug.com/279277
     12
     13            Update containingIsolate to go back all the way to top
     14            isolate from current root, rather than stopping at the first
     15            isolate it finds. This works because the current root is
     16            always updated with each isolate run.
     17
     18        Tests: fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
     19               fast/text/international/unicode-bidi-isolate-nested-with-removes.html
     20
     21        * rendering/InlineIterator.h:
     22        (WebCore::highestContainingIsolateWithinRoot):
     23        * rendering/RenderBlockLineLayout.cpp:
     24        (WebCore::constructBidiRunsForSegment):
     25
    1262014-04-02  Chris Fleizach  <cfleizach@apple.com>
    227

  • trunk/Source/WebCore/rendering/InlineIterator.h

    r166245 r166650  
    449449}
    450450
    451 static inline RenderObject* containingIsolate(RenderObject* object, RenderObject* root)
     451static inline RenderObject* highestContainingIsolateWithinRoot(RenderObject* object, RenderObject* root)
    452452{
    453453    ASSERT(object);
    454454    RenderObject* containingIsolateObject = 0;
    455455    while (object && object != root) {
    456         if (containingIsolateObject && !isIsolatedInline(object))
    457             break;
    458 
    459456        if (isIsolatedInline(object))
    460457            containingIsolateObject = object;

  • trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

    r166428 r166650  
    877877        // to take a RenderObject and do this logic there, but that would be a layering
    878878        // violation for BidiResolver (which knows nothing about RenderObject).
    879         RenderInline* isolatedInline = toRenderInline(containingIsolate(&startObj, currentRoot));
     879        RenderInline* isolatedInline = toRenderInline(highestContainingIsolateWithinRoot(&startObj, currentRoot));
     880        ASSERT(isolatedInline);
     881
    880882        InlineBidiResolver isolatedResolver;
    881883        EUnicodeBidi unicodeBidi = isolatedInline->style().unicodeBidi();
Note: See TracChangeset for help on using the changeset viewer.