Changeset 207310 in webkit

Timestamp:

Oct 13, 2016 2:41:01 PM (8 years ago)

Author:

Alan Bujtas

Message:

[Clean RenderTree] LayoutTests/imported/blink/fast/table/crash-bad-child-table-continuation.html fails.
​https://bugs.webkit.org/show_bug.cgi?id=163399

Reviewed by David Hyatt.

When we try to insert a renderer before a child whose direct parent is a (anonymus) RenderTable, continuation logic
should dismiss the RenderTable as the parent and find a more appropriate ancestor.
RenderTables assumes a certain descendant tree structure which might not be available in the continuation.

Will be testable with webkit.org/b/162834

• rendering/RenderInline.cpp:

(WebCore::canUseAsParentForContinuation):
(WebCore::RenderInline::addChildToContinuation):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/RenderInline.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-10-13  Zalan Bujtas  <zalan@apple.com>
+
+        [Clean RenderTree] LayoutTests/imported/blink/fast/table/crash-bad-child-table-continuation.html fails.
+        https://bugs.webkit.org/show_bug.cgi?id=163399
+
+        Reviewed by David Hyatt.
+
+        When we try to insert a renderer before a child whose direct parent is a (anonymus) RenderTable, continuation logic
+        should dismiss the RenderTable as the parent and find a more appropriate ancestor.
+        RenderTables assumes a certain descendant tree structure which might not be available in the continuation.
+
+        Will be testable with webkit.org/b/162834
+
+        * rendering/RenderInline.cpp:
+        (WebCore::canUseAsParentForContinuation):
+        (WebCore::RenderInline::addChildToContinuation):
+
 2016-10-13  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/rendering/RenderInline.cpp

@@ -41 +41 @@
 #include "RenderListMarker.h"
 #include "RenderNamedFlowThread.h"
+#include "RenderTable.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
@@ -602 +603 @@
 }
 
+static bool canUseAsParentForContinuation(const RenderObject* renderer)
+{
+    if (!renderer)
+        return false;
+    if (!is<RenderBlock>(renderer) && renderer->isAnonymous())
+        return false;
+    if (is<RenderTable>(renderer))
+        return false;
+    return true;
+}
+
 void RenderInline::addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild)
 {
-    RenderBoxModelObject* flow = continuationBefore(beforeChild);
+    auto* flow = continuationBefore(beforeChild);
     // It may or may not be the direct parent of the beforeChild.
     RenderBoxModelObject* beforeChildAncestor = nullptr;
-    // In case of anonymous wrappers, the parent of the beforeChild is mostly irrelevant. What we need is
-    // the topmost wrapper.
-    if (beforeChild && !is<RenderBlock>(beforeChild->parent()) && beforeChild->parent()->isAnonymous()) {
-        RenderElement* anonymousParent = beforeChild->parent();
-        while (anonymousParent && anonymousParent->parent() && anonymousParent->parent()->isAnonymous())
-            anonymousParent = anonymousParent->parent();
-        ASSERT(anonymousParent && anonymousParent->parent());
-        beforeChildAncestor = downcast<RenderBoxModelObject>(anonymousParent->parent());
-    } else {
-        ASSERT(!beforeChild || is<RenderBlock>(*beforeChild->parent()) || is<RenderInline>(*beforeChild->parent()));
-        if (beforeChild)
-            beforeChildAncestor = downcast<RenderBoxModelObject>(beforeChild->parent());
-        else {
-            if (RenderBoxModelObject* continuation = nextContinuation(flow))
-                beforeChildAncestor = continuation;
-            else
-                beforeChildAncestor = flow;
-        }
-    }
+    // In case of anonymous wrappers, the parent of the beforeChild is mostly irrelevant. What we need is the topmost wrapper.
+    if (!beforeChild) {
+        auto* continuation = nextContinuation(flow);
+        beforeChildAncestor = continuation ? continuation : flow;
+    } else if (canUseAsParentForContinuation(beforeChild->parent()))
+        beforeChildAncestor = downcast<RenderBoxModelObject>(beforeChild->parent());
+    else if (beforeChild->parent()) {
+        auto* parent = beforeChild->parent();
+        while (parent && parent->parent() && parent->parent()->isAnonymous())
+            parent = parent->parent();
+        ASSERT(parent && parent->parent());
+        beforeChildAncestor = downcast<RenderBoxModelObject>(parent->parent());
+    } else
+        ASSERT_NOT_REACHED();
 
     if (newChild->isFloatingOrOutOfFlowPositioned())