⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 207804 in webkit


Ignore:
Timestamp:
Oct 24, 2016, 9:19:09 PM (10 years ago)
Author:
Alan Bujtas
Message:

Do not update selection rect on dirty lineboxes.
​https://bugs.webkit.org/show_bug.cgi?id=163862
<rdar://problem/28813156>

Reviewed by Simon Fraser.

Source/WebCore:

In certain cases RenderBlock::updateFirstLetter() triggers
unwanted render tree mutation while the caller assumes intact renderers.
This patch ensures that no renderers gets destroyed while computing the preferred widths
when we are outside of layout context.

Test: fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html

  • rendering/RenderBlock.cpp:

(WebCore::RenderBlock::computePreferredLogicalWidths):
(WebCore::RenderBlock::updateFirstLetter):

  • rendering/RenderBlock.h:
  • rendering/RenderListItem.cpp:

(WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):

  • rendering/RenderRubyRun.cpp:

(WebCore::RenderRubyRun::updateFirstLetter):

  • rendering/RenderRubyRun.h:
  • rendering/RenderTable.cpp:

(WebCore::RenderTable::updateFirstLetter):

  • rendering/RenderTable.h:
  • rendering/svg/RenderSVGText.cpp:

(WebCore::RenderSVGText::updateFirstLetter):

  • rendering/svg/RenderSVGText.h:

LayoutTests:

  • fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt: Added.
  • fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html: Added.
Location:
trunk
Files:
2 added
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r207803 r207804  
     12016-10-24  Zalan Bujtas  <zalan@apple.com>
     2
     3        Do not update selection rect on dirty lineboxes.
     4        https://bugs.webkit.org/show_bug.cgi?id=163862
     5        <rdar://problem/28813156>
     6
     7        Reviewed by Simon Fraser.
     8
     9        * fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt: Added.
     10        * fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html: Added.
     11
    1122016-10-24  Ryan Haddad  <ryanhaddad@apple.com>
    213

  • trunk/Source/WebCore/ChangeLog

    r207803 r207804  
     12016-10-24  Zalan Bujtas  <zalan@apple.com>
     2
     3        Do not update selection rect on dirty lineboxes.
     4        https://bugs.webkit.org/show_bug.cgi?id=163862
     5        <rdar://problem/28813156>
     6
     7        Reviewed by Simon Fraser.
     8
     9        In certain cases RenderBlock::updateFirstLetter() triggers
     10        unwanted render tree mutation while the caller assumes intact renderers.
     11        This patch ensures that no renderers gets destroyed while computing the preferred widths
     12        when we are outside of layout context.
     13
     14        Test: fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html
     15
     16        * rendering/RenderBlock.cpp:
     17        (WebCore::RenderBlock::computePreferredLogicalWidths):
     18        (WebCore::RenderBlock::updateFirstLetter):
     19        * rendering/RenderBlock.h:
     20        * rendering/RenderListItem.cpp:
     21        (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
     22        * rendering/RenderRubyRun.cpp:
     23        (WebCore::RenderRubyRun::updateFirstLetter):
     24        * rendering/RenderRubyRun.h:
     25        * rendering/RenderTable.cpp:
     26        (WebCore::RenderTable::updateFirstLetter):
     27        * rendering/RenderTable.h:
     28        * rendering/svg/RenderSVGText.cpp:
     29        (WebCore::RenderSVGText::updateFirstLetter):
     30        * rendering/svg/RenderSVGText.h:
     31
    1322016-10-24  Ryan Haddad  <ryanhaddad@apple.com>
    233

  • trunk/Source/WebCore/rendering/RenderBlock.cpp

    r207499 r207804  
    27562756    ASSERT(preferredLogicalWidthsDirty());
    27572757
    2758     updateFirstLetter();
     2758    // FIXME: Do not even try to reshuffle first letter renderers when we are not in layout
     2759    // until after webkit.org/b/163848 is fixed.
     2760    updateFirstLetter(view().frameView().isInRenderTreeLayout() ? RenderTreeMutationIsAllowed::Yes : RenderTreeMutationIsAllowed::No);
    27592761
    27602762    m_minPreferredLogicalWidth = 0;
    … …  
    33063308}
    33073309
    3308 void RenderBlock::updateFirstLetter()
     3310void RenderBlock::updateFirstLetter(RenderTreeMutationIsAllowed mutationAllowedOrNot)
    33093311{
    33103312    RenderObject* firstLetterObj;
    … …  
    33273329        return;
    33283330
     3331    if (mutationAllowedOrNot != RenderTreeMutationIsAllowed::Yes)
     3332        return;
    33293333    // Our layout state is not valid for the repaints we are going to trigger by
    33303334    // adding and removing children of firstLetterContainer.

  • trunk/Source/WebCore/rendering/RenderBlock.h

    r205787 r207804  
    246246    LayoutUnit collapsedMarginAfterForChild(const RenderBox& child) const;
    247247
    248     virtual void updateFirstLetter();
     248    enum class RenderTreeMutationIsAllowed { Yes, No };
     249    virtual void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes);
    249250    void getFirstLetter(RenderObject*& firstLetter, RenderElement*& firstLetterContainer, RenderObject* skipObject = nullptr);
    250251

  • trunk/Source/WebCore/rendering/RenderListItem.cpp

    r207683 r207804  
    269269        return;
    270270
    271     // FIXME: Do not even try reposition the marker when we are not in layout
     271    // FIXME: Do not even try to reposition the marker when we are not in layout
    272272    // until after we fixed webkit.org/b/163789.
    273273    if (!view().frameView().isInRenderTreeLayout())

  • trunk/Source/WebCore/rendering/RenderRubyRun.cpp

    r207275 r207804  
    102102}
    103103
    104 void RenderRubyRun::updateFirstLetter()
     104void RenderRubyRun::updateFirstLetter(RenderTreeMutationIsAllowed)
    105105{
    106106}

  • trunk/Source/WebCore/rendering/RenderRubyRun.h

    r207275 r207804  
    6262
    6363    RenderBlock* firstLineBlock() const override;
    64     void updateFirstLetter() override;
     64    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) override;
    6565
    6666    void getOverhang(bool firstLine, RenderObject* startRenderer, RenderObject* endRenderer, float& startOverhang, float& endOverhang) const;

  • trunk/Source/WebCore/rendering/RenderTable.cpp

    r203708 r207804  
    14591459}
    14601460
    1461 void RenderTable::updateFirstLetter()
     1461void RenderTable::updateFirstLetter(RenderTreeMutationIsAllowed)
    14621462{
    14631463}

  • trunk/Source/WebCore/rendering/RenderTable.h

    r203708 r207804  
    304304
    305305    RenderBlock* firstLineBlock() const final;
    306     void updateFirstLetter() final;
     306    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) final;
    307307   
    308308    void updateLogicalWidth() final;

  • trunk/Source/WebCore/rendering/svg/RenderSVGText.cpp

    r201635 r207804  
    546546// Fix for <rdar://problem/8048875>. We should not render :first-letter CSS Style
    547547// in a SVG text element context.
    548 void RenderSVGText::updateFirstLetter()
    549 {
    550 }
    551 
    552 }
     548void RenderSVGText::updateFirstLetter(RenderTreeMutationIsAllowed)
     549{
     550}
     551
     552}

  • trunk/Source/WebCore/rendering/svg/RenderSVGText.h

    r201704 r207804  
    9393
    9494    RenderBlock* firstLineBlock() const override;
    95     void updateFirstLetter() override;
     95    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) override;
    9696
    9797    bool shouldHandleSubtreeMutations() const;
Note: See TracChangeset for help on using the changeset viewer.