Changeset 207984 in webkit

Timestamp:

Oct 27, 2016, 3:45:54 AM (10 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r207683 - Do not mutate the render tree while collecting selection repaint rects.
​https://bugs.webkit.org/show_bug.cgi?id=163800
<rdar://problem/28806886>

Reviewed by David Hyatt.

Source/WebCore:

RenderListItem not only mutates the tree while in layout but it also uses
the old descendant context to find the insertion point.
This patch strictly ensures that we only do it while in layout and never
in other cases such as collecting repaint rects.
This gets redundant when webkit.org/b/163789 is fixed.

Test: fast/lists/crash-when-list-marker-is-moved-during-selection.html

• rendering/RenderListItem.cpp:

(WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):

LayoutTests:

• fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt: Added.
• fast/lists/crash-when-list-marker-is-moved-during-selection.html: Added.

Location:

releases/WebKitGTK/webkit-2.14

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt (added)
• LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderListItem.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog

@@ +1 @@
+2016-10-21  Zalan Bujtas  <zalan@apple.com>
+
+        Do not mutate the render tree while collecting selection repaint rects.
+        https://bugs.webkit.org/show_bug.cgi?id=163800
+        <rdar://problem/28806886>
+
+        Reviewed by David Hyatt.
+
+        * fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt: Added.
+        * fast/lists/crash-when-list-marker-is-moved-during-selection.html: Added.
+
 2016-10-20  Zalan Bujtas  <zalan@apple.com>
 

releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog

@@ +1 @@
+2016-10-21  Zalan Bujtas  <zalan@apple.com>
+
+        Do not mutate the render tree while collecting selection repaint rects.
+        https://bugs.webkit.org/show_bug.cgi?id=163800
+        <rdar://problem/28806886>
+
+        Reviewed by David Hyatt.
+
+        RenderListItem not only mutates the tree while in layout but it also uses
+        the old descendant context to find the insertion point.
+        This patch strictly ensures that we only do it while in layout and never
+        in other cases such as collecting repaint rects.
+        This gets redundant when webkit.org/b/163789 is fixed.
+
+        Test: fast/lists/crash-when-list-marker-is-moved-during-selection.html
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
+
 2016-10-20  Carlos Garcia Campos  <cgarcia@igalia.com>
 

releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp

@@ -267 +267 @@
     // Sanity check the location of our marker.
     if (!m_marker)
+        return;
+
+    // FIXME: Do not even try reposition the marker when we are not in layout
+    // until after we fixed webkit.org/b/163789.
+    if (!view().frameView().isInRenderTreeLayout())
         return;