Changeset 242943 in webkit

Timestamp:

Mar 14, 2019, 9:21:34 AM (7 years ago)

Author:

Alan Bujtas

Message:

Cleanup inline boxes when list marker gets blockified
​https://bugs.webkit.org/show_bug.cgi?id=195746
<rdar://problem/48049175>

Reviewed by Antti Koivisto.

Source/WebCore:

Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
change does not require a new renderer.
This patch takes care of destroying the inline boxtree when the marker gains block display type.

Test: fast/block/float/list-marker-is-float-crash.html

• rendering/RenderListMarker.cpp:

(WebCore::RenderListMarker::styleDidChange):

LayoutTests:

• fast/block/float/list-marker-is-float-crash-expected.txt: Added.
• fast/block/float/list-marker-is-float-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/block/float/list-marker-is-float-crash-expected.txt (added)
• LayoutTests/fast/block/float/list-marker-is-float-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderListMarker.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-03-14  Zalan Bujtas  <zalan@apple.com>
+
+        Cleanup inline boxes when list marker gets blockified
+        https://bugs.webkit.org/show_bug.cgi?id=195746
+        <rdar://problem/48049175>
+
+        Reviewed by Antti Koivisto.
+
+        * fast/block/float/list-marker-is-float-crash-expected.txt: Added.
+        * fast/block/float/list-marker-is-float-crash.html: Added.
+
 2019-03-14  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-03-14  Zalan Bujtas  <zalan@apple.com>
+
+        Cleanup inline boxes when list marker gets blockified
+        https://bugs.webkit.org/show_bug.cgi?id=195746
+        <rdar://problem/48049175>
+
+        Reviewed by Antti Koivisto.
+
+        Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
+        During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
+        change does not require a new renderer.
+        This patch takes care of destroying the inline boxtree when the marker gains block display type. 
+
+        Test: fast/block/float/list-marker-is-float-crash.html
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::styleDidChange):
+
 2019-03-14  Devin Rousso  <drousso@apple.com>
 

trunk/Source/WebCore/rendering/RenderListMarker.cpp

@@ -1145 +1145 @@
     RenderBox::styleDidChange(diff, oldStyle);
 
-    if (oldStyle && (style().listStylePosition() != oldStyle->listStylePosition() || style().listStyleType() != oldStyle->listStyleType()))
-        setNeedsLayoutAndPrefWidthsRecalc();
+    if (oldStyle) {
+        if (style().listStylePosition() != oldStyle->listStylePosition() || style().listStyleType() != oldStyle->listStyleType())
+            setNeedsLayoutAndPrefWidthsRecalc();
+        if (oldStyle->isDisplayInlineType() && !style().isDisplayInlineType()) {
+            delete m_inlineBoxWrapper;
+            m_inlineBoxWrapper = nullptr;
+        }
+    }
 
     if (m_image != style().listStyleImage()) {