⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 243593 in webkit


Ignore:
Timestamp:
Mar 27, 2019, 4:56:26 PM (7 years ago)
Author:
Alan Coon
Message:

Cherry-pick r242943. rdar://problem/49307995

Cleanup inline boxes when list marker gets blockified
​https://bugs.webkit.org/show_bug.cgi?id=195746
<rdar://problem/48049175>

Reviewed by Antti Koivisto.

Source/WebCore:

Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
change does not require a new renderer.
This patch takes care of destroying the inline boxtree when the marker gains block display type.

Test: fast/block/float/list-marker-is-float-crash.html

  • rendering/RenderListMarker.cpp: (WebCore::RenderListMarker::styleDidChange):

LayoutTests:

  • fast/block/float/list-marker-is-float-crash-expected.txt: Added.
  • fast/block/float/list-marker-is-float-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242943 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-607-branch
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-607-branch/LayoutTests/ChangeLog

    r243584 r243593  
     12019-03-27  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r242943. rdar://problem/49307995
     4
     5    Cleanup inline boxes when list marker gets blockified
     6    https://bugs.webkit.org/show_bug.cgi?id=195746
     7    <rdar://problem/48049175>
     8   
     9    Reviewed by Antti Koivisto.
     10   
     11    Source/WebCore:
     12   
     13    Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
     14    During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
     15    change does not require a new renderer.
     16    This patch takes care of destroying the inline boxtree when the marker gains block display type.
     17   
     18    Test: fast/block/float/list-marker-is-float-crash.html
     19   
     20    * rendering/RenderListMarker.cpp:
     21    (WebCore::RenderListMarker::styleDidChange):
     22   
     23    LayoutTests:
     24   
     25    * fast/block/float/list-marker-is-float-crash-expected.txt: Added.
     26    * fast/block/float/list-marker-is-float-crash.html: Added.
     27   
     28    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     29
     30    2019-03-14  Zalan Bujtas  <zalan@apple.com>
     31
     32            Cleanup inline boxes when list marker gets blockified
     33            https://bugs.webkit.org/show_bug.cgi?id=195746
     34            <rdar://problem/48049175>
     35
     36            Reviewed by Antti Koivisto.
     37
     38            * fast/block/float/list-marker-is-float-crash-expected.txt: Added.
     39            * fast/block/float/list-marker-is-float-crash.html: Added.
     40
    1412019-03-27  Alan Coon  <alancoon@apple.com>
    242

  • branches/safari-607-branch/Source/WebCore/ChangeLog

    r243592 r243593  
     12019-03-27  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r242943. rdar://problem/49307995
     4
     5    Cleanup inline boxes when list marker gets blockified
     6    https://bugs.webkit.org/show_bug.cgi?id=195746
     7    <rdar://problem/48049175>
     8   
     9    Reviewed by Antti Koivisto.
     10   
     11    Source/WebCore:
     12   
     13    Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
     14    During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
     15    change does not require a new renderer.
     16    This patch takes care of destroying the inline boxtree when the marker gains block display type.
     17   
     18    Test: fast/block/float/list-marker-is-float-crash.html
     19   
     20    * rendering/RenderListMarker.cpp:
     21    (WebCore::RenderListMarker::styleDidChange):
     22   
     23    LayoutTests:
     24   
     25    * fast/block/float/list-marker-is-float-crash-expected.txt: Added.
     26    * fast/block/float/list-marker-is-float-crash.html: Added.
     27   
     28    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     29
     30    2019-03-14  Zalan Bujtas  <zalan@apple.com>
     31
     32            Cleanup inline boxes when list marker gets blockified
     33            https://bugs.webkit.org/show_bug.cgi?id=195746
     34            <rdar://problem/48049175>
     35
     36            Reviewed by Antti Koivisto.
     37
     38            Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
     39            During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
     40            change does not require a new renderer.
     41            This patch takes care of destroying the inline boxtree when the marker gains block display type.
     42
     43            Test: fast/block/float/list-marker-is-float-crash.html
     44
     45            * rendering/RenderListMarker.cpp:
     46            (WebCore::RenderListMarker::styleDidChange):
     47
    1482019-03-27  Alan Coon  <alancoon@apple.com>
    249

  • branches/safari-607-branch/Source/WebCore/rendering/RenderListMarker.cpp

    r243574 r243593  
    11461146    RenderBox::styleDidChange(diff, oldStyle);
    11471147
    1148     if (oldStyle && (style().listStylePosition() != oldStyle->listStylePosition() || style().listStyleType() != oldStyle->listStyleType()))
    1149         setNeedsLayoutAndPrefWidthsRecalc();
     1148    if (oldStyle) {
     1149        if (style().listStylePosition() != oldStyle->listStylePosition() || style().listStyleType() != oldStyle->listStyleType())
     1150            setNeedsLayoutAndPrefWidthsRecalc();
     1151        if (oldStyle->isDisplayInlineType() && !style().isDisplayInlineType()) {
     1152            delete m_inlineBoxWrapper;
     1153            m_inlineBoxWrapper = nullptr;
     1154        }
     1155    }
    11501156
    11511157    if (m_image != style().listStyleImage()) {
Note: See TracChangeset for help on using the changeset viewer.