⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 245353 in webkit


Ignore:
Timestamp:
May 15, 2019, 2:44:58 PM (7 years ago)
Author:
Alan Coon
Message:

Cherry-pick r245158. rdar://problem/50753914

Do not mix inline and block level boxes.
​https://bugs.webkit.org/show_bug.cgi?id=197462
<rdar://problem/50369362>

Reviewed by Antti Koivisto.

Source/WebCore:

This patch tightens the remove-anonymous-wrappers logic by checking if the removal would
produce an inline-block sibling mix.
When a block level box is removed from the tree, we check if after the removal the anonymous sibling block
boxes are still needed or whether we can removed them as well (and have only inline level child boxes).
In addition to checking if the container is anonymous and is part of a continuation, we also need to check
if collapsing it (and by that moving its children one level up) would cause a inline-block box mix.

Test: fast/ruby/continuation-and-column-spanner-crash.html

  • rendering/updating/RenderTreeBuilder.cpp: (WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):
  • rendering/updating/RenderTreeBuilderContinuation.cpp: (WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):

LayoutTests:

  • fast/ruby/continuation-and-column-spanner-crash-expected.txt: Added.
  • fast/ruby/continuation-and-column-spanner-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245158 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-607-branch
Files:
2 added
4 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-607-branch/LayoutTests/ChangeLog

    r245346 r245353  
     12019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r245158. rdar://problem/50753914
     4
     5    Do not mix inline and block level boxes.
     6    https://bugs.webkit.org/show_bug.cgi?id=197462
     7    <rdar://problem/50369362>
     8   
     9    Reviewed by Antti Koivisto.
     10   
     11    Source/WebCore:
     12   
     13    This patch tightens the remove-anonymous-wrappers logic by checking if the removal would
     14    produce an inline-block sibling mix.
     15    When a block level box is removed from the tree, we check if after the removal the anonymous sibling block
     16    boxes are still needed or whether we can removed them as well (and have only inline level child boxes).
     17    In addition to checking if the container is anonymous and is part of a continuation, we also need to check
     18    if collapsing it (and by that moving its children one level up) would cause a inline-block box mix.
     19   
     20    Test: fast/ruby/continuation-and-column-spanner-crash.html
     21   
     22    * rendering/updating/RenderTreeBuilder.cpp:
     23    (WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):
     24    * rendering/updating/RenderTreeBuilderContinuation.cpp:
     25    (WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):
     26   
     27    LayoutTests:
     28   
     29    * fast/ruby/continuation-and-column-spanner-crash-expected.txt: Added.
     30    * fast/ruby/continuation-and-column-spanner-crash.html: Added.
     31   
     32    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245158 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     33
     34    2019-05-08  Zalan Bujtas  <zalan@apple.com>
     35
     36            Do not mix inline and block level boxes.
     37            https://bugs.webkit.org/show_bug.cgi?id=197462
     38            <rdar://problem/50369362>
     39
     40            Reviewed by Antti Koivisto.
     41
     42            * fast/ruby/continuation-and-column-spanner-crash-expected.txt: Added.
     43            * fast/ruby/continuation-and-column-spanner-crash.html: Added.
     44
    1452019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
    246

  • branches/safari-607-branch/Source/WebCore/ChangeLog

    r245347 r245353  
     12019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r245158. rdar://problem/50753914
     4
     5    Do not mix inline and block level boxes.
     6    https://bugs.webkit.org/show_bug.cgi?id=197462
     7    <rdar://problem/50369362>
     8   
     9    Reviewed by Antti Koivisto.
     10   
     11    Source/WebCore:
     12   
     13    This patch tightens the remove-anonymous-wrappers logic by checking if the removal would
     14    produce an inline-block sibling mix.
     15    When a block level box is removed from the tree, we check if after the removal the anonymous sibling block
     16    boxes are still needed or whether we can removed them as well (and have only inline level child boxes).
     17    In addition to checking if the container is anonymous and is part of a continuation, we also need to check
     18    if collapsing it (and by that moving its children one level up) would cause a inline-block box mix.
     19   
     20    Test: fast/ruby/continuation-and-column-spanner-crash.html
     21   
     22    * rendering/updating/RenderTreeBuilder.cpp:
     23    (WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):
     24    * rendering/updating/RenderTreeBuilderContinuation.cpp:
     25    (WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):
     26   
     27    LayoutTests:
     28   
     29    * fast/ruby/continuation-and-column-spanner-crash-expected.txt: Added.
     30    * fast/ruby/continuation-and-column-spanner-crash.html: Added.
     31   
     32    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245158 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     33
     34    2019-05-09  Zalan Bujtas  <zalan@apple.com>
     35
     36            Do not mix inline and block level boxes.
     37            https://bugs.webkit.org/show_bug.cgi?id=197462
     38            <rdar://problem/50369362>
     39
     40            Reviewed by Antti Koivisto.
     41
     42            This patch tightens the remove-anonymous-wrappers logic by checking if the removal would
     43            produce an inline-block sibling mix.
     44            When a block level box is removed from the tree, we check if after the removal the anonymous sibling block
     45            boxes are still needed or whether we can removed them as well (and have only inline level child boxes).
     46            In addition to checking if the container is anonymous and is part of a continuation, we also need to check
     47            if collapsing it (and by that moving its children one level up) would cause a inline-block box mix.
     48
     49            Test: fast/ruby/continuation-and-column-spanner-crash.html
     50
     51            * rendering/updating/RenderTreeBuilder.cpp:
     52            (WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):
     53            * rendering/updating/RenderTreeBuilderContinuation.cpp:
     54            (WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):
     55
    1562019-05-14  Kocsen Chung  <kocsen_chung@apple.com>
    257

  • branches/safari-607-branch/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp

    r238888 r245353  
    684684    // FIXME: We should also handle split inlines here - we exclude them at the moment by returning
    685685    // if we find a continuation.
    686     auto* current = blockParent.firstChild();
    687     while (current && ((current->isAnonymousBlock() && !downcast<RenderBlock>(*current).isContinuation()) || current->style().isFloating() || current->style().hasOutOfFlowPosition()))
    688         current = current->nextSibling();
    689 
    690     if (current)
    691         return;
    692 
    693     RenderObject* next;
    694     for (current = blockParent.firstChild(); current; current = next) {
     686    Optional<bool> shouldAllChildrenBeInline;
     687    for (auto* current = blockParent.firstChild(); current; current = current->nextSibling()) {
     688        if (current->style().isFloating() || current->style().hasOutOfFlowPosition())
     689            continue;
     690        if (!current->isAnonymousBlock() || downcast<RenderBlock>(*current).isContinuation())
     691            return;
     692        // Anonymous block not in continuation. Check if it holds a set of inline or block children and try not to mix them.
     693        auto* firstChild = current->firstChildSlow();
     694        if (!firstChild)
     695            continue;
     696        auto isInlineLevelBox = firstChild->isInline();
     697        if (!shouldAllChildrenBeInline.hasValue()) {
     698            shouldAllChildrenBeInline = isInlineLevelBox;
     699            continue;
     700        }
     701        // Mixing inline and block level boxes?
     702        if (*shouldAllChildrenBeInline != isInlineLevelBox)
     703            return;
     704    }
     705
     706    RenderObject* next = nullptr;
     707    for (auto* current = blockParent.firstChild(); current; current = next) {
    695708        next = current->nextSibling();
    696709        if (current->isAnonymousBlock())

  • branches/safari-607-branch/Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.cpp

    r228938 r245353  
    3838void RenderTreeBuilder::Continuation::cleanupOnDestroy(RenderBoxModelObject& renderer)
    3939{
    40     if (!renderer.continuation() || renderer.isContinuation())
     40    if (!renderer.continuation() || renderer.isContinuation()) {
     41        if (renderer.hasContinuationChainNode())
     42            renderer.removeFromContinuationChain();
    4143        return;
     44    }
    4245
    4346    ASSERT(renderer.hasContinuationChainNode());
Note: See TracChangeset for help on using the changeset viewer.