⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 259296 in webkit


Ignore:
Timestamp:
Mar 31, 2020, 10:03:58 AM (6 years ago)
Author:
Alan Bujtas
Message:

[Tables] Infinite recursion in RenderTreeBuilder::attach
​https://bugs.webkit.org/show_bug.cgi?id=209771
<rdar://problem/59923112>

Reviewed by Simon Fraser.

Source/WebCore:

Let's construct a COLGROUP wrapper when a COL element is inserted into a <table>. The rest of the table code assumes such structure.
(​https://www.w3.org/TR/html52/tabular-data.html#the-col-element)

Test: fast/table/anonymous-colgroup-simple.html

  • rendering/RenderTableCol.cpp:

(WebCore::RenderTableCol::RenderTableCol):
(WebCore::RenderTableCol::updateFromElement):

  • rendering/RenderTableCol.h:
  • rendering/updating/RenderTreeBuilderTable.cpp:

(WebCore::RenderTreeBuilder::Table::findOrCreateParentForChild):

LayoutTests:

  • fast/table/anonymous-colgroup-simple-expected.txt: Added.
  • fast/table/anonymous-colgroup-simple.html: Added.
Location:
trunk
Files:
2 added
16 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r259294 r259296  
     12020-03-31  Zalan Bujtas  <zalan@apple.com>
     2
     3        [Tables] Infinite recursion in RenderTreeBuilder::attach
     4        https://bugs.webkit.org/show_bug.cgi?id=209771
     5        <rdar://problem/59923112>
     6
     7        Reviewed by Simon Fraser.
     8
     9        * fast/table/anonymous-colgroup-simple-expected.txt: Added.
     10        * fast/table/anonymous-colgroup-simple.html: Added.
     11
    1122020-03-31  Jason Lawrence  <lawrence.j@apple.com>
    213

  • trunk/LayoutTests/fast/table/table-insert-before-non-anonymous-block-expected.txt

    r97074 r259296  
    3939            RenderTableCell {DIV} at (0,0) size 50x0 [bgcolor=#0000FF] [r=0 c=0 rs=1 cs=1]
    4040            RenderTableCell {DIV} at (50,0) size 50x0 [bgcolor=#0000FF] [r=0 c=1 rs=1 cs=1]
    41         RenderTableCol {DIV} at (0,0) size 0x0
     41        RenderTableCol at (0,0) size 0x0
     42          RenderTableCol {DIV} at (0,0) size 0x0
    4243      RenderTable {DIV} at (0,300) size 101x50
    4344        RenderTableSection (anonymous) at (0,0) size 101x50

  • trunk/LayoutTests/platform/ios-wk1/fast/table/table-insert-before-non-anonymous-block-expected.txt

    r204944 r259296  
    3939            RenderTableCell {DIV} at (0,0) size 50x0 [bgcolor=#0000FF] [r=0 c=0 rs=1 cs=1]
    4040            RenderTableCell {DIV} at (50,0) size 50x0 [bgcolor=#0000FF] [r=0 c=1 rs=1 cs=1]
    41         RenderTableCol {DIV} at (0,0) size 0x0
     41        RenderTableCol at (0,0) size 0x0
     42          RenderTableCol {DIV} at (0,0) size 0x0
    4243      RenderTable {DIV} at (0,300) size 101x50
    4344        RenderTableSection (anonymous) at (0,0) size 101x50

  • trunk/LayoutTests/platform/ios/css2.1/20110323/margin-applies-to-006-expected.txt

    r195740 r259296  
    1010  RenderBlock (positioned) {DIV} at (8,52) size 240x240 [border: (10px solid #0000FF)]
    1111    RenderTable {DIV} at (10,10) size 220x220
    12       RenderTableCol {DIV} at (0,0) size 0x0
     12      RenderTableCol at (0,0) size 0x0
     13        RenderTableCol {DIV} at (0,0) size 0x0
    1314      RenderTableSection (anonymous) at (0,0) size 220x220
    1415        RenderTableRow {DIV} at (0,0) size 220x220

  • trunk/LayoutTests/platform/ios/fast/forms/form-hides-table-expected.txt

    r195740 r259296  
    143143      RenderBlock {DIV} at (0,554) size 784x0
    144144        RenderTable at (0,0) size 0x0
    145           RenderTableCol {DIV} at (0,0) size 0x0
     145          RenderTableCol at (0,0) size 0x0
     146            RenderTableCol {DIV} at (0,0) size 0x0
    146147      RenderBlock {DIV} at (0,554) size 784x42
    147148        RenderTable at (0,0) size 121x42

  • trunk/LayoutTests/platform/ios/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt

    r197635 r259296  
    88          text run at (0,0) width 417: "Test passes if there is a box with sharp or rounded corners below."
    99      RenderTable {DIV} at (0,36) size 102x102 [border: (1.50px none #000000)]
    10         RenderTableCol {DIV} at (0,0) size 0x0 [border: (3px solid #008000)]
     10        RenderTableCol at (0,0) size 0x0
     11          RenderTableCol {DIV} at (0,0) size 0x0 [border: (3px solid #008000)]
    1112        RenderTableSection (anonymous) at (1,1) size 100x100
    1213          RenderTableRow {DIV} at (0,0) size 99x99

  • trunk/LayoutTests/platform/ios/tables/mozilla_expected_failures/dom/appendCol1-expected.txt

    r191623 r259296  
    1818              RenderText {#text} at (2,2) size 24x19
    1919                text run at (2,2) width 24: "c12"
    20         RenderTableCol {COL} at (0,0) size 0x0
     20        RenderTableCol at (0,0) size 0x0
     21          RenderTableCol {COL} at (0,0) size 0x0
    2122      RenderBlock (anonymous) at (0,50) size 784x20
    2223        RenderBR {BR} at (0,0) size 0x19

  • trunk/LayoutTests/platform/mac/css2.1/20110323/margin-applies-to-006-expected.txt

    r195740 r259296  
    1010  RenderBlock (positioned) {DIV} at (8,50) size 240x240 [border: (10px solid #0000FF)]
    1111    RenderTable {DIV} at (10,10) size 220x220
    12       RenderTableCol {DIV} at (0,0) size 0x0
     12      RenderTableCol at (0,0) size 0x0
     13        RenderTableCol {DIV} at (0,0) size 0x0
    1314      RenderTableSection (anonymous) at (0,0) size 220x220
    1415        RenderTableRow {DIV} at (0,0) size 220x220

  • trunk/LayoutTests/platform/mac/fast/forms/form-hides-table-expected.txt

    r195740 r259296  
    143143      RenderBlock {DIV} at (0,526) size 769x0
    144144        RenderTable at (0,0) size 0x0
    145           RenderTableCol {DIV} at (0,0) size 0x0
     145          RenderTableCol at (0,0) size 0x0
     146            RenderTableCol {DIV} at (0,0) size 0x0
    146147      RenderBlock {DIV} at (0,526) size 769x40
    147148        RenderTable at (0,0) size 121x40

  • trunk/LayoutTests/platform/mac/fast/table/table-insert-before-non-anonymous-block-expected.txt

    r195740 r259296  
    3939            RenderTableCell {DIV} at (0,0) size 50x0 [bgcolor=#0000FF] [r=0 c=0 rs=1 cs=1]
    4040            RenderTableCell {DIV} at (50,0) size 50x0 [bgcolor=#0000FF] [r=0 c=1 rs=1 cs=1]
    41         RenderTableCol {DIV} at (0,0) size 0x0
     41        RenderTableCol at (0,0) size 0x0
     42          RenderTableCol {DIV} at (0,0) size 0x0
    4243      RenderTable {DIV} at (0,300) size 101x50
    4344        RenderTableSection (anonymous) at (0,0) size 101x50

  • trunk/LayoutTests/platform/mac/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt

    r195740 r259296  
    88          text run at (0,0) width 417: "Test passes if there is a box with sharp or rounded corners below."
    99      RenderTable {DIV} at (0,34) size 102x102 [border: (1px none #000000)]
    10         RenderTableCol {DIV} at (0,0) size 0x0 [border: (3px solid #008000)]
     10        RenderTableCol at (0,0) size 0x0
     11          RenderTableCol {DIV} at (0,0) size 0x0 [border: (3px solid #008000)]
    1112        RenderTableSection (anonymous) at (1,1) size 99x99
    1213          RenderTableRow {DIV} at (0,0) size 99x99

  • trunk/LayoutTests/platform/mac/tables/mozilla_expected_failures/dom/appendCol1-expected.txt

    r191623 r259296  
    1818              RenderText {#text} at (2,2) size 24x18
    1919                text run at (2,2) width 24: "c12"
    20         RenderTableCol {COL} at (0,0) size 0x0
     20        RenderTableCol at (0,0) size 0x0
     21          RenderTableCol {COL} at (0,0) size 0x0
    2122      RenderBlock (anonymous) at (0,46) size 784x18
    2223        RenderBR {BR} at (0,0) size 0x18

  • trunk/Source/WebCore/ChangeLog

    r259290 r259296  
     12020-03-31  Zalan Bujtas  <zalan@apple.com>
     2
     3        [Tables] Infinite recursion in RenderTreeBuilder::attach
     4        https://bugs.webkit.org/show_bug.cgi?id=209771
     5        <rdar://problem/59923112>
     6
     7        Reviewed by Simon Fraser.
     8
     9        Let's construct a COLGROUP wrapper when a COL element is inserted into a <table>. The rest of the table code assumes such structure.
     10        (https://www.w3.org/TR/html52/tabular-data.html#the-col-element)
     11
     12        Test: fast/table/anonymous-colgroup-simple.html
     13
     14        * rendering/RenderTableCol.cpp:
     15        (WebCore::RenderTableCol::RenderTableCol):
     16        (WebCore::RenderTableCol::updateFromElement):
     17        * rendering/RenderTableCol.h:
     18        * rendering/updating/RenderTreeBuilderTable.cpp:
     19        (WebCore::RenderTreeBuilder::Table::findOrCreateParentForChild):
     20
    1212020-03-31  youenn fablet  <youenn@apple.com>
    222

  • trunk/Source/WebCore/rendering/RenderTableCol.cpp

    r232178 r259296  
    5050}
    5151
     52RenderTableCol::RenderTableCol(Document& document, RenderStyle&& style)
     53    : RenderBox(document, WTFMove(style), 0)
     54{
     55    setInline(true);
     56}
     57
    5258void RenderTableCol::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
    5359{
    … …  
    7884void RenderTableCol::updateFromElement()
    7985{
     86    ASSERT(element());
    8087    unsigned oldSpan = m_span;
    81     if (element().hasTagName(colTag) || element().hasTagName(colgroupTag)) {
    82         HTMLTableColElement& tc = static_cast<HTMLTableColElement&>(element());
     88    if (element()->hasTagName(colTag) || element()->hasTagName(colgroupTag)) {
     89        HTMLTableColElement& tc = static_cast<HTMLTableColElement&>(*element());
    8390        m_span = tc.span();
    8491    } else

  • trunk/Source/WebCore/rendering/RenderTableCol.h

    r232178 r259296  
    3737public:
    3838    RenderTableCol(Element&, RenderStyle&&);
    39     Element& element() const { return downcast<Element>(nodeForNonAnonymous()); }
     39    RenderTableCol(Document&, RenderStyle&&);
    4040
    4141    void clearPreferredLogicalWidthsDirtyBits();

  • trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

    r256089 r259296  
    5353    }
    5454
     55    auto createAnonymousTableCell = [&] (auto& parent) -> RenderTableCell& {
     56        auto newCell = RenderTableCell::createAnonymousWithParentRenderer(parent);
     57        auto& cell = *newCell;
     58        m_builder.attach(parent, WTFMove(newCell), beforeChild);
     59        beforeChild = nullptr;
     60        return cell;
     61    };
     62
    5563    auto* lastChild = beforeChild ? beforeChild : parent.lastCell();
    5664    if (lastChild) {
    … …  
    6472        if (auto* lastChildParent = lastChild->parent()) {
    6573            if (lastChildParent->isAnonymous() && !lastChildParent->isBeforeOrAfterContent()) {
     74                // If beforeChild is inside an anonymous COLGROUP, create a cell for the new renderer.
     75                if (is<RenderTableCol>(*lastChildParent))
     76                    return createAnonymousTableCell(parent);
    6677                // If beforeChild is inside an anonymous cell, insert into the cell.
    6778                if (!is<RenderTableCell>(*lastChild))
    6879                    return *lastChildParent;
    6980                // If beforeChild is inside an anonymous row, insert into the row.
    70                 if (is<RenderTableRow>(*lastChildParent)) {
    71                     auto newCell = RenderTableCell::createAnonymousWithParentRenderer(parent);
    72                     auto& cell = *newCell;
    73                     m_builder.attach(*lastChildParent, WTFMove(newCell), beforeChild);
    74                     beforeChild = nullptr;
    75                     return cell;
    76                 }
     81                if (is<RenderTableRow>(*lastChildParent))
     82                    return createAnonymousTableCell(downcast<RenderTableRow>(*lastChildParent));
    7783            }
    7884        }
    7985    }
    80     auto newCell = RenderTableCell::createAnonymousWithParentRenderer(parent);
    81     auto& cell = *newCell;
    82     m_builder.attach(parent, WTFMove(newCell), beforeChild);
    83     beforeChild = nullptr;
    84     return cell;
     86    return createAnonymousTableCell(parent);
    8587}
    8688
    … …  
    122124RenderElement& RenderTreeBuilder::Table::findOrCreateParentForChild(RenderTable& parent, const RenderObject& child, RenderObject*& beforeChild)
    123125{
    124     if (is<RenderTableCaption>(child) || is<RenderTableCol>(child) || is<RenderTableSection>(child))
     126    if (is<RenderTableCaption>(child) || is<RenderTableSection>(child))
    125127        return parent;
     128
     129    if (is<RenderTableCol>(child)) {
     130        if (!child.node() || child.style().display() == DisplayType::TableColumnGroup) {
     131            // COLGROUPs and anonymous RenderTableCols (generated wrappers for COLs) are direct children of the table renderer.
     132            return parent;
     133        }
     134        auto newColGroup = createRenderer<RenderTableCol>(parent.document(), RenderStyle::createAnonymousStyleWithDisplay(parent.style(), DisplayType::TableColumnGroup));
     135        newColGroup->initializeStyle();
     136        auto& colGroup = *newColGroup;
     137        m_builder.attach(parent, WTFMove(newColGroup), beforeChild);
     138        beforeChild = nullptr;
     139        return colGroup;
     140    }
    126141
    127142    auto* lastChild = parent.lastChild();
    … …  
    144159        parentCandidate = parentCandidate->parent();
    145160
    146     if (parentCandidate && is<RenderTableSection>(*parentCandidate) && parentCandidate->isAnonymous() && !parent.isAfterContent(parentCandidate)) {
    147         if (beforeChild == parentCandidate)
    148             beforeChild = downcast<RenderTableSection>(*parentCandidate).firstRow();
    149         return downcast<RenderElement>(*parentCandidate);
     161    if (parentCandidate) {
     162        if (beforeChild && !beforeChild->isAnonymous() && parentCandidate->parent() == &parent) {
     163            auto* section = parentCandidate->previousSibling();
     164            if (is<RenderTableSection>(section) && section->isAnonymous()) {
     165                beforeChild = nullptr;
     166                return downcast<RenderElement>(*section);
     167            }
     168        }
     169
     170        if (is<RenderTableSection>(*parentCandidate) && parentCandidate->isAnonymous() && !parent.isAfterContent(parentCandidate)) {
     171            if (beforeChild == parentCandidate)
     172                beforeChild = downcast<RenderTableSection>(*parentCandidate).firstRow();
     173            return downcast<RenderElement>(*parentCandidate);
     174        }
    150175    }
    151176
Note: See TracChangeset for help on using the changeset viewer.