Changeset 274630 in webkit

Timestamp:

Mar 18, 2021, 3:10:14 AM (5 years ago)

Author:

svillar@igalia.com

Message:

Invalidate RenderTreePosition's next sibling with display:contents
​https://bugs.webkit.org/show_bug.cgi?id=218578

Reviewed by Antti Koivisto.

When inserting elements in the tree from JS it might happen that the renderTreePosition() in the RenderTreeUpdater
caches a nextSibling() value which is only temporarily correct because we sequentially process the descendants of a
given root node in RenderTreeUpdater::updateRenderTree(). One of those potentially incorrect scenarios is when
using display:contents. We can detect those cases because we would leave a parent element in RenderTreeUpdater::popParent()
without changing renderingParent() and so without changing renderTreePosition(). Once we are in that situation we
must invalidate the cached position so the next sibling is recomputed.

• rendering/updating/RenderTreeUpdater.cpp:

(WebCore::RenderTreeUpdater::popParent): Invalidate the render tree position's next sibling if the parent element is not
the renderingParent().

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/updating/RenderTreeUpdater.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-02-26  Sergio Villar Senin  <svillar@igalia.com>
+
+        Invalidate RenderTreePosition's next sibling with display:contents
+        https://bugs.webkit.org/show_bug.cgi?id=218578
+
+        Reviewed by Antti Koivisto.
+
+        When inserting elements in the tree from JS it might happen that the renderTreePosition() in the RenderTreeUpdater
+        caches a nextSibling() value which is only temporarily correct because we sequentially process the descendants of a
+        given root node in RenderTreeUpdater::updateRenderTree(). One of those potentially incorrect scenarios is when
+        using display:contents. We can detect those cases because we would leave a parent element in RenderTreeUpdater::popParent()
+        without changing renderingParent() and so without changing renderTreePosition(). Once we are in that situation we
+        must invalidate the cached position so the next sibling is recomputed.
+
+        * rendering/updating/RenderTreeUpdater.cpp:
+        (WebCore::RenderTreeUpdater::popParent): Invalidate the render tree position's next sibling if the parent element is not
+        the renderingParent().
+
 2021-03-18  Carlos Garcia Campos  <cgarcia@igalia.com>
 

trunk/Source/WebCore/rendering/updating/RenderTreeUpdater.cpp

@@ -238 +238 @@
         updateAfterDescendants(*parent.element, parent.updates);
 
+    if (&parent != &renderingParent())
+        renderTreePosition().invalidateNextSibling();
+
     m_parentStack.removeLast();
 }