Changeset 276014 in webkit

Timestamp:

Apr 15, 2021, 3:07:42 AM (6 years ago)

Author:

Alan Bujtas

Message:

[RenderTreeBuilder] Cleanup the inline tree when moving subtrees
​https://bugs.webkit.org/show_bug.cgi?id=224342
<rdar://76349279>

Reviewed by Antti Koivisto.

When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should be invalidated. The safest way to do this is
to destroy the inline tree (the "subtree moving" will eventually be replaced by "destroy followed by construct" activity).

• rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::move):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• rendering/updating/RenderTreeBuilder.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-04-15  Zalan Bujtas  <zalan@apple.com>
+
+        [RenderTreeBuilder] Cleanup the inline tree when moving subtrees
+        https://bugs.webkit.org/show_bug.cgi?id=224342
+        <rdar://76349279>
+
+        Reviewed by Antti Koivisto.
+
+        When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should be invalidated. The safest way to do this is
+        to destroy the inline tree (the "subtree moving" will eventually be replaced by "destroy followed by construct" activity).
+
+        * rendering/updating/RenderTreeBuilder.cpp:
+        (WebCore::RenderTreeBuilder::move):
+
 2021-04-15  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp

@@ -487 +487 @@
         attachToRenderElementInternal(to, WTFMove(childToMove), beforeChild, RenderObject::IsInternalMove::Yes);
     }
+
+    auto findBFCRootAndDestroyInlineTree = [&] {
+        auto* containingBlock = &from;
+        while (containingBlock) {
+            containingBlock->setNeedsLayout();
+            if (is<RenderBlockFlow>(*containingBlock)) {
+                downcast<RenderBlockFlow>(*containingBlock).deleteLines();
+                break;
+            }
+            containingBlock = containingBlock->containingBlock();
+        }
+    };
+    // When moving a subtree out of a BFC we need to make sure that the line boxes generated for the inline tree are not accessible anymore from the renderers.
+    // Let's find the BFC root and nuke the inline tree (At some point we are going to destroy the subtree instead of moving these renderers around.)
+    if (is<RenderInline>(child))
+        findBFCRootAndDestroyInlineTree();
 }