Changeset 284871 in webkit

Timestamp:

Oct 26, 2021, 9:00:24 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

ASSERT(parent->element()) triggered in Styleable::fromRenderer
​https://bugs.webkit.org/show_bug.cgi?id=232185

Patch by Gabriel Nava Marino <​gnavamarino@apple.com> on 2021-10-26
Reviewed by Tim Nguyen and Antti Koivisto.

Source/WebCore:

The marker renderer can be set as a child of RenderMultiColumnFlowThread
instead of RenderListItem in some instances. RenderMultiColumnFlowThread is
an anonymous box and doesn't have an associated element, so we instead should
loop through the parents until we find the RenderListItem which does have an
associated element.

Test: fast/animation/css-animation-marker-crash.html

• style/Styleable.cpp:

(WebCore::Styleable::fromRenderer):

LayoutTests:

• fast/animation/css-animation-marker-crash-expected.txt: Added.
• fast/animation/css-animation-marker-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/animation/css-animation-marker-crash-expected.txt (added)
• LayoutTests/fast/animation/css-animation-marker-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/style/Styleable.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-10-26  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        ASSERT(parent->element()) triggered in Styleable::fromRenderer
+        https://bugs.webkit.org/show_bug.cgi?id=232185
+
+        Reviewed by Tim Nguyen and Antti Koivisto.
+
+        * fast/animation/css-animation-marker-crash-expected.txt: Added.
+        * fast/animation/css-animation-marker-crash.html: Added.
+
 2021-10-26  Martin Robinson  <mrobinson@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-10-26  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        ASSERT(parent->element()) triggered in Styleable::fromRenderer
+        https://bugs.webkit.org/show_bug.cgi?id=232185
+
+        Reviewed by Tim Nguyen and Antti Koivisto.
+
+        The marker renderer can be set as a child of RenderMultiColumnFlowThread
+        instead of RenderListItem in some instances. RenderMultiColumnFlowThread is
+        an anonymous box and doesn't have an associated element, so we instead should
+        loop through the parents until we find the RenderListItem which does have an
+        associated element.
+
+        Test: fast/animation/css-animation-marker-crash.html
+
+        * style/Styleable.cpp:
+        (WebCore::Styleable::fromRenderer):
+
 2021-10-26  Philippe Normand  <pnormand@igalia.com>
 

trunk/Source/WebCore/style/Styleable.cpp

@@ -62 +62 @@
         break;
     case PseudoId::Marker:
-        if (auto* parent = renderer.parent()) {
-            ASSERT(parent->element());
-            ASSERT(is<RenderListItem>(parent));
-            ASSERT(downcast<RenderListItem>(*parent).markerRenderer() == &renderer);
-            return Styleable(*parent->element(), PseudoId::Marker);
+        if (auto* ancestor = renderer.parent()) {
+            while (ancestor && !ancestor->element())
+                ancestor = ancestor->parent();
+            ASSERT(is<RenderListItem>(ancestor));
+            ASSERT(downcast<RenderListItem>(ancestor)->markerRenderer() == &renderer);
+            return Styleable(*ancestor->element(), PseudoId::Marker);
         }
         break;