⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 111500 in webkit


Ignore:
Timestamp:
Mar 20, 2012, 10:12:51 PM (14 years ago)
Author:
shinyak@chromium.org
Message:

[Crash] RenderMenuList::addChild() in Shadow DOM.
​https://bugs.webkit.org/show_bug.cgi?id=81201

Reviewed by Dimitri Glazkov.

Source/WebCore:

<audio>, <video>, <meter>, <progress>, and <select> are implemented using
Shadow DOM having HTMLContentElement. Their renderer children basically should not
create a renderer unless they are on the upper shadow encapsulation boundary,
which means they are the direct children of the shadow root.

However, current implementation allows their renderer children to create a renderer
even if they are on a lower shadow encapsulation boundary, which means
they are distributed elements of HTMLContentElement.

This patch makes there renderer children not to create a renderer if they are on a lower shadow
encapsulation boudary.

Tests: fast/dom/shadow/content-element-in-media-element.html

fast/dom/shadow/content-element-in-meter-element.html
fast/dom/shadow/content-element-in-progress-element.html
fast/dom/shadow/content-element-in-select-element.html

  • dom/NodeRenderingContext.h:

(NodeRenderingContext):
(WebCore::NodeRenderingContext::isOnUpperEncapsulationBoundary):
(WebCore):

  • html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::childShouldCreateRenderer):

  • html/HTMLMeterElement.cpp:

(WebCore::HTMLMeterElement::childShouldCreateRenderer):

  • html/HTMLProgressElement.cpp:

(WebCore::HTMLProgressElement::childShouldCreateRenderer):

  • html/HTMLSelectElement.cpp:

(WebCore::HTMLSelectElement::childShouldCreateRenderer):

LayoutTests:

Skipped these tests in non-chromium port since SHADOW_DOM flag is not enabled.

Marked 2 new tests FAIL. Their behavior is affected by this patch, but this patch
won't fix them completely. They have another bugs. See Bug 81310 and Bug 81311.

  • fast/dom/shadow/content-element-in-media-element-expected.txt: Added.
  • fast/dom/shadow/content-element-in-media-element.html: Added.
  • fast/dom/shadow/content-element-in-meter-element-expected.txt: Added.
  • fast/dom/shadow/content-element-in-meter-element.html: Added.
  • fast/dom/shadow/content-element-in-progress-element-expected.txt: Added.
  • fast/dom/shadow/content-element-in-progress-element.html: Added.
  • fast/dom/shadow/content-element-in-select-element-expected.txt: Added.
  • fast/dom/shadow/content-element-in-select-element.html: Added.
  • platform/chromium/test_expectations.txt:
  • platform/efl/Skipped:
  • platform/mac/Skipped:
  • platform/qt/Skipped:
  • platform/win/Skipped:
  • platform/wincairo/Skipped:
  • platform/wk2/Skipped:
Location:
trunk
Files:
8 added
13 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r111498 r111500  
     12012-03-19  Shinya Kawanaka  <shinyak@chromium.org>
     2
     3        [Crash] RenderMenuList::addChild() in Shadow DOM.
     4        https://bugs.webkit.org/show_bug.cgi?id=81201
     5
     6        Reviewed by Dimitri Glazkov.
     7
     8        Skipped these tests in non-chromium port since SHADOW_DOM flag is not enabled.
     9
     10        Marked 2 new tests FAIL. Their behavior is affected by this patch, but this patch
     11        won't fix them completely. They have another bugs. See Bug 81310 and Bug 81311.
     12
     13        * fast/dom/shadow/content-element-in-media-element-expected.txt: Added.
     14        * fast/dom/shadow/content-element-in-media-element.html: Added.
     15        * fast/dom/shadow/content-element-in-meter-element-expected.txt: Added.
     16        * fast/dom/shadow/content-element-in-meter-element.html: Added.
     17        * fast/dom/shadow/content-element-in-progress-element-expected.txt: Added.
     18        * fast/dom/shadow/content-element-in-progress-element.html: Added.
     19        * fast/dom/shadow/content-element-in-select-element-expected.txt: Added.
     20        * fast/dom/shadow/content-element-in-select-element.html: Added.
     21        * platform/chromium/test_expectations.txt:
     22        * platform/efl/Skipped:
     23        * platform/mac/Skipped:
     24        * platform/qt/Skipped:
     25        * platform/win/Skipped:
     26        * platform/wincairo/Skipped:
     27        * platform/wk2/Skipped:
     28
    1292012-03-20  Dan Bernstein  <mitz@apple.com>
    230

  • trunk/LayoutTests/platform/chromium/test_expectations.txt

    r111494 r111500  
    32783278BUGCR85293 LINUX : svg/text/foreignObject-text-clipping-bug.xml = PASS IMAGE
    32793279
     3280BUGWK81310 : fast/dom/shadow/content-element-in-media-element.html = TEXT
     3281BUGWK81311 : fast/dom/shadow/content-element-in-meter-element.html = TEXT
     3282
    32803283// CSS Grid Layout is not enabled yet.
    32813284BUGWK60731 SKIP : fast/css-grid-layout = PASS

  • trunk/LayoutTests/platform/efl/Skipped

    r111185 r111500  
    19391939fast/dom/shadow/content-element-outside-shadow.html
    19401940fast/dom/shadow/content-element-outside-shadow-style.html
     1941fast/dom/shadow/content-element-in-media-element.html
     1942fast/dom/shadow/content-element-in-meter-element.html
    19411943fast/dom/shadow/get-element-by-id-in-shadow-root.html
    19421944fast/dom/shadow/shadow-root-js-api.html

  • trunk/LayoutTests/platform/qt/Skipped

    r111472 r111500  
    168168fast/dom/shadow/content-element-outside-shadow.html
    169169fast/dom/shadow/content-element-outside-shadow-style.html
     170fast/dom/shadow/content-element-in-media-element.html
     171fast/dom/shadow/content-element-in-meter-element.html
    170172fast/dom/shadow/get-element-by-id-in-shadow-root.html
    171173fast/dom/shadow/iframe-shadow.html

  • trunk/LayoutTests/platform/win/Skipped

    r111439 r111500  
    10081008fast/forms/form-attribute.html
    10091009
     1010
    10101011# view mode media feature
    10111012fast/media/view-mode-media-feature.html
    … …  
    14611462fast/dom/shadow/content-element-outside-shadow.html
    14621463fast/dom/shadow/content-element-outside-shadow-style.html
     1464fast/dom/shadow/content-element-in-media-element.html
     1465fast/dom/shadow/content-element-in-meter-element.html
    14631466fast/dom/shadow/get-element-by-id-in-shadow-root.html
    14641467fast/dom/shadow/shadow-root-js-api.html

  • trunk/LayoutTests/platform/wincairo/Skipped

    r111149 r111500  
    19731973fast/dom/shadow/content-element-api.html
    19741974fast/dom/shadow/content-element-outside-shadow.html
     1975fast/dom/shadow/content-element-in-media-element.html
     1976fast/dom/shadow/content-element-in-meter-element.html
    19751977fast/dom/shadow/get-element-by-id-in-shadow-root.html
    19761978fast/dom/shadow/shadow-root-js-api.html

  • trunk/LayoutTests/platform/wk2/Skipped

    r111498 r111500  
    10841084fast/dom/shadow/content-element-outside-shadow.html
    10851085fast/dom/shadow/content-element-outside-shadow-style.html
     1086fast/dom/shadow/content-element-in-media-element.html
     1087fast/dom/shadow/content-element-in-meter-element.html
    10861088fast/dom/shadow/shadow-root-js-api.html
    10871089fast/dom/shadow/shadow-disable.html

  • trunk/Source/WebCore/ChangeLog

    r111499 r111500  
     12012-03-19  Shinya Kawanaka  <shinyak@chromium.org>
     2
     3        [Crash] RenderMenuList::addChild() in Shadow DOM.
     4        https://bugs.webkit.org/show_bug.cgi?id=81201
     5
     6        Reviewed by Dimitri Glazkov.
     7
     8        <audio>, <video>, <meter>, <progress>, and <select> are implemented using
     9        Shadow DOM having HTMLContentElement. Their renderer children basically should not
     10        create a renderer unless they are on the upper shadow encapsulation boundary,
     11        which means they are the direct children of the shadow root.
     12
     13        However, current implementation allows their renderer children to create a renderer
     14        even if they are on a lower shadow encapsulation boundary, which means
     15        they are distributed elements of HTMLContentElement.
     16
     17        This patch makes there renderer children not to create a renderer if they are on a lower shadow
     18        encapsulation boudary.
     19
     20        Tests: fast/dom/shadow/content-element-in-media-element.html
     21               fast/dom/shadow/content-element-in-meter-element.html
     22               fast/dom/shadow/content-element-in-progress-element.html
     23               fast/dom/shadow/content-element-in-select-element.html
     24
     25        * dom/NodeRenderingContext.h:
     26        (NodeRenderingContext):
     27        (WebCore::NodeRenderingContext::isOnUpperEncapsulationBoundary):
     28        (WebCore):
     29        * html/HTMLMediaElement.cpp:
     30        (WebCore::HTMLMediaElement::childShouldCreateRenderer):
     31        * html/HTMLMeterElement.cpp:
     32        (WebCore::HTMLMeterElement::childShouldCreateRenderer):
     33        * html/HTMLProgressElement.cpp:
     34        (WebCore::HTMLProgressElement::childShouldCreateRenderer):
     35        * html/HTMLSelectElement.cpp:
     36        (WebCore::HTMLSelectElement::childShouldCreateRenderer):
     37
    1382012-03-20  Dana Jansens  <danakj@chromium.org>
    239

  • trunk/Source/WebCore/dom/NodeRenderingContext.h

    r108959 r111500  
    6363    void hostChildrenChanged();
    6464
     65    bool isOnUpperEncapsulationBoundary() const;
    6566    bool isOnEncapsulationBoundary() const;
    6667    bool hasFlowThreadParent() const { return m_parentFlowRenderer; }
    … …  
    118119}
    119120
     121inline bool NodeRenderingContext::isOnUpperEncapsulationBoundary() const
     122{
     123    return m_phase == AttachingShadowChild;
     124}
     125
    120126class NodeRendererFactory {
    121127    WTF_MAKE_NONCOPYABLE(NodeRendererFactory);

  • trunk/Source/WebCore/html/HTMLMediaElement.cpp

    r110095 r111500  
    469469bool HTMLMediaElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
    470470{
    471     return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
     471    return childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
    472472}
    473473

  • trunk/Source/WebCore/html/HTMLMeterElement.cpp

    r110927 r111500  
    6464bool HTMLMeterElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
    6565{
    66     return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
     66    return childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
    6767}
    6868

  • trunk/Source/WebCore/html/HTMLProgressElement.cpp

    r111009 r111500  
    6666bool HTMLProgressElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
    6767{
    68     return childContext.isOnEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
     68    return childContext.isOnUpperEncapsulationBoundary() && HTMLElement::childShouldCreateRenderer(childContext);
    6969}
    7070

  • trunk/Source/WebCore/html/HTMLSelectElement.cpp

    r110340 r111500  
    329329bool HTMLSelectElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
    330330{
    331     return childContext.isOnEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
     331    return childContext.isOnUpperEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
    332332}
    333333
Note: See TracChangeset for help on using the changeset viewer.