Changeset 229474 in webkit

Timestamp:

Mar 9, 2018, 11:14:23 AM (7 years ago)

Author:

Alan Bujtas

Message:

RenderTreeBuilder::splitAnonymousBoxesAroundChild should take multicolumn spanners into account.
​https://bugs.webkit.org/show_bug.cgi?id=183493
<rdar://problem/38030461>

Reviewed by Antti Koivisto.

Source/WebCore:

Multicolumn spanners are taken out of their original position and placed next
to a RenderMultiColumnSet. splitAnonymousBoxesAroundChild needs to know the original parent (in the render tree context).

Test: fast/multicol/adjust-beforeChild-for-spanner-crash.html

• rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):

• rendering/updating/RenderTreeBuilder.h:
• rendering/updating/RenderTreeBuilderBlock.cpp:

(WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation):

• rendering/updating/RenderTreeBuilderMultiColumn.cpp:

(WebCore::RenderTreeBuilder::MultiColumn::adjustBeforeChildForMultiColumnSpannerIfNeeded):

• rendering/updating/RenderTreeBuilderMultiColumn.h:
• rendering/updating/RenderTreeBuilderRuby.cpp:

(WebCore::RenderTreeBuilder::Ruby::moveChildrenInternal):

• rendering/updating/RenderTreeBuilderTable.cpp:

(WebCore::RenderTreeBuilder::Table::attach):

LayoutTests:

• fast/multicol/adjust-beforeChild-for-spanner-crash-expected.txt: Added.
• fast/multicol/adjust-beforeChild-for-spanner-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/multicol/adjust-beforeChild-for-spanner-crash-expected.txt (added)
• LayoutTests/fast/multicol/adjust-beforeChild-for-spanner-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/updating/RenderTreeBuilder.cpp (modified) (2 diffs)
• Source/WebCore/rendering/updating/RenderTreeBuilder.h (modified) (1 diff)
• Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp (modified) (1 diff)
• Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp (modified) (1 diff)
• Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.h (modified) (1 diff)
• Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp (modified) (1 diff)
• Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2018-03-09  Zalan Bujtas  <zalan@apple.com>
+
+        RenderTreeBuilder::splitAnonymousBoxesAroundChild should take multicolumn spanners into account.
+        https://bugs.webkit.org/show_bug.cgi?id=183493
+        <rdar://problem/38030461>
+
+        Reviewed by Antti Koivisto.
+
+        * fast/multicol/adjust-beforeChild-for-spanner-crash-expected.txt: Added.
+        * fast/multicol/adjust-beforeChild-for-spanner-crash.html: Added.
+
 2018-03-09  Basuke Suzuki  <Basuke.Suzuki@sony.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-03-09  Zalan Bujtas  <zalan@apple.com>
+
+        RenderTreeBuilder::splitAnonymousBoxesAroundChild should take multicolumn spanners into account.
+        https://bugs.webkit.org/show_bug.cgi?id=183493
+        <rdar://problem/38030461>
+
+        Reviewed by Antti Koivisto.
+
+        Multicolumn spanners are taken out of their original position and placed next
+        to a RenderMultiColumnSet. splitAnonymousBoxesAroundChild needs to know the original parent (in the render tree context).
+
+        Test: fast/multicol/adjust-beforeChild-for-spanner-crash.html
+
+        * rendering/updating/RenderTreeBuilder.cpp:
+        (WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):
+        * rendering/updating/RenderTreeBuilder.h:
+        * rendering/updating/RenderTreeBuilderBlock.cpp:
+        (WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation):
+        * rendering/updating/RenderTreeBuilderMultiColumn.cpp:
+        (WebCore::RenderTreeBuilder::MultiColumn::adjustBeforeChildForMultiColumnSpannerIfNeeded):
+        * rendering/updating/RenderTreeBuilderMultiColumn.h:
+        * rendering/updating/RenderTreeBuilderRuby.cpp:
+        (WebCore::RenderTreeBuilder::Ruby::moveChildrenInternal):
+        * rendering/updating/RenderTreeBuilderTable.cpp:
+        (WebCore::RenderTreeBuilder::Table::attach):
+
 2018-03-09  Jer Noble  <jer.noble@apple.com>
 

trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp

@@ -38 +38 @@
 #include "RenderMathMLFenced.h"
 #include "RenderMenuList.h"
+#include "RenderMultiColumnFlow.h"
 #include "RenderRuby.h"
 #include "RenderRubyBase.h"
@@ -600 +601 @@
 }
 
-RenderObject* RenderTreeBuilder::splitAnonymousBoxesAroundChild(RenderBox& parent, RenderObject* beforeChild)
-{
+RenderObject* RenderTreeBuilder::splitAnonymousBoxesAroundChild(RenderBox& parent, RenderObject& originalBeforeChild)
+{
+    // Adjust beforeChild if it is a column spanner and has been moved out of its original position.
+    auto* beforeChild = RenderTreeBuilder::MultiColumn::adjustBeforeChildForMultiColumnSpannerIfNeeded(originalBeforeChild);
     bool didSplitParentAnonymousBoxes = false;
 

trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.h

@@ -81 +81 @@
     void moveAllChildren(RenderBoxModelObject& from, RenderBoxModelObject& to, RenderObject* beforeChild, NormalizeAfterInsertion);
 
-    RenderObject* splitAnonymousBoxesAroundChild(RenderBox& parent, RenderObject* beforeChild);
+    RenderObject* splitAnonymousBoxesAroundChild(RenderBox& parent, RenderObject& originalBeforeChild);
     void makeChildrenNonInline(RenderBlock& parent, RenderObject* insertionPoint = nullptr);
     void removeAnonymousWrappersForInlineChildrenIfNeeded(RenderElement& parent);

trunk/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp

@@ -194 +194 @@
             }
 
-            beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, beforeChild);
+            beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, *beforeChild);
 
             RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(beforeChild->parent() == &parent);

trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp

@@ -408 +408 @@
 }
 
-}
+RenderObject* RenderTreeBuilder::MultiColumn::adjustBeforeChildForMultiColumnSpannerIfNeeded(RenderObject& beforeChild)
+{
+    if (!is<RenderBox>(beforeChild))
+        return &beforeChild;
+
+    auto* nextSibling = beforeChild.nextSibling();
+    if (!nextSibling)
+        return &beforeChild;
+
+    if (!is<RenderMultiColumnSet>(*nextSibling))
+        return &beforeChild;
+
+    auto* multiColumnFlow = downcast<RenderMultiColumnSet>(*nextSibling).multiColumnFlow();
+    if (!multiColumnFlow)
+        return &beforeChild;
+
+    return multiColumnFlow->findColumnSpannerPlaceholder(downcast<RenderBox>(&beforeChild));
+}
+
+}

trunk/Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.h

@@ -44 +44 @@
     void multiColumnDescendantInserted(RenderMultiColumnFlow&, RenderObject& newDescendant);
     void multiColumnRelativeWillBeRemoved(RenderMultiColumnFlow&, RenderObject& relative);
+    static RenderObject* adjustBeforeChildForMultiColumnSpannerIfNeeded(RenderObject& beforeChild);
 
 private:

trunk/Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp

@@ -184 +184 @@
     // and appends them to toBase.
     if (beforeChild && beforeChild->parent() != &from)
-        beforeChild = m_builder.splitAnonymousBoxesAroundChild(from, beforeChild);
+        beforeChild = m_builder.splitAnonymousBoxesAroundChild(from, *beforeChild);
 
     if (from.childrenInline())

trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

@@ -165 +165 @@
 {
     if (beforeChild && beforeChild->parent() != &parent)
-        beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, beforeChild);
+        beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, *beforeChild);
 
     auto& newChild = *child.get();
@@ -178 +178 @@
 {
     if (beforeChild && beforeChild->parent() != &parent)
-        beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, beforeChild);
+        beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, *beforeChild);
 
     // FIXME: child should always be a RenderTableRow at this point.
@@ -190 +190 @@
 {
     if (beforeChild && beforeChild->parent() != &parent)
-        beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, beforeChild);
+        beforeChild = m_builder.splitAnonymousBoxesAroundChild(parent, *beforeChild);
 
     auto& newChild = *child.get();