Changeset 147871 in webkit

Timestamp:

Apr 7, 2013 11:37:39 AM (11 years ago)

Author:

robert@webkit.org

Message:

table element may get larger when its contents are recreated
​https://bugs.webkit.org/show_bug.cgi?id=111342

Reviewed by Darin Adler.

Source/WebCore:

Remove anonymous table section wrappers when destroying their children.

Test: fast/table/anonymous-table-section-removed.html

• rendering/RenderObject.cpp:

(WebCore::RenderObject::destroyAndCleanupAnonymousWrappers):

LayoutTests:

• fast/table/anonymous-table-section-removed-expected.txt: Added.
• fast/table/anonymous-table-section-removed.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/table/anonymous-table-section-removed-expected.txt (added)
• LayoutTests/fast/table/anonymous-table-section-removed.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderObject.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-04-07  Robert Hogan  <robert@webkit.org>
+
+        table element may get larger when its contents are recreated
+        https://bugs.webkit.org/show_bug.cgi?id=111342
+
+        Reviewed by Darin Adler.
+
+        * fast/table/anonymous-table-section-removed-expected.txt: Added.
+        * fast/table/anonymous-table-section-removed.html: Added.
+
 2013-04-06  Timothy Hatcher  <timothy@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-04-07  Robert Hogan  <robert@webkit.org>
+
+        table element may get larger when its contents are recreated
+        https://bugs.webkit.org/show_bug.cgi?id=111342
+
+        Reviewed by Darin Adler.
+
+        Remove anonymous table section wrappers when destroying their children.
+
+        Test: fast/table/anonymous-table-section-removed.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroyAndCleanupAnonymousWrappers):
+
 2013-04-07  Patrick Gansterer  <paroga@webkit.org>
 

trunk/Source/WebCore/rendering/RenderObject.cpp

@@ -2556 +2556 @@
     RenderObject* destroyRoot = this;
     for (RenderObject* destroyRootParent = destroyRoot->parent(); destroyRootParent && destroyRootParent->isAnonymous(); destroyRoot = destroyRootParent, destroyRootParent = destroyRootParent->parent()) {
-        // Currently we only remove anonymous cells' wrapper but we should remove all unneeded
+        // Currently we only remove anonymous cells' and table sections' wrappers but we should remove all unneeded
         // wrappers. See http://webkit.org/b/52123 as an example where this is needed.
-        if (!destroyRootParent->isTableCell())
+        if (!destroyRootParent->isTableCell() && !destroyRootParent->isTableSection())
             break;