Changeset 201393 in webkit

Timestamp:

May 25, 2016, 12:04:47 PM (9 years ago)

Author:

Antti Koivisto

Message:

Source/WebCore:
Shadow DOM: RenderTreePosition miscomputed when display:contents value changes
​https://bugs.webkit.org/show_bug.cgi?id=158072
rdar://problem/25766333

Reviewed by Darin Adler.

Test: fast/shadow-dom/slot-crash.html

• style/RenderTreePosition.h:

(WebCore::RenderTreePosition::invalidateNextSibling):

Add unconditional invalidation function.

• style/RenderTreeUpdater.cpp:

(WebCore::RenderTreeUpdater::updateElementRenderer):

With display:contents rendering siblings may be found from the subtree and the existing cached
position may become invalid.
If the display:contents value changes invalidate the current render tree position.

LayoutTests:
Shadow DOM: RenderTreePosition should determine if element has display:contents from new style
​https://bugs.webkit.org/show_bug.cgi?id=158072

Reviewed by Darin Adler.

• fast/shadow-dom/slot-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/shadow-dom/slot-crash-expected.txt (added)
• LayoutTests/fast/shadow-dom/slot-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/style/RenderTreePosition.h (modified) (1 diff)
• Source/WebCore/style/RenderTreeUpdater.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-05-25  Antti Koivisto  <antti@apple.com>
+
+        Shadow DOM: RenderTreePosition should determine if element has display:contents from new style
+        https://bugs.webkit.org/show_bug.cgi?id=158072
+
+        Reviewed by Darin Adler.
+
+        * fast/shadow-dom/slot-crash.html: Added.
+
 2016-05-25  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-05-25  Antti Koivisto  <antti@apple.com>
+
+        Shadow DOM: RenderTreePosition miscomputed when display:contents value changes
+        https://bugs.webkit.org/show_bug.cgi?id=158072
+        rdar://problem/25766333
+
+        Reviewed by Darin Adler.
+
+        Test: fast/shadow-dom/slot-crash.html
+
+        * style/RenderTreePosition.h:
+        (WebCore::RenderTreePosition::invalidateNextSibling):
+
+            Add unconditional invalidation function.
+
+        * style/RenderTreeUpdater.cpp:
+        (WebCore::RenderTreeUpdater::updateElementRenderer):
+
+            With display:contents rendering siblings may be found from the subtree and the existing cached
+            position may become invalid.
+            If the display:contents value changes invalidate the current render tree position.
+
 2016-05-25  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/style/RenderTreePosition.h

@@ -60 +60 @@
 
     void computeNextSibling(const Node&);
+    void invalidateNextSibling() { m_hasValidNextSibling = false; }
     void invalidateNextSibling(const RenderObject&);
 

trunk/Source/WebCore/style/RenderTreeUpdater.cpp

@@ -246 +246 @@
 
     bool hasDisplayContest = update.style && update.style->display() == CONTENTS;
-    element.setHasDisplayContents(hasDisplayContest);
+    if (hasDisplayContest != element.hasDisplayContents()) {
+        element.setHasDisplayContents(hasDisplayContest);
+        // Render tree position needs to be recomputed as rendering siblings may be found from the display:contents subtree.
+        renderTreePosition().invalidateNextSibling();
+    }
 
     bool shouldCreateNewRenderer = !element.renderer() && update.style && !hasDisplayContest;