- Revision
- 105828
- Author
- [email protected]
- Date
- 2012-01-24 15:53:27 -0800 (Tue, 24 Jan 2012)
Log Message
Crash in updateFirstLetter() from unnecessary anonymous block
https://bugs.webkit.org/show_bug.cgi?id=72675
Patch by Ken Buchanan <[email protected]> on 2012-01-24
Reviewed by David Hyatt.
Source/WebCore:
There was a problem with anonymous blocks not getting removed when
their only block flow siblings are removed if they also have non-block
flow first-letter siblings (i.e. floats). This patch modifies
RenderBlock::removeChild() to look for this situation and strip out
unnecessary anonymous container blocks if it occurs.
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::removeChild):
(WebCore::RenderBlock::collapseAnonymousBoxChild): Added
* rendering/RenderBlock.h:
(WebCore::RenderBlock::collapseAnonymousBoxChild): Added
LayoutTests:
Adding a test that cause a div to be removed from between a floating
first-letter block and its remaining text. If the anonymous block is
removed as an immediate consequence of the div removal, this shouldn't
crash.
* fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt: Added
* fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html: Added
Modified Paths
Added Paths
Property Changed
Diff
Modified: trunk/LayoutTests/ChangeLog (105827 => 105828)
--- trunk/LayoutTests/ChangeLog 2012-01-24 23:51:14 UTC (rev 105827)
+++ trunk/LayoutTests/ChangeLog 2012-01-24 23:53:27 UTC (rev 105828)
@@ -1,3 +1,18 @@
+2012-01-24 Ken Buchanan <[email protected]>
+
+ Crash in updateFirstLetter() from unnecessary anonymous block
+ https://bugs.webkit.org/show_bug.cgi?id=72675
+
+ Reviewed by David Hyatt.
+
+ Adding a test that cause a div to be removed from between a floating
+ first-letter block and its remaining text. If the anonymous block is
+ removed as an immediate consequence of the div removal, this shouldn't
+ crash.
+
+ * fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt: Added
+ * fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html: Added
+
2012-01-24 Adam Barth <[email protected]>
Mark these tests as flaky.
Property changes on: trunk/LayoutTests/ChangeLog
___________________________________________________________________
Added: svn:executable
Added: trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt (0 => 105828)
--- trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt 2012-01-24 23:53:27 UTC (rev 105828)
@@ -0,0 +1 @@
+PASS if no crash or assert
Property changes on: trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline-expected.txt
___________________________________________________________________
Added: svn:executable
Added: trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html (0 => 105828)
--- trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html (rev 0)
+++ trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html 2012-01-24 23:53:27 UTC (rev 105828)
@@ -0,0 +1,34 @@
+<style>
+.inlineFL::first-letter { overflow: visible; }
+.absolutePosition { position: absolute; }
+.floatFL:first-letter { float: right; }
+</style>
+<script>
+function recreateFirstLetterBlock() {
+ document.getElementById("parent").setAttribute('class', 'inlineFL');
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+}
+function removeDiv() {
+ // This causes the parent to only have inline (and floating) children
+ document.getElementById("parent").removeChild(document.getElementById("child"));
+ setTimeout("recreateFirstLetterBlock();", 10);
+}
+
+function changeDivStyle() {
+ document.getElementById("child").setAttribute('class', 'inlineFL');
+ setTimeout("removeDiv();", 10);
+}
+function startTest() {
+ setTimeout("changeDivStyle();", 10);
+ if (window.layoutTestController) {
+ layoutTestController.waitUntilDone();
+ layoutTestController.dumpAsText();
+ }
+}
+window._onload_ = startTest;
+</script>
+<div id="parent" class="floatFL">
+ <div id="child" class="absolutePosition"></div>
+ PASS if no crash or assert
+</div>
Property changes on: trunk/LayoutTests/fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/ChangeLog (105827 => 105828)
--- trunk/Source/WebCore/ChangeLog 2012-01-24 23:51:14 UTC (rev 105827)
+++ trunk/Source/WebCore/ChangeLog 2012-01-24 23:53:27 UTC (rev 105828)
@@ -1,3 +1,22 @@
+2012-01-24 Ken Buchanan <[email protected]>
+
+ Crash in updateFirstLetter() from unnecessary anonymous block
+ https://bugs.webkit.org/show_bug.cgi?id=72675
+
+ Reviewed by David Hyatt.
+
+ There was a problem with anonymous blocks not getting removed when
+ their only block flow siblings are removed if they also have non-block
+ flow first-letter siblings (i.e. floats). This patch modifies
+ RenderBlock::removeChild() to look for this situation and strip out
+ unnecessary anonymous container blocks if it occurs.
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::removeChild):
+ (WebCore::RenderBlock::collapseAnonymousBoxChild): Added
+ * rendering/RenderBlock.h:
+ (WebCore::RenderBlock::collapseAnonymousBoxChild): Added
+
2012-01-24 Daniel Cheng <[email protected]>
[chromium] event.dataTransfer.types should not return "Text" or "URL"
Property changes on: trunk/Source/WebCore/ChangeLog
___________________________________________________________________
Added: svn:executable
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (105827 => 105828)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-01-24 23:51:14 UTC (rev 105827)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2012-01-24 23:53:27 UTC (rev 105828)
@@ -1025,6 +1025,17 @@
&& prev->isAnonymousColumnSpanBlock() == next->isAnonymousColumnSpanBlock();
}
+void RenderBlock::collapseAnonymousBoxChild(RenderBlock* parent, RenderObject* child)
+{
+ parent->setNeedsLayoutAndPrefWidthsRecalc();
+ parent->setChildrenInline(child->childrenInline());
+ RenderBlock* anonBlock = toRenderBlock(parent->children()->removeChildNode(parent, child, child->hasLayer()));
+ anonBlock->moveAllChildrenTo(parent, child->hasLayer());
+ // Delete the now-empty block's lines and nuke it.
+ anonBlock->deleteLineBoxTree();
+ anonBlock->destroy();
+}
+
void RenderBlock::removeChild(RenderObject* oldChild)
{
// If this child is a block, and if our previous and next siblings are
@@ -1081,13 +1092,17 @@
// The removal has knocked us down to containing only a single anonymous
// box. We can go ahead and pull the content right back up into our
// box.
- setNeedsLayoutAndPrefWidthsRecalc();
- setChildrenInline(child->childrenInline());
- RenderBlock* anonBlock = toRenderBlock(children()->removeChildNode(this, child, child->hasLayer()));
- anonBlock->moveAllChildrenTo(this, child->hasLayer());
- // Delete the now-empty block's lines and nuke it.
- anonBlock->deleteLineBoxTree();
- anonBlock->destroy();
+ collapseAnonymousBoxChild(this, child);
+ } else if ((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) {
+ // It's possible that the removal has knocked us down to a single anonymous
+ // block with pseudo-style element siblings (e.g. first-letter). If these
+ // are floating or positioned, then we need to pull the content up also.
+ RenderBlock* anonBlock = toRenderBlock((prev && prev->isAnonymousBlock()) ? prev : next);
+ if ((anonBlock->previousSibling() || anonBlock->nextSibling())
+ && (!anonBlock->previousSibling() || (anonBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonBlock->previousSibling()->isFloatingOrPositioned()))
+ && (!anonBlock->nextSibling() || (anonBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonBlock->nextSibling()->isFloatingOrPositioned()))) {
+ collapseAnonymousBoxChild(this, anonBlock);
+ }
}
if (!firstChild() && !documentBeingDestroyed()) {
Modified: trunk/Source/WebCore/rendering/RenderBlock.h (105827 => 105828)
--- trunk/Source/WebCore/rendering/RenderBlock.h 2012-01-24 23:51:14 UTC (rev 105827)
+++ trunk/Source/WebCore/rendering/RenderBlock.h 2012-01-24 23:53:27 UTC (rev 105828)
@@ -461,6 +461,8 @@
void makeChildrenNonInline(RenderObject* insertionPoint = 0);
virtual void removeLeftoverAnonymousBlock(RenderBlock* child);
+ static void collapseAnonymousBoxChild(RenderBlock* parent, RenderObject* child);
+
virtual void dirtyLinesFromChangedChild(RenderObject* child) { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
Property changes on: trunk/Source/WebCore/rendering/RenderBlock.h
___________________________________________________________________
Added: svn:executable
