[webkit-changes] [118867] branches/chromium/1132

Tue, 29 May 2012 18:04:13 -0700

Title: [118867] branches/chromium/1132

Diff

Copied: branches/chromium/1132/LayoutTests/tables/table-section-overflow-clip-crash-expected.txt (from rev 118592, trunk/LayoutTests/tables/table-section-overflow-clip-crash-expected.txt) (0 => 118867)


--- branches/chromium/1132/LayoutTests/tables/table-section-overflow-clip-crash-expected.txt	                        (rev 0)
+++ branches/chromium/1132/LayoutTests/tables/table-section-overflow-clip-crash-expected.txt	2012-05-30 01:04:07 UTC (rev 118867)
@@ -0,0 +1,2 @@
+WebKit Bug 87445 - RenderTableSection::paintCell.
+Test passes if it does not crash.

Copied: branches/chromium/1132/LayoutTests/tables/table-section-overflow-clip-crash.html (from rev 118592, trunk/LayoutTests/tables/table-section-overflow-clip-crash.html) (0 => 118867)


--- branches/chromium/1132/LayoutTests/tables/table-section-overflow-clip-crash.html	                        (rev 0)
+++ branches/chromium/1132/LayoutTests/tables/table-section-overflow-clip-crash.html	2012-05-30 01:04:07 UTC (rev 118867)
@@ -0,0 +1,62 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+#test0 {
+    counter-reset: c;
+}
+#test0::after {
+    content: counter(c);
+    counter-reset: c;
+}
+#test1::after {
+    content: counter(c);
+    counter-reset: c;
+}
+#test2 {
+    counter-reset: c;
+    height: 1px;
+    width: 1px;
+    overflow-x: scroll;
+    -webkit-perspective: 1;
+}
+#test3 {
+    content: counter(c);
+    -webkit-animation-name: a;
+    -webkit-animation-duration: 0.01s;
+}
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function finish() {
+    document.body.innerHTML = "WebKit Bug 87445 - RenderTableSection::paintCell.<br/>Test passes if it does not crash.";
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+_onload_ = function() {
+    test0 = document.createElement('div');
+    test0.setAttribute('id', 'test0');
+    document.body.appendChild(test0);
+    test1 = document.createElement('div');
+    test1.setAttribute('id', 'test1');
+    test0.appendChild(test1);
+    test2 = document.createElement('div');
+    test2.setAttribute('id', 'test2');
+    test1.appendChild(test2);
+    test3 = document.createElement('div');
+    test3.setAttribute('id', 'test3');
+    test2.appendChild(test3);
+    test2.style.display = 'table-footer-group';
+    document.body.offsetTop;
+    setTimeout("finish()", 10);
+}
+</script>
+</head>
+<body>
+</body>
+</html>

Modified: branches/chromium/1132/Source/WebCore/rendering/RenderObject.cpp (118866 => 118867)


--- branches/chromium/1132/Source/WebCore/rendering/RenderObject.cpp	2012-05-30 01:00:30 UTC (rev 118866)
+++ branches/chromium/1132/Source/WebCore/rendering/RenderObject.cpp	2012-05-30 01:04:07 UTC (rev 118867)
@@ -592,14 +592,26 @@
 
 static inline bool objectIsRelayoutBoundary(const RenderObject* object)
 {
-    // FIXME: In future it may be possible to broaden this condition in order to improve performance.
-    // Table cells are excluded because even when their CSS height is fixed, their height()
-    // may depend on their contents.
-    return object->isTextControl()
+    // FIXME: In future it may be possible to broaden these conditions in order to improve performance.
+    if (object->isTextControl())
+        return true;
+
 #if ENABLE(SVG)
-        || object->isSVGRoot()
+    if (object->isSVGRoot())
+        return true;
 #endif
-        || (object->hasOverflowClip() && !object->style()->width().isIntrinsicOrAuto() && !object->style()->height().isIntrinsicOrAuto() && !object->style()->height().isPercent() && !object->isTableCell());
+
+    if (!object->hasOverflowClip())
+        return false;
+
+    if (object->style()->width().isIntrinsicOrAuto() || object->style()->height().isIntrinsicOrAuto() || object->style()->height().isPercent())
+        return false;
+
+    // Table parts can't be relayout roots since the table is responsible for layouting all the parts.
+    if (object->isTablePart())
+        return false;
+
+    return true;
 }
 
 void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderObject* newRoot)

Modified: branches/chromium/1132/Source/WebCore/rendering/RenderTableSection.cpp (118866 => 118867)


--- branches/chromium/1132/Source/WebCore/rendering/RenderTableSection.cpp	2012-05-30 01:00:30 UTC (rev 118866)
+++ branches/chromium/1132/Source/WebCore/rendering/RenderTableSection.cpp	2012-05-30 01:04:07 UTC (rev 118867)
@@ -403,6 +403,8 @@
 void RenderTableSection::layout()
 {
     ASSERT(needsLayout());
+    ASSERT(!needsCellRecalc());
+    ASSERT(!table()->needsSectionRecalc());
 
     LayoutStateMaintainer statePusher(view(), this, locationOffset(), style()->isFlippedBlocksWritingMode());
     for (RenderObject* child = children()->firstChild(); child; child = child->nextSibling()) {

_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes

Reply via email to