Diff
Modified: branches/safari-536.28-branch/LayoutTests/ChangeLog (133341 => 133342)
--- branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/LayoutTests/ChangeLog 2012-11-02 21:09:27 UTC (rev 133342)
@@ -1,5 +1,21 @@
2012-11-02 Lucas Forschler <[email protected]>
+ Merge r124556
+
+ 2012-08-02 Kent Tamura <[email protected]>
+
+ Fix crashes for <input> and <textarea> with display:run-in.
+ https://bugs.webkit.org/show_bug.cgi?id=87300
+
+ Reviewed by Abhishek Arya.
+
+ * fast/runin/input-text-runin-expected.txt: Added.
+ * fast/runin/input-text-runin.html: Added.
+ * fast/runin/textarea-runin-expected.txt: Added.
+ * fast/runin/textarea-text-runin.html: Added.
+
+2012-11-02 Lucas Forschler <[email protected]>
+
Merge r124520
2012-08-02 Ryosuke Niwa <[email protected]>
@@ -10725,3 +10741,4 @@
.
.
.
+.
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/input-text-runin-expected.txt (from rev 124556, trunk/LayoutTests/fast/runin/input-text-runin-expected.txt) (0 => 133342)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/input-text-runin-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/input-text-runin-expected.txt 2012-11-02 21:09:27 UTC (rev 133342)
@@ -0,0 +1 @@
+PASS if not crashed
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/input-text-runin.html (from rev 124556, trunk/LayoutTests/fast/runin/input-text-runin.html) (0 => 133342)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/input-text-runin.html (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/input-text-runin.html 2012-11-02 21:09:27 UTC (rev 133342)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<head>
+<style>
+#el0 { -webkit-appearance: none; }
+.c0 { display: run-in; }
+</style>
+</head>
+<body><input type=text id=el0>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.body.appendChild(el0);
+document.body.appendChild(document.createElement('div'));
+document.body.offsetTop;
+el0.classList.add('c0');
+document.body.offsetTop;
+document.body.innerHTML = 'PASS if not crashed';
+</script>
+</body>
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/textarea-runin-expected.txt (from rev 124556, trunk/LayoutTests/fast/runin/textarea-runin-expected.txt) (0 => 133342)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/textarea-runin-expected.txt (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/textarea-runin-expected.txt 2012-11-02 21:09:27 UTC (rev 133342)
@@ -0,0 +1 @@
+PASS if not crashed
Copied: branches/safari-536.28-branch/LayoutTests/fast/runin/textarea-runin.html (from rev 124556, trunk/LayoutTests/fast/runin/textarea-runin.html) (0 => 133342)
--- branches/safari-536.28-branch/LayoutTests/fast/runin/textarea-runin.html (rev 0)
+++ branches/safari-536.28-branch/LayoutTests/fast/runin/textarea-runin.html 2012-11-02 21:09:27 UTC (rev 133342)
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<head>
+<style>
+#el0 { -webkit-appearance: none; }
+.c0 { display: run-in; }
+</style>
+</head>
+<body><textarea id=el0></textarea>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.body.appendChild(el0);
+document.body.appendChild(document.createElement('div'));
+document.body.offsetTop;
+el0.classList.add('c0');
+eventSender.mouseMoveTo(20, 10);
+eventSender.mouseDown();
+eventSender.mouseUp();
+document.body.innerHTML = 'PASS if not crashed';
+</script>
+</body>
Modified: branches/safari-536.28-branch/Source/WebCore/ChangeLog (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/ChangeLog 2012-11-02 21:09:27 UTC (rev 133342)
@@ -1,5 +1,61 @@
2012-11-02 Lucas Forschler <[email protected]>
+ Merge r124556
+
+ 2012-08-02 Kent Tamura <[email protected]>
+
+ Fix crashes for <input> and <textarea> with display:run-in.
+ https://bugs.webkit.org/show_bug.cgi?id=87300
+
+ Reviewed by Abhishek Arya.
+
+ Introduce RenderObject::canBeReplacedWithInlineRunIn, and renderers which
+ should not be run-in override it so that it returns false.
+
+ Test: fast/runin/input-text-runin.html
+ fast/runin/textarea-runin.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::moveRunInUnderSiblingBlockIfNeeded):
+ Checks canBeReplacedWithInlineRunIn instead of checking tag names.
+ * rendering/RenderFileUploadControl.cpp:
+ (WebCore::RenderFileUploadControl::canBeReplacedWithInlineRunIn):
+ Added. Disallow run-in.
+ * rendering/RenderFileUploadControl.h:
+ (RenderFileUploadControl): Declare canBeReplacedWithInlineRunIn.
+ * rendering/RenderListBox.cpp:
+ (WebCore::RenderListBox::canBeReplacedWithInlineRunIn):
+ Added. Disallow run-in. This is not a behavior change.
+ * rendering/RenderListBox.h:
+ (RenderListBox): Declare canBeReplacedWithInlineRunIn.
+ * rendering/RenderMenuList.cpp:
+ (WebCore::RenderMenuList::canBeReplacedWithInlineRunIn):
+ Added. Disallow run-in. This is not a behavior change.
+ * rendering/RenderMenuList.h:
+ (RenderMenuList): Declare canBeReplacedWithInlineRunIn.
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::canBeReplacedWithInlineRunIn):
+ Added. Allow run-in by default.
+ * rendering/RenderObject.h:
+ (RenderObject): Declare canBeReplacedWithInlineRunIn.
+ * rendering/RenderProgress.cpp:
+ (WebCore::RenderProgress::canBeReplacedWithInlineRunIn):
+ Added. Disallow run-in. This is not a behavior change.
+ * rendering/RenderProgress.h:
+ (RenderProgress): Declare canBeReplacedWithInlineRunIn.
+ * rendering/RenderSlider.cpp:
+ (WebCore::RenderSlider::canBeReplacedWithInlineRunIn):
+ Added. Disallow run-in.
+ * rendering/RenderSlider.h:
+ (RenderSlider): Declare canBeReplacedWithInlineRunIn.
+ * rendering/RenderTextControl.cpp:
+ (WebCore::RenderTextControl::canBeReplacedWithInlineRunIn):
+ Added. Disallow run-in.
+ * rendering/RenderTextControl.h:
+ (RenderTextControl): Declare canBeReplacedWithInlineRunIn.
+
+2012-11-02 Lucas Forschler <[email protected]>
+
Merge r124520
2012-08-02 Ryosuke Niwa <[email protected]>
@@ -205969,3 +206025,4 @@
.
.
.
+.
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.cpp (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderBlock.cpp 2012-11-02 21:09:27 UTC (rev 133342)
@@ -1832,12 +1832,8 @@
// Check if this node is allowed to run-in. E.g. <select> expects its renderer to
// be a RenderListBox or RenderMenuList, and hence cannot be a RenderInline run-in.
- Node* runInNode = runIn->node();
- if (runInNode && runInNode->hasTagName(selectTag))
+ if (!runIn->canBeReplacedWithInlineRunIn())
return;
-
- if (runInNode && runInNode->hasTagName(progressTag))
- return;
RenderObject* curr = runIn->nextSibling();
if (!curr || !curr->isRenderBlock() || !curr->childrenInline())
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderFileUploadControl.cpp (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderFileUploadControl.cpp 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderFileUploadControl.cpp 2012-11-02 21:09:27 UTC (rev 133342)
@@ -60,6 +60,11 @@
{
}
+bool RenderFileUploadControl::canBeReplacedWithInlineRunIn() const
+{
+ return false;
+}
+
void RenderFileUploadControl::updateFromElement()
{
HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderFileUploadControl.h (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderFileUploadControl.h 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderFileUploadControl.h 2012-11-02 21:09:27 UTC (rev 133342)
@@ -44,6 +44,7 @@
private:
virtual const char* renderName() const { return "RenderFileUploadControl"; }
+ virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
virtual void updateFromElement();
virtual void computePreferredLogicalWidths();
virtual void paintObject(PaintInfo&, const LayoutPoint&);
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderListBox.cpp (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderListBox.cpp 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderListBox.cpp 2012-11-02 21:09:27 UTC (rev 133342)
@@ -146,6 +146,11 @@
}
}
+bool RenderListBox::canBeReplacedWithInlineRunIn() const
+{
+ return false;
+}
+
void RenderListBox::selectionChanged()
{
repaint();
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderListBox.h (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderListBox.h 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderListBox.h 2012-11-02 21:09:27 UTC (rev 133342)
@@ -61,7 +61,7 @@
virtual bool isListBox() const { return true; }
virtual void updateFromElement();
-
+ virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
virtual bool hasControlClip() const { return true; }
virtual void paintObject(PaintInfo&, const LayoutPoint&);
virtual LayoutRect controlClipRect(const LayoutPoint&) const;
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderMenuList.cpp (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderMenuList.cpp 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderMenuList.cpp 2012-11-02 21:09:27 UTC (rev 133342)
@@ -74,6 +74,11 @@
m_popup = 0;
}
+bool RenderMenuList::canBeReplacedWithInlineRunIn() const
+{
+ return false;
+}
+
void RenderMenuList::createInnerBlock()
{
if (m_innerBlock) {
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderMenuList.h (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderMenuList.h 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderMenuList.h 2012-11-02 21:09:27 UTC (rev 133342)
@@ -68,6 +68,7 @@
virtual LayoutRect controlClipRect(const LayoutPoint&) const;
virtual bool hasControlClip() const { return true; }
virtual bool canHaveGeneratedChildren() const OVERRIDE { return false; }
+ virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
virtual const char* renderName() const { return "RenderMenuList"; }
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.cpp (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.cpp 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.cpp 2012-11-02 21:09:27 UTC (rev 133342)
@@ -2902,6 +2902,11 @@
return containingBlock ? !containingBlock->needsLayout() : true;
}
+bool RenderObject::canBeReplacedWithInlineRunIn() const
+{
+ return true;
+}
+
#if ENABLE(SVG)
RenderSVGResourceContainer* RenderObject::toRenderSVGResourceContainer()
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.h (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.h 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderObject.h 2012-11-02 21:09:27 UTC (rev 133342)
@@ -916,6 +916,8 @@
virtual LayoutRect outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/, LayoutPoint* /*cachedOffsetToRepaintContainer*/ = 0) const { return LayoutRect(); }
+ virtual bool canBeReplacedWithInlineRunIn() const;
+
private:
RenderStyle* firstLineStyleSlowCase() const;
StyleDifference adjustStyleDifference(StyleDifference, unsigned contextSensitiveProperties) const;
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderProgress.cpp (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderProgress.cpp 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderProgress.cpp 2012-11-02 21:09:27 UTC (rev 133342)
@@ -61,6 +61,11 @@
RenderBlock::updateFromElement();
}
+bool RenderProgress::canBeReplacedWithInlineRunIn() const
+{
+ return false;
+}
+
double RenderProgress::animationProgress() const
{
return m_animating ? (fmod((currentTime() - m_animationStartTime), m_animationDuration) / m_animationDuration) : 0;
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderProgress.h (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderProgress.h 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderProgress.h 2012-11-02 21:09:27 UTC (rev 133342)
@@ -46,6 +46,7 @@
virtual bool isProgress() const { return true; }
virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
virtual void updateFromElement();
+ virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
void animationTimerFired(Timer<RenderProgress>*);
void updateAnimationState();
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderSlider.cpp (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderSlider.cpp 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderSlider.cpp 2012-11-02 21:09:27 UTC (rev 133342)
@@ -59,6 +59,11 @@
{
}
+bool RenderSlider::canBeReplacedWithInlineRunIn() const
+{
+ return false;
+}
+
LayoutUnit RenderSlider::baselinePosition(FontBaseline, bool /*firstLine*/, LineDirectionMode, LinePositionMode) const
{
// FIXME: Patch this function for writing-mode.
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderSlider.h (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderSlider.h 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderSlider.h 2012-11-02 21:09:27 UTC (rev 133342)
@@ -39,6 +39,7 @@
private:
virtual const char* renderName() const { return "RenderSlider"; }
virtual bool isSlider() const { return true; }
+ virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
virtual void computePreferredLogicalWidths();
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderTextControl.cpp (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderTextControl.cpp 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderTextControl.cpp 2012-11-02 21:09:27 UTC (rev 133342)
@@ -296,4 +296,9 @@
return placeholderRenderer;
}
+bool RenderTextControl::canBeReplacedWithInlineRunIn() const
+{
+ return false;
+}
+
} // namespace WebCore
Modified: branches/safari-536.28-branch/Source/WebCore/rendering/RenderTextControl.h (133341 => 133342)
--- branches/safari-536.28-branch/Source/WebCore/rendering/RenderTextControl.h 2012-11-02 21:07:51 UTC (rev 133341)
+++ branches/safari-536.28-branch/Source/WebCore/rendering/RenderTextControl.h 2012-11-02 21:09:27 UTC (rev 133342)
@@ -71,6 +71,7 @@
virtual void computePreferredLogicalWidths();
virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
virtual bool avoidsFloats() const { return true; }
+ virtual bool canBeReplacedWithInlineRunIn() const OVERRIDE;
virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
