Modified: branches/safari-600.8-branch/LayoutTests/ChangeLog (186609 => 186610)
--- branches/safari-600.8-branch/LayoutTests/ChangeLog 2015-07-09 20:47:58 UTC (rev 186609)
+++ branches/safari-600.8-branch/LayoutTests/ChangeLog 2015-07-09 21:01:46 UTC (rev 186610)
@@ -1,3 +1,26 @@
+2015-07-09 Matthew Hanson <matthew_han...@apple.com>
+
+ Merge r186502. rdar://problem/21707910
+
+ 2015-07-07 Matthew Hanson <matthew_han...@apple.com>
+
+ Merge r184577. rdar://problem/21708263
+
+ 2015-05-19 Zalan Bujtas <za...@apple.com>
+
+ Merged anonymous blocks should invalidate simple line layout path.
+ https://bugs.webkit.org/show_bug.cgi?id=145104
+ rdar://problem/20980930
+
+ Reviewed by Antti Koivisto.
+
+ When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
+ This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
+ Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
+
+ * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt: Added.
+ * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html: Added.
+
2015-06-16 Alexey Proskuryakov <a...@apple.com>
Add expectations for a couple flaky tests:
Added: branches/safari-600.8-branch/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt (0 => 186610)
--- branches/safari-600.8-branch/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt (rev 0)
+++ branches/safari-600.8-branch/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt 2015-07-09 21:01:46 UTC (rev 186610)
@@ -0,0 +1,2 @@
+Pass if no crash or assert in debug.
+foo
Added: branches/safari-600.8-branch/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html (0 => 186610)
--- branches/safari-600.8-branch/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html (rev 0)
+++ branches/safari-600.8-branch/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html 2015-07-09 21:01:46 UTC (rev 186610)
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests when 2 anonymous blocks are merged and the 'to' block has simple line layout path.</title>
+</head>
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<div>Pass if no crash or assert in debug.</div>foo<div id="removethis"></div><span>
+<script>
+ document.body.offsetWidth;
+ var elem = document.getElementById("removethis");
+ elem.parentNode.removeChild(elem);
+</script>
+</body>
+</html>
Modified: branches/safari-600.8-branch/Source/WebCore/ChangeLog (186609 => 186610)
--- branches/safari-600.8-branch/Source/WebCore/ChangeLog 2015-07-09 20:47:58 UTC (rev 186609)
+++ branches/safari-600.8-branch/Source/WebCore/ChangeLog 2015-07-09 21:01:46 UTC (rev 186610)
@@ -1,3 +1,28 @@
+2015-07-09 Matthew Hanson <matthew_han...@apple.com>
+
+ Merge r186502. rdar://problem/21707910
+
+ 2015-07-07 Matthew Hanson <matthew_han...@apple.com>
+
+ Merge r184577. rdar://problem/21708263
+
+ 2015-05-19 Zalan Bujtas <za...@apple.com>
+
+ Merged anonymous blocks should invalidate simple line layout path.
+ https://bugs.webkit.org/show_bug.cgi?id=145104
+ rdar://problem/20980930
+
+ Reviewed by Antti Koivisto.
+
+ When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
+ This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
+ Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
+
+ Test: fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html
+
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::insertChildInternal):
+
2015-06-08 Babak Shafiei <bshaf...@apple.com>
Merge r183682.
Modified: branches/safari-600.8-branch/Source/WebCore/rendering/RenderElement.cpp (186609 => 186610)
--- branches/safari-600.8-branch/Source/WebCore/rendering/RenderElement.cpp 2015-07-09 20:47:58 UTC (rev 186609)
+++ branches/safari-600.8-branch/Source/WebCore/rendering/RenderElement.cpp 2015-07-09 21:01:46 UTC (rev 186610)
@@ -70,7 +70,7 @@
bool RenderElement::s_affectsParentBlock = false;
bool RenderElement::s_noLongerAffectsParentBlock = false;
-
+
static HashMap<const RenderObject*, ControlStates*>& controlStatesRendererMap()
{
static NeverDestroyed<HashMap<const RenderObject*, ControlStates*>> map;
@@ -274,7 +274,7 @@
else if (diff < StyleDifferenceRecompositeLayer)
diff = StyleDifferenceRecompositeLayer;
}
-
+
#if ENABLE(CSS_FILTERS)
if ((contextSensitiveProperties & ContextSensitivePropertyFilter) && hasLayer()) {
RenderLayer* layer = toRenderLayerModelObject(this)->layer();
@@ -284,7 +284,7 @@
diff = StyleDifferenceRecompositeLayer;
}
#endif
-
+
// The answer to requiresLayer() for plugins, iframes, and canvas can change without the actual
// style changing, since it depends on whether we decide to composite these elements. When the
// layer status of one of these elements changes, we need to force a layout.
@@ -321,7 +321,7 @@
// Optimize the common case
if (oldLayers && !oldLayers->next() && newLayers && !newLayers->next() && (oldLayers->image() == newLayers->image()))
return;
-
+
// Go through the new layers and addClients first, to avoid removing all clients of an image.
for (const FillLayer* currNew = newLayers; currNew; currNew = currNew->next()) {
if (currNew->image())
@@ -444,7 +444,7 @@
// Now that the layer (if any) has been updated, we need to adjust the diff again,
// check whether we should layout now, and decide if we need to repaint.
StyleDifference updatedDiff = adjustStyleDifference(diff, contextSensitiveProperties);
-
+
if (diff <= StyleDifferenceLayoutPositionedMovementOnly) {
if (updatedDiff == StyleDifferenceLayout)
setNeedsLayoutAndPrefWidthsRecalc();
@@ -579,6 +579,8 @@
if (AXObjectCache* cache = document().axObjectCache())
cache->childrenChanged(this, newChild);
+ if (this->isRenderBlockFlow())
+ toRenderBlockFlow(*this).invalidateLineLayoutPath();
}
RenderObject* RenderElement::removeChildInternal(RenderObject& oldChild, NotifyChildrenType notifyChildren)
@@ -618,7 +620,7 @@
// WARNING: There should be no code running between willBeRemovedFromTree and the actual removal below.
// This is needed to avoid race conditions where willBeRemovedFromTree would dirty the tree's structure
// and the code running here would force an untimely rebuilding, leaving |oldChild| dangling.
-
+
RenderObject* nextSibling = oldChild.nextSibling();
if (oldChild.previousSibling())
@@ -642,7 +644,7 @@
if (AXObjectCache* cache = document().existingAXObjectCache())
cache->childrenChanged(this);
-
+
return nextSibling;
}
@@ -750,7 +752,7 @@
return false;
parentRenderer = parentRenderer->parent();
}
-
+
return true;
}
@@ -919,7 +921,7 @@
if (!m_parent)
return;
-
+
if (diff == StyleDifferenceLayout || diff == StyleDifferenceSimplifiedLayout) {
RenderCounter::rendererStyleChanged(this, oldStyle, &m_style.get());
@@ -1382,7 +1384,7 @@
return current;
if (!current->isRenderInline() || current->isRubyText())
return nullptr;
-
+
const RenderStyle& styleToUse = firstLine ? current->firstLineStyle() : current->style();
if (styleToUse.textDecoration() & textDecoration)
return current;
