Title: [275278] trunk/Source/WebCore
- Revision
- 275278
- Author
- za...@apple.com
- Date
- 2021-03-31 06:40:44 -0700 (Wed, 31 Mar 2021)
Log Message
[RenderTreeBuilder] Do not merge anonymous table cells with mismatching children types
https://bugs.webkit.org/show_bug.cgi?id=223979
<rdar://76003320>
Reviewed by Antti Koivisto.
A table cell (as it establishes a block formatting context) should only contain either
inline or block level inflow boxes.
* rendering/RenderElement.h:
(WebCore::RenderElement::firstInFlowChild const):
(WebCore::RenderElement::lastInFlowChild const):
* rendering/RenderObject.h:
(WebCore::RenderObject::isInFlow const):
(WebCore::RenderObject::previousInFlowSibling const):
(WebCore::RenderObject::nextInFlowSibling const):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::canCollapseNextSibling):
(WebCore::RenderTreeBuilder::Table::collapseAndDetachAnonymousNextSibling):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (275277 => 275278)
--- trunk/Source/WebCore/ChangeLog 2021-03-31 12:16:18 UTC (rev 275277)
+++ trunk/Source/WebCore/ChangeLog 2021-03-31 13:40:44 UTC (rev 275278)
@@ -1,3 +1,25 @@
+2021-03-31 Zalan Bujtas <za...@apple.com>
+
+ [RenderTreeBuilder] Do not merge anonymous table cells with mismatching children types
+ https://bugs.webkit.org/show_bug.cgi?id=223979
+ <rdar://76003320>
+
+ Reviewed by Antti Koivisto.
+
+ A table cell (as it establishes a block formatting context) should only contain either
+ inline or block level inflow boxes.
+
+ * rendering/RenderElement.h:
+ (WebCore::RenderElement::firstInFlowChild const):
+ (WebCore::RenderElement::lastInFlowChild const):
+ * rendering/RenderObject.h:
+ (WebCore::RenderObject::isInFlow const):
+ (WebCore::RenderObject::previousInFlowSibling const):
+ (WebCore::RenderObject::nextInFlowSibling const):
+ * rendering/updating/RenderTreeBuilderTable.cpp:
+ (WebCore::canCollapseNextSibling):
+ (WebCore::RenderTreeBuilder::Table::collapseAndDetachAnonymousNextSibling):
+
2021-03-31 Antti Koivisto <an...@apple.com>
Animated pseudo element style resolved against wrong parent style
Modified: trunk/Source/WebCore/rendering/RenderElement.h (275277 => 275278)
--- trunk/Source/WebCore/rendering/RenderElement.h 2021-03-31 12:16:18 UTC (rev 275277)
+++ trunk/Source/WebCore/rendering/RenderElement.h 2021-03-31 13:40:44 UTC (rev 275278)
@@ -69,6 +69,8 @@
RenderObject* firstChild() const { return m_firstChild; }
RenderObject* lastChild() const { return m_lastChild; }
+ RenderObject* firstInFlowChild() const;
+ RenderObject* lastInFlowChild() const;
bool canContainFixedPositionObjects() const;
bool canContainAbsolutelyPositionedObjects() const;
@@ -502,6 +504,26 @@
return adjustLayoutUnitForAbsoluteZoom(value, renderer.style());
}
+inline RenderObject* RenderElement::firstInFlowChild() const
+{
+ if (auto* firstChild = this->firstChild()) {
+ if (firstChild->isInFlow())
+ return firstChild;
+ return firstChild->nextInFlowSibling();
+ }
+ return nullptr;
+}
+
+inline RenderObject* RenderElement::lastInFlowChild() const
+{
+ if (auto* lastChild = this->lastChild()) {
+ if (lastChild->isInFlow())
+ return lastChild;
+ return lastChild->previousInFlowSibling();
+ }
+ return nullptr;
+}
+
} // namespace WebCore
SPECIALIZE_TYPE_TRAITS_RENDER_OBJECT(RenderElement, isRenderElement())
Modified: trunk/Source/WebCore/rendering/RenderObject.h (275277 => 275278)
--- trunk/Source/WebCore/rendering/RenderObject.h 2021-03-31 12:16:18 UTC (rev 275277)
+++ trunk/Source/WebCore/rendering/RenderObject.h 2021-03-31 13:40:44 UTC (rev 275278)
@@ -116,6 +116,8 @@
RenderObject* previousSibling() const { return m_previous; }
RenderObject* nextSibling() const { return m_next; }
+ RenderObject* previousInFlowSibling() const;
+ RenderObject* nextInFlowSibling() const;
// Use RenderElement versions instead.
virtual RenderObject* firstChildSlow() const { return nullptr; }
@@ -650,6 +652,7 @@
virtual unsigned length() const { return 1; }
bool isFloatingOrOutOfFlowPositioned() const { return (isFloating() || isOutOfFlowPositioned()); }
+ bool isInFlow() const { return !isFloatingOrOutOfFlowPositioned(); }
enum HighlightState {
None, // The object is not selected.
@@ -1153,6 +1156,22 @@
m_rendererWithStyleFlags.setPointer(renderer);
}
+inline RenderObject* RenderObject::previousInFlowSibling() const
+{
+ auto* previousSibling = this->previousSibling();
+ while (previousSibling && !previousSibling->isInFlow())
+ previousSibling = previousSibling->previousSibling();
+ return previousSibling;
+}
+
+inline RenderObject* RenderObject::nextInFlowSibling() const
+{
+ auto* nextSibling = this->nextSibling();
+ while (nextSibling && !nextSibling->isInFlow())
+ nextSibling = nextSibling->nextSibling();
+ return nextSibling;
+}
+
WTF::TextStream& operator<<(WTF::TextStream&, const RenderObject&);
#if ENABLE(TREE_DEBUGGING)
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp (275277 => 275278)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp 2021-03-31 12:16:18 UTC (rev 275277)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp 2021-03-31 13:40:44 UTC (rev 275278)
@@ -247,12 +247,22 @@
return false;
}
+static inline bool canCollapseNextSibling(const RenderBox& previousSibling, const RenderBox& nextSibling)
+{
+ if (!previousSibling.isAnonymous() || !nextSibling.isAnonymous())
+ return false;
+ auto* previousSiblingFirstInFlowChild = previousSibling.firstInFlowChild();
+ auto* nextSiblingFirstInFlowChild = nextSibling.firstInFlowChild();
+ // Do not try to collapse and move inline level boxes over to a container with block level boxes (and vice versa).
+ return !previousSiblingFirstInFlowChild || !nextSiblingFirstInFlowChild || previousSiblingFirstInFlowChild->isInline() == nextSiblingFirstInFlowChild->isInline();
+}
+
template <typename Parent, typename Child>
RenderPtr<RenderObject> RenderTreeBuilder::Table::collapseAndDetachAnonymousNextSibling(Parent* parent, Child* previousSibling, Child* nextSibling)
{
if (!parent || !previousSibling || !nextSibling)
return { };
- if (!previousSibling->isAnonymous() || !nextSibling->isAnonymous())
+ if (!canCollapseNextSibling(*previousSibling, *nextSibling))
return { };
m_builder.moveAllChildren(*nextSibling, *previousSibling, RenderTreeBuilder::NormalizeAfterInsertion::No);
return m_builder.detach(*parent, *nextSibling);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
