Diff
Modified: trunk/LayoutTests/ChangeLog (289134 => 289135)
--- trunk/LayoutTests/ChangeLog 2022-02-04 19:50:04 UTC (rev 289134)
+++ trunk/LayoutTests/ChangeLog 2022-02-04 21:29:41 UTC (rev 289135)
@@ -1,3 +1,17 @@
+2022-02-04 Commit Queue <commit-qu...@webkit.org>
+
+ Unreviewed, reverting r289098.
+ https://bugs.webkit.org/show_bug.cgi?id=236154
+
+ caused some unexpected crashes
+
+ Reverted changeset:
+
+ "[RenderTreeBuilder] Clean up column spanners when style
+ change affects containing block"
+ https://bugs.webkit.org/show_bug.cgi?id=236042
+ https://commits.webkit.org/r289098
+
2022-02-04 Sam Weinig <wei...@apple.com>
Gradients don't correctly interpolate missing/none color components correctly
Deleted: trunk/LayoutTests/fast/multicol/leftover-spanner-on-style-change-crash-expected.txt (289134 => 289135)
--- trunk/LayoutTests/fast/multicol/leftover-spanner-on-style-change-crash-expected.txt 2022-02-04 19:50:04 UTC (rev 289134)
+++ trunk/LayoutTests/fast/multicol/leftover-spanner-on-style-change-crash-expected.txt 2022-02-04 21:29:41 UTC (rev 289135)
@@ -1 +0,0 @@
-
Deleted: trunk/LayoutTests/fast/multicol/leftover-spanner-on-style-change-crash.html (289134 => 289135)
--- trunk/LayoutTests/fast/multicol/leftover-spanner-on-style-change-crash.html 2022-02-04 19:50:04 UTC (rev 289134)
+++ trunk/LayoutTests/fast/multicol/leftover-spanner-on-style-change-crash.html 2022-02-04 21:29:41 UTC (rev 289135)
@@ -1,31 +0,0 @@
-<style>
- html {
- columns: 1px;
- }
- div::before {
- content: url();
- }
- frame {
- column-span: all;
- }
- :first-child {
- position: absolute;
- rotate: 0deg;
- }
- :read-only {
- translate: 0;
- }
-</style>
-<!-- PASS if no crash or assert. -->
-<script>
- if (window.testRunner)
- testRunner.dumpAsText();
- internals.settings.setTextAutosizingEnabled(true);
- _onload_ = () => {
- let div0 = document.createElement('div');
- document.body.appendChild(div0);
- div0.appendChild(document.createElement('frame'));
- document.body.offsetTop;
- document.designMode = 'on';
- };
-</script>
Modified: trunk/Source/WebCore/ChangeLog (289134 => 289135)
--- trunk/Source/WebCore/ChangeLog 2022-02-04 19:50:04 UTC (rev 289134)
+++ trunk/Source/WebCore/ChangeLog 2022-02-04 21:29:41 UTC (rev 289135)
@@ -1,3 +1,17 @@
+2022-02-04 Commit Queue <commit-qu...@webkit.org>
+
+ Unreviewed, reverting r289098.
+ https://bugs.webkit.org/show_bug.cgi?id=236154
+
+ caused some unexpected crashes
+
+ Reverted changeset:
+
+ "[RenderTreeBuilder] Clean up column spanners when style
+ change affects containing block"
+ https://bugs.webkit.org/show_bug.cgi?id=236042
+ https://commits.webkit.org/r289098
+
2022-02-04 Alex Christensen <achristen...@webkit.org>
Remember whether cached main resources used private relay when considering whether to call _setPrivacyProxyFailClosed
Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (289134 => 289135)
--- trunk/Source/WebCore/rendering/RenderBlock.cpp 2022-02-04 19:50:04 UTC (rev 289134)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp 2022-02-04 21:29:41 UTC (rev 289135)
@@ -432,10 +432,11 @@
void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
{
+ bool hadTransform = hasTransform();
RenderBox::styleDidChange(diff, oldStyle);
- if (oldStyle)
- adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded(*oldStyle, style());
+ if (hadTransform != hasTransform())
+ adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded();
propagateStyleToAnonymousChildren(PropagateToBlockChildrenOnly);
Modified: trunk/Source/WebCore/rendering/RenderElement.cpp (289134 => 289135)
--- trunk/Source/WebCore/rendering/RenderElement.cpp 2022-02-04 19:50:04 UTC (rev 289134)
+++ trunk/Source/WebCore/rendering/RenderElement.cpp 2022-02-04 21:29:41 UTC (rev 289135)
@@ -532,7 +532,10 @@
auto oldStyle = m_style.replace(WTFMove(style));
bool detachedFromParent = !parent();
- adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded(oldStyle, m_style);
+ // Make sure we invalidate the containing block cache for flows when the contianing block context changes
+ // so that styleDidChange can safely use RenderBlock::locateEnclosingFragmentedFlow()
+ if (oldStyle.position() != m_style.position())
+ adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded();
styleDidChange(diff, &oldStyle);
@@ -2211,22 +2214,11 @@
return (imageElement && !imageElement->allowsOrientationOverride()) ? ImageOrientation(ImageOrientation::FromImage) : style().imageOrientation();
}
-void RenderElement::adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded(const RenderStyle& oldStyle, const RenderStyle& newStyle)
+void RenderElement::adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded()
{
if (fragmentedFlowState() == NotInsideFragmentedFlow)
return;
- // Make sure we invalidate the containing block cache for flows when the contianing block context changes
- // so that styleDidChange can safely use RenderBlock::locateEnclosingFragmentedFlow()
- // FIXME: Share some code with RenderElement::canContain*.
- auto mayNotBeContainingBlockForDescendantsAnymore = oldStyle.position() != m_style.position()
- || oldStyle.hasTransformRelatedProperty() != m_style.hasTransformRelatedProperty()
- || oldStyle.willChange() != newStyle.willChange()
- || oldStyle.containsLayout() != newStyle.containsLayout()
- || oldStyle.containsSize() != newStyle.containsSize();
- if (!mayNotBeContainingBlockForDescendantsAnymore)
- return;
-
// Invalidate the containing block caches.
if (is<RenderBlock>(*this))
downcast<RenderBlock>(*this).resetEnclosingFragmentedFlowAndChildInfoIncludingDescendants();
Modified: trunk/Source/WebCore/rendering/RenderElement.h (289134 => 289135)
--- trunk/Source/WebCore/rendering/RenderElement.h 2022-02-04 19:50:04 UTC (rev 289134)
+++ trunk/Source/WebCore/rendering/RenderElement.h 2022-02-04 21:29:41 UTC (rev 289135)
@@ -326,7 +326,7 @@
void updateOutlineAutoAncestor(bool hasOutlineAuto);
void removeFromRenderFragmentedFlowIncludingDescendants(bool shouldUpdateState);
- void adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded(const RenderStyle& oldStyle, const RenderStyle& newStyle);
+ void adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded();
bool isVisibleInViewport() const;
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp (289134 => 289135)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2022-02-04 19:50:04 UTC (rev 289134)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp 2022-02-04 21:29:41 UTC (rev 289135)
@@ -671,13 +671,6 @@
multiColumnBuilder().restoreColumnSpannersForContainer(renderer, downcast<RenderMultiColumnFlow>(*enclosingFragmentedFlow));
return;
}
-
- // Style change may have moved some subtree out of the fragmented flow. Their flow states have already been updated (see adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded)
- // and here is where we take care of the remaining, spanner tree mutation.
- for (auto& descendant : descendantsOfType<RenderMultiColumnSpannerPlaceholder>(renderer)) {
- if (auto* containingBlock = descendant.containingBlock(); containingBlock && containingBlock->enclosingFragmentedFlow() != enclosingFragmentedFlow)
- multiColumnBuilder().restoreColumnSpannersForContainer(*containingBlock, downcast<RenderMultiColumnFlow>(*enclosingFragmentedFlow));
- }
}
}
