Title: [207984] releases/WebKitGTK/webkit-2.14
- Revision
- 207984
- Author
- [email protected]
- Date
- 2016-10-27 03:45:54 -0700 (Thu, 27 Oct 2016)
Log Message
Merge r207683 - Do not mutate the render tree while collecting selection repaint rects.
https://bugs.webkit.org/show_bug.cgi?id=163800
<rdar://problem/28806886>
Reviewed by David Hyatt.
Source/WebCore:
RenderListItem not only mutates the tree while in layout but it also uses
the old descendant context to find the insertion point.
This patch strictly ensures that we only do it while in layout and never
in other cases such as collecting repaint rects.
This gets redundant when webkit.org/b/163789 is fixed.
Test: fast/lists/crash-when-list-marker-is-moved-during-selection.html
* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
LayoutTests:
* fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt: Added.
* fast/lists/crash-when-list-marker-is-moved-during-selection.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog (207983 => 207984)
--- releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog 2016-10-27 10:43:20 UTC (rev 207983)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog 2016-10-27 10:45:54 UTC (rev 207984)
@@ -1,3 +1,14 @@
+2016-10-21 Zalan Bujtas <[email protected]>
+
+ Do not mutate the render tree while collecting selection repaint rects.
+ https://bugs.webkit.org/show_bug.cgi?id=163800
+ <rdar://problem/28806886>
+
+ Reviewed by David Hyatt.
+
+ * fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt: Added.
+ * fast/lists/crash-when-list-marker-is-moved-during-selection.html: Added.
+
2016-10-20 Zalan Bujtas <[email protected]>
Stop searching for first-letter containers at multi-column boundary.
Added: releases/WebKitGTK/webkit-2.14/LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt (0 => 207984)
--- releases/WebKitGTK/webkit-2.14/LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection-expected.txt 2016-10-27 10:45:54 UTC (rev 207984)
@@ -0,0 +1,2 @@
+Pass if no crash or assert.
+
Added: releases/WebKitGTK/webkit-2.14/LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection.html (0 => 207984)
--- releases/WebKitGTK/webkit-2.14/LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection.html (rev 0)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/fast/lists/crash-when-list-marker-is-moved-during-selection.html 2016-10-27 10:45:54 UTC (rev 207984)
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we don't mutate the render tree during selection.</title>
+<style>
+ body {
+ column-count: 2;
+ }
+</style>
+<script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+ }
+
+ function runTest() {
+ setTimeout(function() {
+ li.style.webkitWritingMode = "horizontal-tb";
+ innerSpan.style.display = "list-item";
+ mostInnerSpan.style.display = "list-item";
+ document.getSelection().setBaseAndExtent(container, 0, document.body, document.body.childNodes.length);
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+ }
+</script>
+</head>
+<body _onload_=runTest()>
+Pass if no crash or assert.
+<div id="container" style="-webkit-writing-mode: vertical-rl"><table><tr><td><li id="li"><span id="innerSpan"><span id="mostInnerSpan"></span></span></li></tr></td></table>
+</body>
+</html>
Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog (207983 => 207984)
--- releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog 2016-10-27 10:43:20 UTC (rev 207983)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog 2016-10-27 10:45:54 UTC (rev 207984)
@@ -1,3 +1,22 @@
+2016-10-21 Zalan Bujtas <[email protected]>
+
+ Do not mutate the render tree while collecting selection repaint rects.
+ https://bugs.webkit.org/show_bug.cgi?id=163800
+ <rdar://problem/28806886>
+
+ Reviewed by David Hyatt.
+
+ RenderListItem not only mutates the tree while in layout but it also uses
+ the old descendant context to find the insertion point.
+ This patch strictly ensures that we only do it while in layout and never
+ in other cases such as collecting repaint rects.
+ This gets redundant when webkit.org/b/163789 is fixed.
+
+ Test: fast/lists/crash-when-list-marker-is-moved-during-selection.html
+
+ * rendering/RenderListItem.cpp:
+ (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
+
2016-10-20 Carlos Garcia Campos <[email protected]>
[GTK] Configures but fails to link with ENABLE_OPENGL=OFF
Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp (207983 => 207984)
--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp 2016-10-27 10:43:20 UTC (rev 207983)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp 2016-10-27 10:45:54 UTC (rev 207984)
@@ -268,6 +268,11 @@
if (!m_marker)
return;
+ // FIXME: Do not even try reposition the marker when we are not in layout
+ // until after we fixed webkit.org/b/163789.
+ if (!view().frameView().isInRenderTreeLayout())
+ return;
+
RenderElement* currentParent = m_marker->parent();
RenderBlock* newParent = getParentOfFirstLineBox(*this, *m_marker);
if (!newParent) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
