Title: [210396] branches/safari-603-branch
- Revision
- 210396
- Author
- matthew_han...@apple.com
- Date
- 2017-01-05 15:49:57 -0800 (Thu, 05 Jan 2017)
Log Message
Merge r210369. rdar://problem/29100419
Modified Paths
Added Paths
Diff
Modified: branches/safari-603-branch/LayoutTests/ChangeLog (210395 => 210396)
--- branches/safari-603-branch/LayoutTests/ChangeLog 2017-01-05 23:49:54 UTC (rev 210395)
+++ branches/safari-603-branch/LayoutTests/ChangeLog 2017-01-05 23:49:57 UTC (rev 210396)
@@ -1,5 +1,20 @@
2017-01-05 Matthew Hanson <matthew_han...@apple.com>
+ Merge r210369. rdar://problem/29100419
+
+ 2017-01-05 Zalan Bujtas <za...@apple.com>
+
+ Mark the dedicated root linebox for trailing floats in empty inlines dirty.
+ https://bugs.webkit.org/show_bug.cgi?id=166732
+ <rdar://problem/29100419>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/inline/trailing-floats-inline-crash2-expected.txt: Added.
+ * fast/inline/trailing-floats-inline-crash2.html: Added.
+
+2017-01-05 Matthew Hanson <matthew_han...@apple.com>
+
Merge r210361. rdar://problem/29870245
2017-01-05 Chris Dumez <cdu...@apple.com>
Added: branches/safari-603-branch/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt (0 => 210396)
--- branches/safari-603-branch/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt (rev 0)
+++ branches/safari-603-branch/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt 2017-01-05 23:49:57 UTC (rev 210396)
@@ -0,0 +1,5 @@
+PASS if no crash or assert.
+
+
+foobar foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar
+
Added: branches/safari-603-branch/LayoutTests/fast/inline/trailing-floats-inline-crash2.html (0 => 210396)
--- branches/safari-603-branch/LayoutTests/fast/inline/trailing-floats-inline-crash2.html (rev 0)
+++ branches/safari-603-branch/LayoutTests/fast/inline/trailing-floats-inline-crash2.html 2017-01-05 23:49:57 UTC (rev 210396)
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+ :last-child {float:left;}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+PASS if no crash or assert.
+<div></div><br><div><pre></pre><br><span><strike>
+foobar foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar<br><input></strike><script>
+document.body.offsetHeight;</script></span></div>
+</body>
+</html>
Modified: branches/safari-603-branch/Source/WebCore/ChangeLog (210395 => 210396)
--- branches/safari-603-branch/Source/WebCore/ChangeLog 2017-01-05 23:49:54 UTC (rev 210395)
+++ branches/safari-603-branch/Source/WebCore/ChangeLog 2017-01-05 23:49:57 UTC (rev 210396)
@@ -1,5 +1,29 @@
2017-01-05 Matthew Hanson <matthew_han...@apple.com>
+ Merge r210369. rdar://problem/29100419
+
+ 2017-01-05 Zalan Bujtas <za...@apple.com>
+
+ Mark the dedicated root linebox for trailing floats in empty inlines dirty.
+ https://bugs.webkit.org/show_bug.cgi?id=166732
+ <rdar://problem/29100419>
+
+ Reviewed by Antti Koivisto.
+
+ We normally attach floating boxes to the last root linebox. However when the floatbox is preceded by a <br>
+ we generate a dedicated root linebox (TrailingFloatsRootInlineBox) for the floatbox.
+ When this floatbox is a RenderInline descendant and this RenderInline does not generate lineboxes (it's ancestor RenderBlockFlow does)
+ we have to make sure that this special root linebox gets marked dirty when the associated floatbox changes.
+ (Unfortunately through the recursive calls on dirtyLinesFromChangedChild(), we lose the information about
+ the "changed child" since the inlines propagates the marking logic to the RenderBlockFlow, see FIXME.)
+
+ Test: fast/inline/trailing-floats-inline-crash2.html
+
+ * rendering/RenderLineBoxList.cpp:
+ (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+
+2017-01-05 Matthew Hanson <matthew_han...@apple.com>
+
Merge r210368. rdar://problem/28908164
2017-01-05 Antoine Quint <grao...@apple.com>
Modified: branches/safari-603-branch/Source/WebCore/rendering/RenderLineBoxList.cpp (210395 => 210396)
--- branches/safari-603-branch/Source/WebCore/rendering/RenderLineBoxList.cpp 2017-01-05 23:49:54 UTC (rev 210395)
+++ branches/safari-603-branch/Source/WebCore/rendering/RenderLineBoxList.cpp 2017-01-05 23:49:57 UTC (rev 210396)
@@ -323,8 +323,8 @@
return;
}
- // Try to figure out which line box we belong in. First try to find a previous
- // line box by examining our siblings. If we didn't find a line box, then use our
+ // Try to figure out which line box we belong in. First try to find a previous
+ // line box by examining our siblings. If we didn't find a line box, then use our
// parent's first line box.
RootInlineBox* box = nullptr;
RenderObject* current;
@@ -370,11 +370,11 @@
if (box) {
box->markDirty();
- // dirty the adjacent lines that might be affected
+ // Dirty the adjacent lines that might be affected.
// NOTE: we dirty the previous line because RootInlineBox objects cache
// the address of the first object on the next line after a BR, which we may be
- // invalidating here. For more info, see how RenderBlock::layoutInlineChildren
- // calls setLineBreakInfo with the result of findNextLineBreak. findNextLineBreak,
+ // invalidating here. For more info, see how RenderBlock::layoutInlineChildren
+ // calls setLineBreakInfo with the result of findNextLineBreak. findNextLineBreak,
// despite the name, actually returns the first RenderObject after the BR.
// <rdar://problem/3849947> "Typing after pasting line does not appear until after window resize."
if (RootInlineBox* prevBox = box->prevRootBox())
@@ -384,11 +384,13 @@
// necessary some of the time, in situations involving BRs.
if (RootInlineBox* nextBox = box->nextRootBox()) {
nextBox->markDirty();
-
- // Special root box for floats may be added at the end of the list. If this occurs with BRs we need to invalidate it explicitly.
- if (auto* nextNextBox = nextBox->nextRootBox()) {
- if (nextNextBox->isTrailingFloatsRootInlineBox())
- nextNextBox->markDirty();
+ // Dedicated linebox for floats may be added as the last rootbox. If this occurs with BRs inside inlines that propagte their lineboxes to
+ // the parent flow, we need to invalidate it explicitly.
+ // FIXME: We should be able to figure out the actual "changed child" even when we are calling through empty inlines recursively.
+ if (is<RenderInline>(child) && !downcast<RenderInline>(child).firstLineBoxIncludingCulling()) {
+ auto* lastRootBox = nextBox->blockFlow().lastRootBox();
+ if (lastRootBox->isTrailingFloatsRootInlineBox() && !lastRootBox->isDirty())
+ lastRootBox->markDirty();
}
}
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
