Diff
Copied: branches/chromium/912/LayoutTests/fast/css-generated-content/nested-tables-with-before-after-content-crash.html (from rev 100630, trunk/LayoutTests/fast/css-generated-content/nested-tables-with-before-after-content-crash.html) (0 => 101037)
--- branches/chromium/912/LayoutTests/fast/css-generated-content/nested-tables-with-before-after-content-crash.html (rev 0)
+++ branches/chromium/912/LayoutTests/fast/css-generated-content/nested-tables-with-before-after-content-crash.html 2011-11-23 02:51:03 UTC (rev 101037)
@@ -0,0 +1,18 @@
+<!DOCTYPE>
+<html style="font: 1em/1 Ahem, sans-serif;">
+<style type="text/css">
+.c1 { display: inline-table; color: blue}
+.c1:before { overflow: hidden; content: counter(section); color: red}
+.c1:nth-child(2n) { text-decoration: overline; }
+</style>
+<body>
+<div class="c1" id="div1"><q style="display:inline-table"></q></div>
+</body>
+<script>
+ function runTest() {
+ document.getElementById('div1').setAttribute('class', 'c1');
+ document.body.offsetTop;
+ }
+ window._onload_ = runTest;
+</script>
+</html>
Copied: branches/chromium/912/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png (from rev 100630, trunk/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png)
(Binary files differ)
Copied: branches/chromium/912/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (from rev 100630, trunk/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt) (0 => 101037)
--- branches/chromium/912/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (rev 0)
+++ branches/chromium/912/LayoutTests/platform/chromium-win/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt 2011-11-23 02:51:03 UTC (rev 101037)
@@ -0,0 +1,24 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,8) size 784x584
+ RenderTable {DIV} at (0,0) size 48x19 [color=#0000FF]
+ RenderTableSection (anonymous) at (0,0) size 48x19
+ RenderTableRow (anonymous) at (0,0) size 48x19
+ RenderTableCell (anonymous) at (0,0) size 48x19 [r=0 c=0 rs=1 cs=1]
+ RenderInline (generated) at (0,0) size 16x16 [color=#FF0000]
+ RenderCounter at (0,3) size 16x16
+ text run at (0,3) width 16: "0"
+ RenderTable {Q} at (16,0) size 32x16
+ RenderTableSection (anonymous) at (0,0) size 32x16
+ RenderTableRow (anonymous) at (0,0) size 32x16
+ RenderTableCell (anonymous) at (0,0) size 32x16 [r=0 c=0 rs=1 cs=1]
+ RenderInline (generated) at (0,0) size 16x16
+ RenderQuote at (0,0) size 16x16
+ text run at (0,0) width 16: "\""
+ RenderInline (generated) at (0,0) size 16x16
+ RenderQuote at (16,0) size 16x16
+ text run at (16,0) width 16: "\""
+ RenderText {#text} at (0,0) size 0x0
+ RenderText {#text} at (0,0) size 0x0
Copied: branches/chromium/912/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png (from rev 100630, trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.png)
(Binary files differ)
Copied: branches/chromium/912/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (from rev 100630, trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt) (0 => 101037)
--- branches/chromium/912/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (rev 0)
+++ branches/chromium/912/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt 2011-11-23 02:51:03 UTC (rev 101037)
@@ -0,0 +1,24 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,8) size 784x584
+ RenderTable {DIV} at (0,0) size 48x19 [color=#0000FF]
+ RenderTableSection (anonymous) at (0,0) size 48x19
+ RenderTableRow (anonymous) at (0,0) size 48x19
+ RenderTableCell (anonymous) at (0,0) size 48x19 [r=0 c=0 rs=1 cs=1]
+ RenderInline (generated) at (0,0) size 16x16 [color=#FF0000]
+ RenderCounter at (0,3) size 16x16
+ text run at (0,3) width 16: "0"
+ RenderTable {Q} at (16,0) size 32x16
+ RenderTableSection (anonymous) at (0,0) size 32x16
+ RenderTableRow (anonymous) at (0,0) size 32x16
+ RenderTableCell (anonymous) at (0,0) size 32x16 [r=0 c=0 rs=1 cs=1]
+ RenderInline (generated) at (0,0) size 16x16
+ RenderQuote at (0,0) size 16x16
+ text run at (0,0) width 16: "\""
+ RenderInline (generated) at (0,0) size 16x16
+ RenderQuote at (16,0) size 16x16
+ text run at (16,0) width 16: "\""
+ RenderText {#text} at (0,0) size 0x0
+ RenderText {#text} at (0,0) size 0x0
Modified: branches/chromium/912/Source/WebCore/rendering/RenderBlock.cpp (101036 => 101037)
--- branches/chromium/912/Source/WebCore/rendering/RenderBlock.cpp 2011-11-23 02:15:40 UTC (rev 101036)
+++ branches/chromium/912/Source/WebCore/rendering/RenderBlock.cpp 2011-11-23 02:51:03 UTC (rev 101037)
@@ -674,7 +674,7 @@
{
// Make sure we don't append things after :after-generated content if we have it.
if (!beforeChild)
- beforeChild = findAfterContentRenderer();
+ beforeChild = afterPseudoElementRenderer();
// If the requested beforeChild is not one of our children, then this is because
// there is an anonymous container within this object that contains the beforeChild.
Modified: branches/chromium/912/Source/WebCore/rendering/RenderObject.cpp (101036 => 101037)
--- branches/chromium/912/Source/WebCore/rendering/RenderObject.cpp 2011-11-23 02:15:40 UTC (rev 101036)
+++ branches/chromium/912/Source/WebCore/rendering/RenderObject.cpp 2011-11-23 02:51:03 UTC (rev 101037)
@@ -268,6 +268,16 @@
return node() && node()->renderer() == this && node()->hasTagName(marqueeTag);
}
+static bool isBeforeAfterContentGeneratedByAncestor(RenderObject* renderer, RenderObject* beforeAfterContent)
+{
+ while (renderer) {
+ if (renderer->generatingNode() == beforeAfterContent->generatingNode())
+ return true;
+ renderer = renderer->parent();
+ }
+ return false;
+}
+
void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)
{
RenderObjectChildList* children = virtualChildren();
@@ -278,9 +288,9 @@
RenderObject* beforeContent = 0;
bool beforeChildHasBeforeAndAfterContent = false;
if (beforeChild && (beforeChild->isTable() || beforeChild->isTableSection() || beforeChild->isTableRow() || beforeChild->isTableCell())) {
- beforeContent = beforeChild->findBeforeContentRenderer();
- RenderObject* afterContent = beforeChild->findAfterContentRenderer();
- if (beforeContent && afterContent) {
+ beforeContent = beforeChild->beforePseudoElementRenderer();
+ RenderObject* afterContent = beforeChild->afterPseudoElementRenderer();
+ if (beforeContent && afterContent && isBeforeAfterContentGeneratedByAncestor(this, beforeContent)) {
beforeChildHasBeforeAndAfterContent = true;
beforeContent->destroy();
}
Modified: branches/chromium/912/Source/WebCore/rendering/RenderObject.h (101036 => 101037)
--- branches/chromium/912/Source/WebCore/rendering/RenderObject.h 2011-11-23 02:15:40 UTC (rev 101036)
+++ branches/chromium/912/Source/WebCore/rendering/RenderObject.h 2011-11-23 02:51:03 UTC (rev 101037)
@@ -351,18 +351,6 @@
static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
static inline bool isBeforeOrAfterContent(const RenderObject* obj) { return obj && obj->isBeforeOrAfterContent(); }
- inline RenderObject* findBeforeContentRenderer() const
- {
- RenderObject* renderer = beforePseudoElementRenderer();
- return isBeforeContent(renderer) ? renderer : 0;
- }
-
- inline RenderObject* findAfterContentRenderer() const
- {
- RenderObject* renderer = afterPseudoElementRenderer();
- return isAfterContent(renderer) ? renderer : 0;
- }
-
inline RenderObject* anonymousContainer(RenderObject* child)
{
RenderObject* container = child;
Modified: branches/chromium/912/Source/WebCore/rendering/RenderObjectChildList.cpp (101036 => 101037)
--- branches/chromium/912/Source/WebCore/rendering/RenderObjectChildList.cpp 2011-11-23 02:15:40 UTC (rev 101036)
+++ branches/chromium/912/Source/WebCore/rendering/RenderObjectChildList.cpp 2011-11-23 02:51:03 UTC (rev 101037)
@@ -313,7 +313,7 @@
if (!first)
return 0;
- if (first->style()->styleType() == BEFORE)
+ if (first->isBeforeContent())
return first;
// Check for a possible generated run-in, using run-in positioning rules.
@@ -325,7 +325,7 @@
// We still need to skip any list markers that could exist before the run-in.
while (first && first->isListMarker())
first = first->nextSibling();
- if (first && first->style()->styleType() == BEFORE && first->isRenderInline() && first->isRunIn())
+ if (first && first->isBeforeContent() && first->isRenderInline() && first->isRunIn())
return first;
return 0;
@@ -337,7 +337,7 @@
do {
last = last->lastChild();
} while (last && last->isAnonymous() && last->style()->styleType() == NOPSEUDO && !last->isListMarker());
- if (last && last->style()->styleType() != AFTER)
+ if (last && !last->isAfterContent())
return 0;
return last;
}
Modified: branches/chromium/912/Source/WebCore/rendering/RenderTable.cpp (101036 => 101037)
--- branches/chromium/912/Source/WebCore/rendering/RenderTable.cpp 2011-11-23 02:15:40 UTC (rev 101036)
+++ branches/chromium/912/Source/WebCore/rendering/RenderTable.cpp 2011-11-23 02:51:03 UTC (rev 101037)
@@ -112,7 +112,7 @@
{
// Make sure we don't append things after :after-generated content if we have it.
if (!beforeChild)
- beforeChild = findAfterContentRenderer();
+ beforeChild = afterPseudoElementRenderer();
bool wrapInAnonymousSection = !child->isPositioned();
Modified: branches/chromium/912/Source/WebCore/rendering/RenderTableRow.cpp (101036 => 101037)
--- branches/chromium/912/Source/WebCore/rendering/RenderTableRow.cpp 2011-11-23 02:15:40 UTC (rev 101036)
+++ branches/chromium/912/Source/WebCore/rendering/RenderTableRow.cpp 2011-11-23 02:51:03 UTC (rev 101037)
@@ -91,7 +91,7 @@
{
// Make sure we don't append things after :after-generated content if we have it.
if (!beforeChild)
- beforeChild = findAfterContentRenderer();
+ beforeChild = afterPseudoElementRenderer();
if (!child->isTableCell()) {
RenderObject* last = beforeChild;
Modified: branches/chromium/912/Source/WebCore/rendering/RenderTableSection.cpp (101036 => 101037)
--- branches/chromium/912/Source/WebCore/rendering/RenderTableSection.cpp 2011-11-23 02:15:40 UTC (rev 101036)
+++ branches/chromium/912/Source/WebCore/rendering/RenderTableSection.cpp 2011-11-23 02:51:03 UTC (rev 101037)
@@ -104,7 +104,7 @@
{
// Make sure we don't append things after :after-generated content if we have it.
if (!beforeChild)
- beforeChild = findAfterContentRenderer();
+ beforeChild = afterPseudoElementRenderer();
if (!child->isTableRow()) {
RenderObject* last = beforeChild;
