Diff
Modified: trunk/LayoutTests/ChangeLog (259295 => 259296)
--- trunk/LayoutTests/ChangeLog 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/ChangeLog 2020-03-31 17:03:58 UTC (rev 259296)
@@ -1,3 +1,14 @@
+2020-03-31 Zalan Bujtas <za...@apple.com>
+
+ [Tables] Infinite recursion in RenderTreeBuilder::attach
+ https://bugs.webkit.org/show_bug.cgi?id=209771
+ <rdar://problem/59923112>
+
+ Reviewed by Simon Fraser.
+
+ * fast/table/anonymous-colgroup-simple-expected.txt: Added.
+ * fast/table/anonymous-colgroup-simple.html: Added.
+
2020-03-31 Jason Lawrence <lawrenc...@apple.com>
REGRESSION: [ iOS wk2 ] fast/forms/input-text-scroll-left-on-blur.html is flaky failing.
Added: trunk/LayoutTests/fast/table/anonymous-colgroup-simple-expected.txt (0 => 259296)
--- trunk/LayoutTests/fast/table/anonymous-colgroup-simple-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/table/anonymous-colgroup-simple-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -0,0 +1 @@
+Pass if no crash or assert.
Added: trunk/LayoutTests/fast/table/anonymous-colgroup-simple.html (0 => 259296)
--- trunk/LayoutTests/fast/table/anonymous-colgroup-simple.html (rev 0)
+++ trunk/LayoutTests/fast/table/anonymous-colgroup-simple.html 2020-03-31 17:03:58 UTC (rev 259296)
@@ -0,0 +1,13 @@
+<table><tbody id="tbody"><col id="col">
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+document.body.offsetHeight;
+tbody.prepend(col);
+document.body.offsetHeight;
+col.before("or assert.");
+document.body.offsetHeight;
+tbody.prepend(col);
+document.body.offsetHeight;
+col.before("Pass if no crash ");
+</script>
Modified: trunk/LayoutTests/fast/table/table-insert-before-non-anonymous-block-expected.txt (259295 => 259296)
--- trunk/LayoutTests/fast/table/table-insert-before-non-anonymous-block-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/fast/table/table-insert-before-non-anonymous-block-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -38,7 +38,8 @@
RenderTableRow (anonymous) at (0,0) size 100x50
RenderTableCell {DIV} at (0,0) size 50x0 [bgcolor=#0000FF] [r=0 c=0 rs=1 cs=1]
RenderTableCell {DIV} at (50,0) size 50x0 [bgcolor=#0000FF] [r=0 c=1 rs=1 cs=1]
- RenderTableCol {DIV} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0
RenderTable {DIV} at (0,300) size 101x50
RenderTableSection (anonymous) at (0,0) size 101x50
RenderTableRow (anonymous) at (0,0) size 101x50
Modified: trunk/LayoutTests/platform/ios/css2.1/20110323/margin-applies-to-006-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/ios/css2.1/20110323/margin-applies-to-006-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/ios/css2.1/20110323/margin-applies-to-006-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -9,7 +9,8 @@
layer at (8,52) size 240x240
RenderBlock (positioned) {DIV} at (8,52) size 240x240 [border: (10px solid #0000FF)]
RenderTable {DIV} at (10,10) size 220x220
- RenderTableCol {DIV} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0
RenderTableSection (anonymous) at (0,0) size 220x220
RenderTableRow {DIV} at (0,0) size 220x220
RenderTableCell {DIV} at (0,0) size 220x20 [border: (10px solid #FFA500)] [r=0 c=0 rs=1 cs=1]
Modified: trunk/LayoutTests/platform/ios/fast/forms/form-hides-table-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/ios/fast/forms/form-hides-table-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/ios/fast/forms/form-hides-table-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -142,7 +142,8 @@
RenderTableCol {DIV} at (0,0) size 0x0
RenderBlock {DIV} at (0,554) size 784x0
RenderTable at (0,0) size 0x0
- RenderTableCol {DIV} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0
RenderBlock {DIV} at (0,554) size 784x42
RenderTable at (0,0) size 121x42
RenderTableSection (anonymous) at (0,0) size 121x42
Modified: trunk/LayoutTests/platform/ios/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/ios/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/ios/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -7,7 +7,8 @@
RenderText {#text} at (0,0) size 417x19
text run at (0,0) width 417: "Test passes if there is a box with sharp or rounded corners below."
RenderTable {DIV} at (0,36) size 102x102 [border: (1.50px none #000000)]
- RenderTableCol {DIV} at (0,0) size 0x0 [border: (3px solid #008000)]
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0 [border: (3px solid #008000)]
RenderTableSection (anonymous) at (1,1) size 100x100
RenderTableRow {DIV} at (0,0) size 99x99
RenderTableCell {DIV} at (0,0) size 99x3 [border: (1.50px none #000000)] [r=0 c=0 rs=1 cs=1]
Modified: trunk/LayoutTests/platform/ios/tables/mozilla_expected_failures/dom/appendCol1-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/ios/tables/mozilla_expected_failures/dom/appendCol1-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/ios/tables/mozilla_expected_failures/dom/appendCol1-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -17,7 +17,8 @@
RenderTableCell {TD} at (30,2) size 28x24 [border: (1px inset #808080)] [r=0 c=1 rs=1 cs=1]
RenderText {#text} at (2,2) size 24x19
text run at (2,2) width 24: "c12"
- RenderTableCol {COL} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {COL} at (0,0) size 0x0
RenderBlock (anonymous) at (0,50) size 784x20
RenderBR {BR} at (0,0) size 0x19
RenderTable {TABLE} at (0,70) size 235x30 [bgcolor=#FFA500] [border: (1px outset #808080)]
Modified: trunk/LayoutTests/platform/ios-wk1/fast/table/table-insert-before-non-anonymous-block-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/ios-wk1/fast/table/table-insert-before-non-anonymous-block-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/ios-wk1/fast/table/table-insert-before-non-anonymous-block-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -38,7 +38,8 @@
RenderTableRow (anonymous) at (0,0) size 100x50
RenderTableCell {DIV} at (0,0) size 50x0 [bgcolor=#0000FF] [r=0 c=0 rs=1 cs=1]
RenderTableCell {DIV} at (50,0) size 50x0 [bgcolor=#0000FF] [r=0 c=1 rs=1 cs=1]
- RenderTableCol {DIV} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0
RenderTable {DIV} at (0,300) size 101x50
RenderTableSection (anonymous) at (0,0) size 101x50
RenderTableRow (anonymous) at (0,0) size 101x50
Modified: trunk/LayoutTests/platform/mac/css2.1/20110323/margin-applies-to-006-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/mac/css2.1/20110323/margin-applies-to-006-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/mac/css2.1/20110323/margin-applies-to-006-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -9,7 +9,8 @@
layer at (8,50) size 240x240
RenderBlock (positioned) {DIV} at (8,50) size 240x240 [border: (10px solid #0000FF)]
RenderTable {DIV} at (10,10) size 220x220
- RenderTableCol {DIV} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0
RenderTableSection (anonymous) at (0,0) size 220x220
RenderTableRow {DIV} at (0,0) size 220x220
RenderTableCell {DIV} at (0,0) size 220x20 [border: (10px solid #FFA500)] [r=0 c=0 rs=1 cs=1]
Modified: trunk/LayoutTests/platform/mac/fast/forms/form-hides-table-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/mac/fast/forms/form-hides-table-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/mac/fast/forms/form-hides-table-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -142,7 +142,8 @@
RenderTableCol {DIV} at (0,0) size 0x0
RenderBlock {DIV} at (0,526) size 769x0
RenderTable at (0,0) size 0x0
- RenderTableCol {DIV} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0
RenderBlock {DIV} at (0,526) size 769x40
RenderTable at (0,0) size 121x40
RenderTableSection (anonymous) at (0,0) size 121x40
Modified: trunk/LayoutTests/platform/mac/fast/table/table-insert-before-non-anonymous-block-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/mac/fast/table/table-insert-before-non-anonymous-block-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/mac/fast/table/table-insert-before-non-anonymous-block-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -38,7 +38,8 @@
RenderTableRow (anonymous) at (0,0) size 100x50
RenderTableCell {DIV} at (0,0) size 50x0 [bgcolor=#0000FF] [r=0 c=0 rs=1 cs=1]
RenderTableCell {DIV} at (50,0) size 50x0 [bgcolor=#0000FF] [r=0 c=1 rs=1 cs=1]
- RenderTableCol {DIV} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0
RenderTable {DIV} at (0,300) size 101x50
RenderTableSection (anonymous) at (0,0) size 101x50
RenderTableRow (anonymous) at (0,0) size 101x50
Modified: trunk/LayoutTests/platform/mac/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/mac/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/mac/ietestcenter/css3/bordersbackgrounds/border-radius-applies-to-012-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -7,7 +7,8 @@
RenderText {#text} at (0,0) size 417x18
text run at (0,0) width 417: "Test passes if there is a box with sharp or rounded corners below."
RenderTable {DIV} at (0,34) size 102x102 [border: (1px none #000000)]
- RenderTableCol {DIV} at (0,0) size 0x0 [border: (3px solid #008000)]
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {DIV} at (0,0) size 0x0 [border: (3px solid #008000)]
RenderTableSection (anonymous) at (1,1) size 99x99
RenderTableRow {DIV} at (0,0) size 99x99
RenderTableCell {DIV} at (0,0) size 99x3 [border: (2px none #000000)] [r=0 c=0 rs=1 cs=1]
Modified: trunk/LayoutTests/platform/mac/tables/mozilla_expected_failures/dom/appendCol1-expected.txt (259295 => 259296)
--- trunk/LayoutTests/platform/mac/tables/mozilla_expected_failures/dom/appendCol1-expected.txt 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/LayoutTests/platform/mac/tables/mozilla_expected_failures/dom/appendCol1-expected.txt 2020-03-31 17:03:58 UTC (rev 259296)
@@ -17,7 +17,8 @@
RenderTableCell {TD} at (30,2) size 28x22 [border: (1px inset #808080)] [r=0 c=1 rs=1 cs=1]
RenderText {#text} at (2,2) size 24x18
text run at (2,2) width 24: "c12"
- RenderTableCol {COL} at (0,0) size 0x0
+ RenderTableCol at (0,0) size 0x0
+ RenderTableCol {COL} at (0,0) size 0x0
RenderBlock (anonymous) at (0,46) size 784x18
RenderBR {BR} at (0,0) size 0x18
RenderTable {TABLE} at (0,64) size 235x28 [bgcolor=#FFA500] [border: (1px outset #808080)]
Modified: trunk/Source/WebCore/ChangeLog (259295 => 259296)
--- trunk/Source/WebCore/ChangeLog 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/Source/WebCore/ChangeLog 2020-03-31 17:03:58 UTC (rev 259296)
@@ -1,3 +1,23 @@
+2020-03-31 Zalan Bujtas <za...@apple.com>
+
+ [Tables] Infinite recursion in RenderTreeBuilder::attach
+ https://bugs.webkit.org/show_bug.cgi?id=209771
+ <rdar://problem/59923112>
+
+ Reviewed by Simon Fraser.
+
+ Let's construct a COLGROUP wrapper when a COL element is inserted into a <table>. The rest of the table code assumes such structure.
+ (https://www.w3.org/TR/html52/tabular-data.html#the-col-element)
+
+ Test: fast/table/anonymous-colgroup-simple.html
+
+ * rendering/RenderTableCol.cpp:
+ (WebCore::RenderTableCol::RenderTableCol):
+ (WebCore::RenderTableCol::updateFromElement):
+ * rendering/RenderTableCol.h:
+ * rendering/updating/RenderTreeBuilderTable.cpp:
+ (WebCore::RenderTreeBuilder::Table::findOrCreateParentForChild):
+
2020-03-31 youenn fablet <you...@apple.com>
Fix SDP filtering after https://trac.webkit.org/changeset/258545
Modified: trunk/Source/WebCore/rendering/RenderTableCol.cpp (259295 => 259296)
--- trunk/Source/WebCore/rendering/RenderTableCol.cpp 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/Source/WebCore/rendering/RenderTableCol.cpp 2020-03-31 17:03:58 UTC (rev 259296)
@@ -49,6 +49,12 @@
updateFromElement();
}
+RenderTableCol::RenderTableCol(Document& document, RenderStyle&& style)
+ : RenderBox(document, WTFMove(style), 0)
+{
+ setInline(true);
+}
+
void RenderTableCol::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
{
RenderBox::styleDidChange(diff, oldStyle);
@@ -77,9 +83,10 @@
void RenderTableCol::updateFromElement()
{
+ ASSERT(element());
unsigned oldSpan = m_span;
- if (element().hasTagName(colTag) || element().hasTagName(colgroupTag)) {
- HTMLTableColElement& tc = static_cast<HTMLTableColElement&>(element());
+ if (element()->hasTagName(colTag) || element()->hasTagName(colgroupTag)) {
+ HTMLTableColElement& tc = static_cast<HTMLTableColElement&>(*element());
m_span = tc.span();
} else
m_span = !(hasInitializedStyle() && style().display() == DisplayType::TableColumnGroup);
Modified: trunk/Source/WebCore/rendering/RenderTableCol.h (259295 => 259296)
--- trunk/Source/WebCore/rendering/RenderTableCol.h 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/Source/WebCore/rendering/RenderTableCol.h 2020-03-31 17:03:58 UTC (rev 259296)
@@ -36,7 +36,7 @@
WTF_MAKE_ISO_ALLOCATED(RenderTableCol);
public:
RenderTableCol(Element&, RenderStyle&&);
- Element& element() const { return downcast<Element>(nodeForNonAnonymous()); }
+ RenderTableCol(Document&, RenderStyle&&);
void clearPreferredLogicalWidthsDirtyBits();
Modified: trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp (259295 => 259296)
--- trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp 2020-03-31 16:52:39 UTC (rev 259295)
+++ trunk/Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp 2020-03-31 17:03:58 UTC (rev 259296)
@@ -52,6 +52,14 @@
}
}
+ auto createAnonymousTableCell = [&] (auto& parent) -> RenderTableCell& {
+ auto newCell = RenderTableCell::createAnonymousWithParentRenderer(parent);
+ auto& cell = *newCell;
+ m_builder.attach(parent, WTFMove(newCell), beforeChild);
+ beforeChild = nullptr;
+ return cell;
+ };
+
auto* lastChild = beforeChild ? beforeChild : parent.lastCell();
if (lastChild) {
if (is<RenderTableCell>(*lastChild) && lastChild->isAnonymous() && !lastChild->isBeforeOrAfterContent()) {
@@ -63,25 +71,19 @@
// Try to find an anonymous container for the child.
if (auto* lastChildParent = lastChild->parent()) {
if (lastChildParent->isAnonymous() && !lastChildParent->isBeforeOrAfterContent()) {
+ // If beforeChild is inside an anonymous COLGROUP, create a cell for the new renderer.
+ if (is<RenderTableCol>(*lastChildParent))
+ return createAnonymousTableCell(parent);
// If beforeChild is inside an anonymous cell, insert into the cell.
if (!is<RenderTableCell>(*lastChild))
return *lastChildParent;
// If beforeChild is inside an anonymous row, insert into the row.
- if (is<RenderTableRow>(*lastChildParent)) {
- auto newCell = RenderTableCell::createAnonymousWithParentRenderer(parent);
- auto& cell = *newCell;
- m_builder.attach(*lastChildParent, WTFMove(newCell), beforeChild);
- beforeChild = nullptr;
- return cell;
- }
+ if (is<RenderTableRow>(*lastChildParent))
+ return createAnonymousTableCell(downcast<RenderTableRow>(*lastChildParent));
}
}
}
- auto newCell = RenderTableCell::createAnonymousWithParentRenderer(parent);
- auto& cell = *newCell;
- m_builder.attach(parent, WTFMove(newCell), beforeChild);
- beforeChild = nullptr;
- return cell;
+ return createAnonymousTableCell(parent);
}
RenderElement& RenderTreeBuilder::Table::findOrCreateParentForChild(RenderTableSection& parent, const RenderObject& child, RenderObject*& beforeChild)
@@ -121,9 +123,22 @@
RenderElement& RenderTreeBuilder::Table::findOrCreateParentForChild(RenderTable& parent, const RenderObject& child, RenderObject*& beforeChild)
{
- if (is<RenderTableCaption>(child) || is<RenderTableCol>(child) || is<RenderTableSection>(child))
+ if (is<RenderTableCaption>(child) || is<RenderTableSection>(child))
return parent;
+ if (is<RenderTableCol>(child)) {
+ if (!child.node() || child.style().display() == DisplayType::TableColumnGroup) {
+ // COLGROUPs and anonymous RenderTableCols (generated wrappers for COLs) are direct children of the table renderer.
+ return parent;
+ }
+ auto newColGroup = createRenderer<RenderTableCol>(parent.document(), RenderStyle::createAnonymousStyleWithDisplay(parent.style(), DisplayType::TableColumnGroup));
+ newColGroup->initializeStyle();
+ auto& colGroup = *newColGroup;
+ m_builder.attach(parent, WTFMove(newColGroup), beforeChild);
+ beforeChild = nullptr;
+ return colGroup;
+ }
+
auto* lastChild = parent.lastChild();
if (!beforeChild && is<RenderTableSection>(lastChild) && lastChild->isAnonymous() && !lastChild->isBeforeContent())
return downcast<RenderElement>(*lastChild);
@@ -143,10 +158,20 @@
&& parentCandidate->style().display() != DisplayType::TableColumnGroup)
parentCandidate = parentCandidate->parent();
- if (parentCandidate && is<RenderTableSection>(*parentCandidate) && parentCandidate->isAnonymous() && !parent.isAfterContent(parentCandidate)) {
- if (beforeChild == parentCandidate)
- beforeChild = downcast<RenderTableSection>(*parentCandidate).firstRow();
- return downcast<RenderElement>(*parentCandidate);
+ if (parentCandidate) {
+ if (beforeChild && !beforeChild->isAnonymous() && parentCandidate->parent() == &parent) {
+ auto* section = parentCandidate->previousSibling();
+ if (is<RenderTableSection>(section) && section->isAnonymous()) {
+ beforeChild = nullptr;
+ return downcast<RenderElement>(*section);
+ }
+ }
+
+ if (is<RenderTableSection>(*parentCandidate) && parentCandidate->isAnonymous() && !parent.isAfterContent(parentCandidate)) {
+ if (beforeChild == parentCandidate)
+ beforeChild = downcast<RenderTableSection>(*parentCandidate).firstRow();
+ return downcast<RenderElement>(*parentCandidate);
+ }
}
if (beforeChild && !is<RenderTableSection>(*beforeChild)
