Title: [186842] branches/safari-600.8-branch
- Revision
- 186842
- Author
- matthew_han...@apple.com
- Date
- 2015-07-15 09:04:17 -0700 (Wed, 15 Jul 2015)
Log Message
Merge r186747. rdar://problem/21716398
Modified Paths
Added Paths
Diff
Modified: branches/safari-600.8-branch/LayoutTests/ChangeLog (186841 => 186842)
--- branches/safari-600.8-branch/LayoutTests/ChangeLog 2015-07-15 16:04:12 UTC (rev 186841)
+++ branches/safari-600.8-branch/LayoutTests/ChangeLog 2015-07-15 16:04:17 UTC (rev 186842)
@@ -1,5 +1,33 @@
2015-07-15 Matthew Hanson <matthew_han...@apple.com>
+ Merge r186747. rdar://problem/21716398
+
+ 2015-07-12 David Kilzer <ddkil...@apple.com>
+
+ Merge r186474. rdar://problem/21716537
+
+ 2015-07-07 Zalan Bujtas <za...@apple.com>
+
+ REGRESSION(169105): CSS Regions: renderer returns wrong selection root when it is inside a column flow.
+ https://bugs.webkit.org/show_bug.cgi?id=146529
+ rdar://problem/21613670
+
+ Reviewed by Mihnea Ovidenie and David Kilzer.
+
+ This patch ensures that RenderObject::selectionRoot() handles column flows properly while searching for the associated
+ selection root.
+ When the renderer is inside a column flow and the column flow is part of a named flow, we stop
+ traversing the ancestor chain, searching for the selection root, when we reach the column flow.
+ Since the column flow is not a selection root, we mistakenly fall back to the RenderView as selection root.
+ Instead, we should check if the column is inside a named flow and return the selection root accordingly.
+ Returning the wrong selection root confuses RenderView::splitSelectionBetweenSubtrees() logic and this particular
+ RenderObject could end up in multiple selection trees.
+
+ * fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow-expected.txt: Added.
+ * fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html: Added.
+
+2015-07-15 Matthew Hanson <matthew_han...@apple.com>
+
Merge r186746. rdar://problem/21716391
2015-07-12 David Kilzer <ddkil...@apple.com>
Added: branches/safari-600.8-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow-expected.txt (0 => 186842)
--- branches/safari-600.8-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow-expected.txt (rev 0)
+++ branches/safari-600.8-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow-expected.txt 2015-07-15 16:04:17 UTC (rev 186842)
@@ -0,0 +1,3 @@
+Pass if no assert or crash in debug.
+foobar
+foobar
Added: branches/safari-600.8-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html (0 => 186842)
--- branches/safari-600.8-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html (rev 0)
+++ branches/safari-600.8-branch/LayoutTests/fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html 2015-07-15 16:04:17 UTC (rev 186842)
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that elements inside columns get their proper selection root.</title>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function test() {
+ document.designMode = "on";
+ document.execCommand("SelectAll");
+ document.getElementById('changeme').style.display = 'inline';
+}
+</script>
+<style>
+.flow {
+ -webkit-flow-into: thread;
+}
+
+.column {
+ -webkit-columns: 2;
+}
+
+.spanner {
+ -webkit-column-span: all;
+}
+</style>
+</head>
+<body _onload_="test()">
+<div class=flow>
+ <div>Pass if no assert or crash in debug.</div>
+ <div class=column>
+ <div id="changeme">foobar</div>
+ <div class=spanner>foobar</div>
+ </div>
+</div>
+</body>
+</html>
Modified: branches/safari-600.8-branch/Source/WebCore/ChangeLog (186841 => 186842)
--- branches/safari-600.8-branch/Source/WebCore/ChangeLog 2015-07-15 16:04:12 UTC (rev 186841)
+++ branches/safari-600.8-branch/Source/WebCore/ChangeLog 2015-07-15 16:04:17 UTC (rev 186842)
@@ -1,5 +1,35 @@
2015-07-15 Matthew Hanson <matthew_han...@apple.com>
+ Merge r186747. rdar://problem/21716398
+
+ 2015-07-12 David Kilzer <ddkil...@apple.com>
+
+ Merge r186474. rdar://problem/21716537
+
+ 2015-07-07 Zalan Bujtas <za...@apple.com>
+
+ REGRESSION(169105): CSS Regions: renderer returns wrong selection root when it is inside a column flow.
+ https://bugs.webkit.org/show_bug.cgi?id=146529
+ rdar://problem/21613670
+
+ Reviewed by Mihnea Ovidenie and David Kilzer.
+
+ This patch ensures that RenderObject::selectionRoot() handles column flows properly while searching for the associated
+ selection root.
+ When the renderer is inside a column flow and the column flow is part of a named flow, we stop
+ traversing the ancestor chain, searching for the selection root, when we reach the column flow.
+ Since the column flow is not a selection root, we mistakenly fall back to the RenderView as selection root.
+ Instead, we should check if the column is inside a named flow and return the selection root accordingly.
+ Returning the wrong selection root confuses RenderView::splitSelectionBetweenSubtrees() logic and this particular
+ RenderObject could end up in multiple selection trees.
+
+ Test: fast/regions/selection/crash-when-element-is-inside-column-and-the-containing-block-is-inside-flow.html
+
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::selectionRoot):
+
+2015-07-15 Matthew Hanson <matthew_han...@apple.com>
+
Merge r186746. rdar://problem/21716391
2015-07-12 David Kilzer <ddkil...@apple.com>
Modified: branches/safari-600.8-branch/Source/WebCore/rendering/RenderObject.cpp (186841 => 186842)
--- branches/safari-600.8-branch/Source/WebCore/rendering/RenderObject.cpp 2015-07-15 16:04:12 UTC (rev 186841)
+++ branches/safari-600.8-branch/Source/WebCore/rendering/RenderObject.cpp 2015-07-15 16:04:17 UTC (rev 186842)
@@ -53,6 +53,7 @@
#include "RenderIterator.h"
#include "RenderLayer.h"
#include "RenderLayerBacking.h"
+#include "RenderMultiColumnFlowThread.h"
#include "RenderNamedFlowFragment.h"
#include "RenderNamedFlowThread.h"
#include "RenderSVGResourceContainer.h"
@@ -1554,9 +1555,17 @@
SelectionSubtreeRoot& RenderObject::selectionRoot() const
{
RenderFlowThread* flowThread = flowThreadContainingBlock();
- if (flowThread && flowThread->isRenderNamedFlowThread())
+ if (!flowThread)
+ return view();
+
+ if (flowThread->isRenderNamedFlowThread())
return *toRenderNamedFlowThread(flowThread);
-
+ if (flowThread->isRenderMultiColumnFlowThread()) {
+ if (!flowThread->containingBlock())
+ return view();
+ return flowThread->containingBlock()->selectionRoot();
+ }
+ ASSERT_NOT_REACHED();
return view();
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
