Cleanup inline boxes when list marker gets blockified
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 14 Mar 2019 16:21:34 +0000 (16:21 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 14 Mar 2019 16:21:34 +0000 (16:21 +0000)
commit1af2b63586311c8aaa03379b45d8fc6be5a17988
tree0798f32bd74df8d7c25cf6190a1e6119b60611b3
parent0c8db3f656359e3f97e9cc8d2caecf3d0a1054f7
Cleanup inline boxes when list marker gets blockified
https://bugs.webkit.org/show_bug.cgi?id=195746
<rdar://problem/48049175>

Reviewed by Antti Koivisto.

Source/WebCore:

Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
change does not require a new renderer.
This patch takes care of destroying the inline boxtree when the marker gains block display type.

Test: fast/block/float/list-marker-is-float-crash.html

* rendering/RenderListMarker.cpp:
(WebCore::RenderListMarker::styleDidChange):

LayoutTests:

* fast/block/float/list-marker-is-float-crash-expected.txt: Added.
* fast/block/float/list-marker-is-float-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242943 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/block/float/list-marker-is-float-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/block/float/list-marker-is-float-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderListMarker.cpp