resetFlowThreadContainingBlockAndChildInfoIncludingDescendants should not ignore...
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 9 May 2017 22:30:11 +0000 (22:30 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 9 May 2017 22:30:11 +0000 (22:30 +0000)
commit3a764896bb817198ddd1f51d271d6e689bd11c5a
treee903bbfbbf0a6affc31361bd15470291889ecbcb
parent9b14fe46d86a6d00a53d63be73911996f1660e3e
resetFlowThreadContainingBlockAndChildInfoIncludingDescendants should not ignore RenderElement subtrees.
https://bugs.webkit.org/show_bug.cgi?id=171873
<rdar://problem/32004954>

Reviewed by Simon Fraser.

Source/WebCore:

Normally a RenderBlock's parent is another RenderBlock, but In some cases (e.g. tables) a RenderBlock can
have a non-RenderBlock(RenderBox) ancestor.
While updating the flow thread state on a subtree, we should descent into subtrees with RenderElement
roots and not just RenderBlocks so that we clear the state on the entire subtree.

Test: fast/multicol/crash-when-column-inside-table.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::resetFlowThreadContainingBlockAndChildInfoIncludingDescendants):
* rendering/RenderBlock.h:
* rendering/RenderElement.cpp:
(WebCore::RenderElement::resetFlowThreadContainingBlockAndChildInfoIncludingDescendants):
* rendering/RenderElement.h:

LayoutTests:

* fast/multicol/crash-when-column-inside-table-expected.txt: Added.
* fast/multicol/crash-when-column-inside-table.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@216549 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/multicol/crash-when-column-inside-table-expected.txt [new file with mode: 0644]
LayoutTests/fast/multicol/crash-when-column-inside-table.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlock.cpp
Source/WebCore/rendering/RenderBlock.h
Source/WebCore/rendering/RenderElement.cpp
Source/WebCore/rendering/RenderElement.h