Ignore out-of-flow siblings when searching for a spanner candidate.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 27 Oct 2016 02:49:54 +0000 (02:49 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 27 Oct 2016 02:49:54 +0000 (02:49 +0000)
commit71f2e4097a60d3d7c44f53938f5dcb44baf00350
treec25ca16852c2aa6b3433e505f894aaccfde6f817
parent6244d66defb472a16bb589d7a4daedf9899fa1a1
Ignore out-of-flow siblings when searching for a spanner candidate.
https://bugs.webkit.org/show_bug.cgi?id=164042.
<rdar://problem/28758456>

Reviewed by Simon Fraser.

Source/WebCore:

While searching for the spanner candidates in a flow thread, we have to take into account
whether renderers are in- or out-of-flow.
What it means is that while traversing the renderer tree to find the the candidate
renderer (next sibling/ancestor's next child in pre-order traversal), we have to check if the candidate
is in the same layout context too.

Test: fast/multicol/crash-when-spanner-candidate-is-out-of-flow.html

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::spannerPlacehoderCandidate):
(WebCore::RenderMultiColumnFlowThread::processPossibleSpannerDescendant):

LayoutTests:

* fast/multicol/crash-when-spanner-candidate-is-out-of-flow-expected.txt: Added.
* fast/multicol/crash-when-spanner-candidate-is-out-of-flow.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@207930 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/multicol/crash-when-spanner-candidate-is-out-of-flow-expected.txt [new file with mode: 0644]
LayoutTests/fast/multicol/crash-when-spanner-candidate-is-out-of-flow.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp