Do not collapse the soon-to-be-parent anon block when we shuffle around the marker...
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Nov 2018 02:38:06 +0000 (02:38 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Nov 2018 02:38:06 +0000 (02:38 +0000)
commitedb618805ce4aad492bb6d41d988578ba390b697
tree04a18f992eea34ab863485808afcee937b8dee65
parent81566a795720348fd58d4fb99b3dbb4cff5a0777
Do not collapse the soon-to-be-parent anon block when we shuffle around the marker item renderer.
https://bugs.webkit.org/show_bug.cgi?id=191554
<rdar://problem/45825265>

Reviewed by Antti Koivisto.

Source/WebCore:

While moving the marker item renderer to its correct subtree, we accidentally remove the soon-to-be parent anonymous block.
Moving a renderer is a 2 step process:
1. Detach the renderer from its current parent
2. Attach it to its new parent.
During step #1, we check if there is a chance to collapse anonymous blocks. In this case the soon-to-be-parent is a sibling anonymous block which, after detaching the marker sibling
is not needed anymore (except we use it as the new parent).

Test: fast/inline/marker-list-item-move-should-not-crash.html

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::detach):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::detach):
* rendering/updating/RenderTreeBuilderBlock.h:
* rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::RenderTreeBuilder::List::updateItemMarker):

LayoutTests:

* fast/inline/marker-list-item-move-should-not-crash-expected.txt: Added.
* fast/inline/marker-list-item-move-should-not-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@238119 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/inline/marker-list-item-move-should-not-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/inline/marker-list-item-move-should-not-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
Source/WebCore/rendering/updating/RenderTreeBuilder.h
Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h
Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp