Make inline continuation style change logic consistent.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 15 Apr 2015 04:24:14 +0000 (04:24 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 15 Apr 2015 04:24:14 +0000 (04:24 +0000)
https://bugs.webkit.org/show_bug.cgi?id=143737
rdar://problem/20486596

Reviewed by Simon Fraser.

Do not force RenderBlock type-casting on the first sibling of the continuation's container.
The first sibling of the container of a continuation should be handled as the rest of the siblings.

Source/WebCore:

Test: fast/inline/inline-with-column-span-and-remove-block-child-crash.html

* rendering/RenderInline.cpp:
(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):

LayoutTests:

* fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt: Added.
* fast/inline/inline-with-column-span-and-remove-block-child-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@182835 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderInline.cpp

index cfcb0a4..30171ce 100644 (file)
@@ -1,3 +1,17 @@
+2015-04-14  Zalan Bujtas  <zalan@apple.com>
+
+        Make inline continuation style change logic consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=143737
+        rdar://problem/20486596
+
+        Reviewed by Simon Fraser.
+
+        Do not force RenderBlock type-casting on the first sibling of the continuation's container.
+        The first sibling of the container of a continuation should be handled as the rest of the siblings.
+
+        * fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt: Added.
+        * fast/inline/inline-with-column-span-and-remove-block-child-crash.html: Added.
+
 2015-04-14  Daniel Bates  <dabates@apple.com>
 
         Rename test LayoutTests/fast/events/drag-link.html to drag-and-drop-link-into-focused-contenteditable.html
diff --git a/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt b/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash-expected.txt
new file mode 100644 (file)
index 0000000..346a3e4
--- /dev/null
@@ -0,0 +1,2 @@
+Pass if no crash or assert in debug.
+
diff --git a/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash.html b/LayoutTests/fast/inline/inline-with-column-span-and-remove-block-child-crash.html
new file mode 100644 (file)
index 0000000..648c10d
--- /dev/null
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>This test that when the block element is removed from an inline element when column span is present, we do not crash.</title>
+  <style>
+    #container {
+      -webkit-column-count: 2; 
+    }
+    #after {
+      -webkit-column-span: all;
+    }
+  </style>
+</head>
+<body>
+<div id=container>
+  <span id=outer>Pass if no crash or assert in debug.
+    <div id=removethis></div>
+  </span>
+  <div id=after></div>
+</div>
+</body>
+
+<script>
+  if (window.testRunner)
+    testRunner.dumpAsText();
+
+  document.execCommand("SelectAll");
+
+  var elem = document.getElementById("removethis");
+  elem.parentNode.removeChild(elem);
+
+  document.getElementById("outer").style.position = "relative";
+</script>
+</html>
index 5c40f7a..eb21c52 100644 (file)
@@ -1,3 +1,20 @@
+2015-04-14  Zalan Bujtas  <zalan@apple.com>
+
+        Make inline continuation style change logic consistent.
+        https://bugs.webkit.org/show_bug.cgi?id=143737
+        rdar://problem/20486596
+
+        Reviewed by Simon Fraser.
+
+        Do not force RenderBlock type-casting on the first sibling of the continuation's container.
+        The first sibling of the container of a continuation should be handled as the rest of the siblings.
+
+        Test: fast/inline/inline-with-column-span-and-remove-block-child-crash.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::updateStyleOfAnonymousBlockContinuations):
+        (WebCore::RenderInline::styleDidChange):
+
 2015-04-14  Chris Dumez  <cdumez@apple.com>
 
         Regression(r180020): Web Inspector crashes on pages that have a stylesheet with an invalid MIME type
index 7cd3304..0b2b513 100644 (file)
@@ -139,9 +139,10 @@ static RenderElement* inFlowPositionedInlineAncestor(RenderElement* p)
     return 0;
 }
 
-static void updateStyleOfAnonymousBlockContinuations(RenderBlock& block, const RenderStyle* newStyle, const RenderStyle* oldStyle)
+static void updateStyleOfAnonymousBlockContinuations(const RenderBlock& block, const RenderStyle* newStyle, const RenderStyle* oldStyle)
 {
-    for (RenderBox* box = &block; box && box->isAnonymousBlock(); box = box->nextSiblingBox()) {
+    // If any descendant blocks exist then they will be in the next anonymous block and its siblings.
+    for (RenderBox* box = block.nextSiblingBox(); box && box->isAnonymousBlock(); box = box->nextSiblingBox()) {
         if (box->style().position() == newStyle->position())
             continue;
         
@@ -185,13 +186,8 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
         // If an inline's in-flow positioning has changed and it is part of an active continuation as a descendant of an anonymous containing block,
         // then any descendant blocks will need to change their in-flow positioning accordingly.
         // Do this by updating the position of the descendant blocks' containing anonymous blocks - there may be more than one.
-        if (containingBlock()->isAnonymousBlock() && oldStyle && newStyle.position() != oldStyle->position() && (newStyle.hasInFlowPosition() || oldStyle->hasInFlowPosition())) {
-            // If any descendant blocks exist then they will be in the next anonymous block and its siblings.
-            ASSERT(containingBlock()->nextSibling());
-            RenderBlock& block = downcast<RenderBlock>(*containingBlock()->nextSibling());
-            ASSERT(block.isAnonymousBlock());
-            updateStyleOfAnonymousBlockContinuations(block, &newStyle, oldStyle);
-        }
+        if (containingBlock()->isAnonymousBlock() && oldStyle && newStyle.position() != oldStyle->position() && (newStyle.hasInFlowPosition() || oldStyle->hasInFlowPosition()))
+            updateStyleOfAnonymousBlockContinuations(*containingBlock(), &newStyle, oldStyle);
     }
 
     if (!alwaysCreateLineBoxes()) {