<rdar://problem/11025225> Assertion failure in RenderView::computeRectForRepaint...
authormitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Mar 2012 23:58:59 +0000 (23:58 +0000)
committermitz@apple.com <mitz@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Mar 2012 23:58:59 +0000 (23:58 +0000)
https://bugs.webkit.org/show_bug.cgi?id=81051

Reviewed by Simon Fraser.

.:

* ManualTests/inline-repaint-container.html: Added.

Source/WebCore:

Test: ManualTests/inline-repaint-container.html.

* rendering/RenderInline.cpp:
(WebCore::RenderInline::clippedOverflowRectForRepaint): This function was not handling the
case of the repaint container being a descendant of the containing block correctly, leading
to the assertion failure, but also to a correctness bug seen in the new test. If the repaint
container is a descendant of the containing block, just return the rect in the repaint
container coordinates.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@110643 268f45cc-cd09-0410-ab3c-d52691b4dbfc

ChangeLog
ManualTests/inline-repaint-container.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderInline.cpp

index d21f496..c8cedc8 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2012-03-13  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11025225> Assertion failure in RenderView::computeRectForRepaint() (!repaintContainer || repaintContainer == this) at store.apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=81051
+
+        Reviewed by Simon Fraser.
+
+        * ManualTests/inline-repaint-container.html: Added.
+
 2012-03-13  Adam Barth  <abarth@webkit.org> && Benjamin Poulain  <bpoulain@apple.com>
 
         Always enable ENABLE(CLIENT_BASED_GEOLOCATION)
diff --git a/ManualTests/inline-repaint-container.html b/ManualTests/inline-repaint-container.html
new file mode 100644 (file)
index 0000000..e1f19c9
--- /dev/null
@@ -0,0 +1,12 @@
+<div style="-webkit-transform: translatez(0)">
+</div>
+<div style="position: relative;">
+    <span style="position: relative; z-index: 10; top: 40px; left: 30px;">
+        <span style="position: relative; top: 50px; font: 60px ahem; color: red;" id="target">X</span>
+    </span>
+</div>
+<script>
+    setTimeout(function() {
+        document.getElementById("target").style.color = "green";
+    }, 0);
+</script>
index 1e911f8..44aab2d 100644 (file)
@@ -1,5 +1,21 @@
 2012-03-13  Dan Bernstein  <mitz@apple.com>
 
+        <rdar://problem/11025225> Assertion failure in RenderView::computeRectForRepaint() (!repaintContainer || repaintContainer == this) at store.apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=81051
+
+        Reviewed by Simon Fraser.
+
+        Test: ManualTests/inline-repaint-container.html.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint): This function was not handling the
+        case of the repaint container being a descendant of the containing block correctly, leading
+        to the assertion failure, but also to a correctness bug seen in the new test. If the repaint
+        container is a descendant of the containing block, just return the rect in the repaint
+        container coordinates.
+
+2012-03-13  Dan Bernstein  <mitz@apple.com>
+
         <rdar://problem/11025217> [Mac] Assertion failure in collectComplexTextRunsForCharactersCoreText
         https://bugs.webkit.org/show_bug.cgi?id=77044
 
index 0a5a65e..6648abd 100644 (file)
@@ -1011,18 +1011,27 @@ LayoutRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
 
     // Now invalidate a rectangle.
     LayoutUnit ow = style() ? style()->outlineSize() : 0;
-    
+
+    bool hitRepaintContainer = false;
+
     // We need to add in the relative position offsets of any inlines (including us) up to our
     // containing block.
     RenderBlock* cb = containingBlock();
     for (const RenderObject* inlineFlow = this; inlineFlow && inlineFlow->isRenderInline() && inlineFlow != cb;
          inlineFlow = inlineFlow->parent()) {
-         if (inlineFlow->style()->position() == RelativePosition && inlineFlow->hasLayer())
+         if (inlineFlow == repaintContainer) {
+            hitRepaintContainer = true;
+            break;
+        }
+        if (inlineFlow->style()->position() == RelativePosition && inlineFlow->hasLayer())
             toRenderInline(inlineFlow)->layer()->relativePositionOffset(left, top);
     }
 
     LayoutRect r(-ow + left, -ow + top, boundingBox.width() + ow * 2, boundingBox.height() + ow * 2);
 
+    if (hitRepaintContainer)
+        return r;
+
     if (cb->hasColumns())
         cb->adjustRectForColumns(r);
 
@@ -1036,11 +1045,8 @@ LayoutRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
         LayoutRect boxRect(LayoutPoint(), cb->cachedSizeForOverflowClip());
         r = intersection(repaintRect, boxRect);
     }
-    
-    // FIXME: need to ensure that we compute the correct repaint rect when the repaint container
-    // is an inline.
-    if (repaintContainer != this)
-        cb->computeRectForRepaint(repaintContainer, r);
+
+    cb->computeRectForRepaint(repaintContainer, r);
 
     if (ow) {
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {