RenderGrid children should always be RenderBoxes
authortony@chromium.org <tony@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 20 Aug 2012 21:32:03 +0000 (21:32 +0000)
committertony@chromium.org <tony@chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 20 Aug 2012 21:32:03 +0000 (21:32 +0000)
https://bugs.webkit.org/show_bug.cgi?id=94305

Reviewed by Abhishek Arya.

Source/WebCore:

During RenderGrid::layout, we assume all the children are RenderBoxes.
When removing children, if the last child is an anonymous block, we don't
want to remove the anonymous block for grids. Ensure this doesn't happen
by adding canCollapseAnonymousBlockChild to RenderBlock (flexboxen and
grid can override this method).

Test: fast/css-grid-layout/should-not-collapse-anonymous-blocks.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::removeChild): Check canCollapseAnonymousBlockChild().
* rendering/RenderBlock.h:
(WebCore::RenderBlock::canCollapseAnonymousBlockChild):
(RenderBlock):
* rendering/RenderDeprecatedFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
* rendering/RenderFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
* rendering/RenderGrid.h: canCollapseAnonymousBlockChild returns false.

LayoutTests:

Add test case from fuzzer.

* fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt: Added.
* fast/css-grid-layout/should-not-collapse-anonymous-blocks.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@126071 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt [new file with mode: 0644]
LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBlock.cpp
Source/WebCore/rendering/RenderBlock.h
Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
Source/WebCore/rendering/RenderFlexibleBox.h
Source/WebCore/rendering/RenderGrid.h

index 7fec102..5cb1142 100644 (file)
@@ -1,3 +1,15 @@
+2012-08-20  Tony Chang  <tony@chromium.org>
+
+        RenderGrid children should always be RenderBoxes
+        https://bugs.webkit.org/show_bug.cgi?id=94305
+
+        Reviewed by Abhishek Arya.
+
+        Add test case from fuzzer.
+
+        * fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt: Added.
+        * fast/css-grid-layout/should-not-collapse-anonymous-blocks.html: Added.
+
 2012-08-20  Kenneth Russell  <kbr@google.com>
 
         Unreviewed, rolling out r126026.
diff --git a/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt b/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks-expected.txt
new file mode 100644 (file)
index 0000000..4900486
--- /dev/null
@@ -0,0 +1,3 @@
+This test passes if it does not crash.
+
+
diff --git a/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks.html b/LayoutTests/fast/css-grid-layout/should-not-collapse-anonymous-blocks.html
new file mode 100644 (file)
index 0000000..d4c1ef2
--- /dev/null
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.testRunner) {
+    testRunner.overridePreference("WebKitCSSGridLayoutEnabled", 1);
+    testRunner.dumpAsText();
+}
+</script>
+<style>
+#a:nth-last-child(-n+2) {
+    -webkit-flow-into: body;
+}
+</style>
+<body>
+<p>This test passes if it does not crash.</p>
+<div style="display: -webkit-grid;">
+    <div id=a></div>
+    <div style="display: inline; "></div>
+</div>
+</html>
index 5934603..5a8a5d0 100644 (file)
@@ -1,3 +1,27 @@
+2012-08-20  Tony Chang  <tony@chromium.org>
+
+        RenderGrid children should always be RenderBoxes
+        https://bugs.webkit.org/show_bug.cgi?id=94305
+
+        Reviewed by Abhishek Arya.
+
+        During RenderGrid::layout, we assume all the children are RenderBoxes.
+        When removing children, if the last child is an anonymous block, we don't
+        want to remove the anonymous block for grids. Ensure this doesn't happen
+        by adding canCollapseAnonymousBlockChild to RenderBlock (flexboxen and
+        grid can override this method).
+
+        Test: fast/css-grid-layout/should-not-collapse-anonymous-blocks.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild): Check canCollapseAnonymousBlockChild().
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::canCollapseAnonymousBlockChild):
+        (RenderBlock):
+        * rendering/RenderDeprecatedFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
+        * rendering/RenderFlexibleBox.h: canCollapseAnonymousBlockChild returns false.
+        * rendering/RenderGrid.h: canCollapseAnonymousBlockChild returns false.
+
 2012-08-20  Kenneth Russell  <kbr@google.com>
 
         Unreviewed, rolling out r126026.
index d5e992c..aa71af5 100755 (executable)
@@ -1213,12 +1213,12 @@ void RenderBlock::removeChild(RenderObject* oldChild)
     RenderBox::removeChild(oldChild);
 
     RenderObject* child = prev ? prev : next;
-    if (canMergeAnonymousBlocks && child && !child->previousSibling() && !child->nextSibling() && !isFlexibleBoxIncludingDeprecated()) {
+    if (canMergeAnonymousBlocks && child && !child->previousSibling() && !child->nextSibling() && canCollapseAnonymousBlockChild()) {
         // The removal has knocked us down to containing only a single anonymous
         // box.  We can go ahead and pull the content right back up into our
         // box.
         collapseAnonymousBoxChild(this, child);
-    } else if (((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) && !isFlexibleBoxIncludingDeprecated()) {
+    } else if (((prev && prev->isAnonymousBlock()) || (next && next->isAnonymousBlock())) && canCollapseAnonymousBlockChild()) {
         // It's possible that the removal has knocked us down to a single anonymous
         // block with pseudo-style element siblings (e.g. first-letter). If these
         // are floating, then we need to pull the content up also.
index 2c7fe36..11b698b 100644 (file)
@@ -985,6 +985,8 @@ protected:
 
     virtual bool recomputeLogicalWidth();
 
+    virtual bool canCollapseAnonymousBlockChild() const { return true; }
+
 public:
     LayoutUnit offsetFromLogicalTopOfFirstPage() const;
     RenderRegion* regionAtBlockOffset(LayoutUnit) const;
index 958bdf3..851fbe4 100644 (file)
@@ -47,9 +47,9 @@ public:
     void layoutVerticalBox(bool relayoutChildren);
 
     virtual bool avoidsFloats() const { return true; }
-
     virtual bool isDeprecatedFlexibleBox() const { return true; }
     virtual bool isStretchingChildren() const { return m_stretchingChildren; }
+    virtual bool canCollapseAnonymousBlockChild() const OVERRIDE { return false; }
 
     void placeChild(RenderBox* child, const LayoutPoint& location);
 
index bd05b45..d418ce8 100644 (file)
@@ -45,6 +45,7 @@ public:
 
     virtual bool isFlexibleBox() const OVERRIDE { return true; }
     virtual bool avoidsFloats() const OVERRIDE { return true; }
+    virtual bool canCollapseAnonymousBlockChild() const OVERRIDE { return false; }
     virtual void computePreferredLogicalWidths() OVERRIDE;
     virtual void layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight = 0) OVERRIDE;
 
index f9b0879..e5017fa 100644 (file)
@@ -41,6 +41,7 @@ public:
     virtual void computePreferredLogicalWidths() OVERRIDE;
 
     virtual bool avoidsFloats() const OVERRIDE { return true; }
+    virtual bool canCollapseAnonymousBlockChild() const OVERRIDE { return false; }
 
 private:
     class GridTrack;