Tapping after CSS-based table casues an infinite loop in wordRangeFromPosition
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 11 May 2018 20:39:30 +0000 (20:39 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 11 May 2018 20:39:30 +0000 (20:39 +0000)
https://bugs.webkit.org/show_bug.cgi?id=185465
<rdar://problem/35263057>

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Rebaselined the tests. h2

* web-platform-tests/dom/nodes/getElementsByClassName-30-expected.txt: table is generating a new line as expected.
* web-platform-tests/html/syntax/parsing/html5lib_menuitem-element-expected.txt: h2 is generating an extra line
to emulate its margin as expected.
* web-platform-tests/html/syntax/parsing/html5lib_tests11-expected.txt: Ditto.
* web-platform-tests/html/syntax/parsing/html5lib_tests21-expected.txt: Ditto.
* web-platform-tests/html/syntax/parsing/html5lib_tests25-expected.txt: Ditto.
* web-platform-tests/html/syntax/parsing/html5lib_webkit02-expected.txt: Ditto.

Source/WebCore:

The bug was caused by TextIterator not emitting a line break when exiting a CSS-based table when an element
with `display: table-row` has an invisible text node. Specifically, TextIterator::exitNode is never called on
an element with `table-cell: row` when m_node is a text node with whitespaces which appears after an element
with `display: table-cell`.

For example, for a tree structure like:
table-row (R)
  table-cell (C)
    "text" (1)
  " " (2)
Getting out of (C) would result in moving onto (2) without generating a line break for (R).

When this happens in nextBoundary as it tries to find the end of the last word in the table cell, we end up
finding the end of the document as the end of the word. As a result, nextWordBoundaryInDirection, the caller
of nextBoundary, ends up infinite looping between the positon at the end of the document and the position
immediately before the last word in the last table cell when it traverses words backwards.

This patch fixes the hang by addressing this root cause in TextIterator. Namely, TextIterator now generates
a line break when exiting a block while walking up ancestors in TextIterator::advance().

Tests: editing/selection/tapping-in-table-at-end-of-document.html
       editing/text-iterator/table-at-end-of-document.html

* editing/TextIterator.cpp:
(WebCore::TextIterator::advance): Fixed the bug.
(WebCore::shouldEmitNewlineAfterNode): Do generate a new line at the end of a document when we're trying to
generate every visible poitions even there are no renderers beyond this point. e.g. a position inside the
last cell of a table at the end of a document hits this condition.
(WebCore::shouldEmitExtraNewlineForNode): Don't emit a line break when the render box's height is 0px
to avoid generating many empty lines for empty paragraph and header elements (this function is used to generate
a blank line between p's and h1/h2/...'s).
(WebCore::TextIterator::exitNode):

LayoutTests:

Rebaselined the tests. Most of these are due to new extra line breaks being generated after table and
header elements as expected. See inline comments for some newly discovered bugs and rebaselines due to
other non-obvious reasons.

* accessibility/internal-link-anchors2-expected.txt: This test now demonstrates a bug that WebKit doesn't
generate an extra line break before h3 when it has a large margin-top since an extra line break is only
generated after a node at the moment.
* accessibility/mac/mathml-elements-expected.txt:
* accessibility/table-headers-expected.txt:
* compositing/layer-creation/overlap-transformed-preserved-3d-expected.txt:
* css3/flexbox/box-orient-button-expected.txt:
* css3/flexbox/flexitem-expected.txt:
* editing/execCommand/19087-expected.txt: The second blockquote which has the height of 0px no longer
generates an extra new line.
* editing/inserting/insert-list-in-table-cell-08-expected.txt: Selection is now being restored properly
using TextIterator in InsertListCommand.
* editing/selection/tapping-in-table-at-end-of-document-expected.txt: Added.
* editing/selection/tapping-in-table-at-end-of-document.html: Added.
* editing/text-iterator/table-at-end-of-document-expected.txt: Added.
* editing/text-iterator/table-at-end-of-document.html: Added.
* fast/block/positioning/insert-positioned-in-anonymous-crash-expected.txt:
* fast/css/css3-ch-unit-expected.txt: Line breaks are generated between block & inline-block elements
as expected.
* fast/css/percent-min-width-img-src-change-expected.txt:
* fast/css/percent-width-img-src-change-expected.txt:
* fast/css/pseudo-empty-display-none-expected.txt:
* fast/dom/HTMLAnchorElement/anchor-in-noscroll-iframe-crash-expected.txt:
* fast/dom/HTMLDivElement/align/getset-expected.txt:
* fast/dom/HTMLSelectElement/listbox-select-reset-expected.txt:
* fast/dom/HTMLTableElement/table-with-invalid-border-expected.txt:
* fast/forms/option-mouseevents-expected.txt:
* fast/history/multiple-classes-visited-expected.txt:
* fast/history/self-is-visited-expected.txt:
* fast/html/marquee-reparent-check-expected.txt:
* fast/inline-block/anonymous-block-crash-expected.txt: This test now demonstrates a bug that we're not
generating an empty line before a block in some cases.
* fast/inline/inline-position-top-align-expected.txt:
* fast/invalid/test-case-tr-th-td-should-not-close-dl-list-expected.txt:
* fast/overflow/scrollbar-click-retains-focus-expected.txt:
* fast/parser/comments-expected.txt:
* fast/parser/fragment-parser-doctype-expected.txt:
* fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt:
* fast/spatial-navigation/snav-radio-group-expected.txt: A line break is generated after a nested table.
* fast/sub-pixel/table-cells-have-stable-width-expected.txt:
* fast/table/table-row-oveflow-crash-expected.txt: A line break is generated after a table as expected,
which is followed by a BR which creates a blank line.
* fast/table/table-with-borderattr-null-expected.txt:
* fast/table/table-with-borderattr-set-to-null-expected.txt:
* fast/text/international/dynamic-text-combine-crash-expected.txt:
* fast/xsl/mozilla-tests-expected.txt:
* http/tests/misc/large-js-program-expected.txt:
* imported/blink/plugins/empty-per-context-data-expected.txt:
* inspector/console/js-isLikelyStackTrace-expected.txt:
* inspector/console/js-source-locations-expected.txt:
* mathml/out-of-flow-in-token-crash-expected.txt:
* mathml/presentation/stretchy-depth-height-expected.txt:
* platform/mac/accessibility/table-cells-roles-expected.txt: Line breaks are generated after a block
followed by two two consecutive BRs.
* platform/mac/accessibility/table-roles-hierarchy-expected.txt: Ditto.
* svg/foreignObject/fO-fixed-position-crash-expected.txt:
* tiled-drawing/scrolling/non-fast-region/wheel-handler-region-basic-expected.txt:
* transforms/3d/hit-testing/coplanar-with-camera-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@231717 268f45cc-cd09-0410-ab3c-d52691b4dbfc

60 files changed:
LayoutTests/ChangeLog
LayoutTests/accessibility/internal-link-anchors2-expected.txt
LayoutTests/accessibility/mac/mathml-elements-expected.txt
LayoutTests/accessibility/table-headers-expected.txt
LayoutTests/compositing/layer-creation/overlap-transformed-preserved-3d-expected.txt
LayoutTests/css3/flexbox/box-orient-button-expected.txt
LayoutTests/css3/flexbox/flexitem-expected.txt
LayoutTests/editing/execCommand/19087-expected.txt
LayoutTests/editing/inserting/insert-list-in-table-cell-08-expected.txt
LayoutTests/editing/selection/tapping-in-table-at-end-of-document-expected.txt [new file with mode: 0644]
LayoutTests/editing/selection/tapping-in-table-at-end-of-document.html [new file with mode: 0644]
LayoutTests/editing/text-iterator/table-at-end-of-document-expected.txt [new file with mode: 0644]
LayoutTests/editing/text-iterator/table-at-end-of-document.html [new file with mode: 0644]
LayoutTests/fast/block/positioning/insert-positioned-in-anonymous-crash-expected.txt
LayoutTests/fast/css/css3-ch-unit-expected.txt
LayoutTests/fast/css/percent-min-width-img-src-change-expected.txt
LayoutTests/fast/css/percent-width-img-src-change-expected.txt
LayoutTests/fast/css/pseudo-empty-display-none-expected.txt
LayoutTests/fast/dom/HTMLAnchorElement/anchor-in-noscroll-iframe-crash-expected.txt
LayoutTests/fast/dom/HTMLDivElement/align/getset-expected.txt
LayoutTests/fast/dom/HTMLSelectElement/listbox-select-reset-expected.txt
LayoutTests/fast/dom/HTMLTableElement/table-with-invalid-border-expected.txt
LayoutTests/fast/forms/option-mouseevents-expected.txt
LayoutTests/fast/history/multiple-classes-visited-expected.txt
LayoutTests/fast/history/self-is-visited-expected.txt
LayoutTests/fast/html/marquee-reparent-check-expected.txt
LayoutTests/fast/inline-block/anonymous-block-crash-expected.txt
LayoutTests/fast/inline/inline-position-top-align-expected.txt
LayoutTests/fast/invalid/test-case-tr-th-td-should-not-close-dl-list-expected.txt
LayoutTests/fast/overflow/scrollbar-click-retains-focus-expected.txt
LayoutTests/fast/parser/comments-expected.txt
LayoutTests/fast/parser/fragment-parser-doctype-expected.txt
LayoutTests/fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt
LayoutTests/fast/spatial-navigation/snav-radio-group-expected.txt
LayoutTests/fast/sub-pixel/table-cells-have-stable-width-expected.txt
LayoutTests/fast/table/table-row-oveflow-crash-expected.txt
LayoutTests/fast/table/table-with-borderattr-null-expected.txt
LayoutTests/fast/table/table-with-borderattr-set-to-null-expected.txt
LayoutTests/fast/text/international/dynamic-text-combine-crash-expected.txt
LayoutTests/fast/xsl/mozilla-tests-expected.txt
LayoutTests/http/tests/misc/large-js-program-expected.txt
LayoutTests/imported/blink/plugins/empty-per-context-data-expected.txt
LayoutTests/imported/w3c/ChangeLog
LayoutTests/imported/w3c/web-platform-tests/dom/nodes/getElementsByClassName-30-expected.txt
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_menuitem-element-expected.txt
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_tests11-expected.txt
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_tests21-expected.txt
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_tests25-expected.txt
LayoutTests/imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_webkit02-expected.txt
LayoutTests/inspector/console/js-isLikelyStackTrace-expected.txt
LayoutTests/inspector/console/js-source-locations-expected.txt
LayoutTests/mathml/out-of-flow-in-token-crash-expected.txt
LayoutTests/mathml/presentation/stretchy-depth-height-expected.txt
LayoutTests/platform/mac/accessibility/table-cells-roles-expected.txt
LayoutTests/platform/mac/accessibility/table-roles-hierarchy-expected.txt
LayoutTests/svg/foreignObject/fO-fixed-position-crash-expected.txt
LayoutTests/tiled-drawing/scrolling/non-fast-region/wheel-handler-region-basic-expected.txt
LayoutTests/transforms/3d/hit-testing/coplanar-with-camera-expected.txt
Source/WebCore/ChangeLog
Source/WebCore/editing/TextIterator.cpp

index 1a94747..99f107e 100644 (file)
@@ -1,3 +1,74 @@
+2018-05-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Tapping after CSS-based table casues an infinite loop in wordRangeFromPosition
+        https://bugs.webkit.org/show_bug.cgi?id=185465
+        <rdar://problem/35263057>
+
+        Reviewed by Antti Koivisto.
+
+        Rebaselined the tests. Most of these are due to new extra line breaks being generated after table and
+        header elements as expected. See inline comments for some newly discovered bugs and rebaselines due to
+        other non-obvious reasons.
+
+        * accessibility/internal-link-anchors2-expected.txt: This test now demonstrates a bug that WebKit doesn't
+        generate an extra line break before h3 when it has a large margin-top since an extra line break is only
+        generated after a node at the moment.
+        * accessibility/mac/mathml-elements-expected.txt:
+        * accessibility/table-headers-expected.txt:
+        * compositing/layer-creation/overlap-transformed-preserved-3d-expected.txt:
+        * css3/flexbox/box-orient-button-expected.txt:
+        * css3/flexbox/flexitem-expected.txt:
+        * editing/execCommand/19087-expected.txt: The second blockquote which has the height of 0px no longer
+        generates an extra new line.
+        * editing/inserting/insert-list-in-table-cell-08-expected.txt: Selection is now being restored properly
+        using TextIterator in InsertListCommand.
+        * editing/selection/tapping-in-table-at-end-of-document-expected.txt: Added.
+        * editing/selection/tapping-in-table-at-end-of-document.html: Added.
+        * editing/text-iterator/table-at-end-of-document-expected.txt: Added.
+        * editing/text-iterator/table-at-end-of-document.html: Added.
+        * fast/block/positioning/insert-positioned-in-anonymous-crash-expected.txt:
+        * fast/css/css3-ch-unit-expected.txt: Line breaks are generated between block & inline-block elements
+        as expected.
+        * fast/css/percent-min-width-img-src-change-expected.txt:
+        * fast/css/percent-width-img-src-change-expected.txt:
+        * fast/css/pseudo-empty-display-none-expected.txt:
+        * fast/dom/HTMLAnchorElement/anchor-in-noscroll-iframe-crash-expected.txt:
+        * fast/dom/HTMLDivElement/align/getset-expected.txt:
+        * fast/dom/HTMLSelectElement/listbox-select-reset-expected.txt:
+        * fast/dom/HTMLTableElement/table-with-invalid-border-expected.txt:
+        * fast/forms/option-mouseevents-expected.txt:
+        * fast/history/multiple-classes-visited-expected.txt:
+        * fast/history/self-is-visited-expected.txt:
+        * fast/html/marquee-reparent-check-expected.txt:
+        * fast/inline-block/anonymous-block-crash-expected.txt: This test now demonstrates a bug that we're not
+        generating an empty line before a block in some cases.
+        * fast/inline/inline-position-top-align-expected.txt:
+        * fast/invalid/test-case-tr-th-td-should-not-close-dl-list-expected.txt:
+        * fast/overflow/scrollbar-click-retains-focus-expected.txt:
+        * fast/parser/comments-expected.txt:
+        * fast/parser/fragment-parser-doctype-expected.txt:
+        * fast/ruby/ruby-base-merge-block-children-crash-2-expected.txt:
+        * fast/spatial-navigation/snav-radio-group-expected.txt: A line break is generated after a nested table.
+        * fast/sub-pixel/table-cells-have-stable-width-expected.txt:
+        * fast/table/table-row-oveflow-crash-expected.txt: A line break is generated after a table as expected,
+        which is followed by a BR which creates a blank line.
+        * fast/table/table-with-borderattr-null-expected.txt:
+        * fast/table/table-with-borderattr-set-to-null-expected.txt:
+        * fast/text/international/dynamic-text-combine-crash-expected.txt:
+        * fast/xsl/mozilla-tests-expected.txt:
+        * http/tests/misc/large-js-program-expected.txt:
+        * imported/blink/plugins/empty-per-context-data-expected.txt:
+        * inspector/console/js-isLikelyStackTrace-expected.txt:
+        * inspector/console/js-source-locations-expected.txt:
+        * mathml/out-of-flow-in-token-crash-expected.txt:
+        * mathml/presentation/stretchy-depth-height-expected.txt:
+        * platform/mac/accessibility/table-cells-roles-expected.txt: Line breaks are generated after a block
+        followed by two two consecutive BRs.
+        * platform/mac/accessibility/table-roles-hierarchy-expected.txt: Ditto.
+        * svg/foreignObject/fO-fixed-position-crash-expected.txt:
+        * tiled-drawing/scrolling/non-fast-region/wheel-handler-region-basic-expected.txt:
+        * transforms/3d/hit-testing/coplanar-with-camera-expected.txt:
+
 2018-05-11  Chris Dumez  <cdumez@apple.com>
 
         REGRESSION (async policy delegate): Revoking an object URL immediately after triggering download breaks file download
index 29aad5b..fcbac34 100644 (file)
@@ -33,7 +33,7 @@ over
 under
 over
 
-3      2       1
+3      2       1 
 This tests ensures that Mac specific attributes and roles for MathML elements work as expected.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
index 9af1a5f..fa0031a 100644 (file)
@@ -3,6 +3,7 @@ No      Country Capital
 2.     Russia  Moscow
 3.     Ukraine Kiev
 
+
 This tests that the columnHeaders() and rowHeaders() functions return the correct headers for a table cell.
 
 The table cell at (0,3) should have exactly one column header, currently it has 1 column header(s).
index 037a7a5..3278e6c 100644 (file)
@@ -11,18 +11,22 @@ default:
 
 hello
 world
+
 horizontal:
 
 hello
 world
+
 vertical:
 
 hello
 world
+
 default => vertical:
 
 hello
 world
+
 vertical => horizontal:
 
 hello
index 11af55d..1dffe34 100644 (file)
@@ -28,6 +28,7 @@ object
 
 
 
+
 button
 
 
@@ -39,6 +40,7 @@ object
 
 
 
+
 Some text
 Some more text
 
index 3211e80..02b4266 100644 (file)
@@ -4,4 +4,3 @@ This tests for a crash when indenting a particular selection that contains a blo
 
 
 
-
index 610061f..a4a036f 100644 (file)
@@ -33,4 +33,5 @@ After:
 |       <td>
 |         "gghfg"
 |       <td>
-|         "fsfg<#selection-focus>"
+|         "fsfg"
+| <#selection-focus>
diff --git a/LayoutTests/editing/selection/tapping-in-table-at-end-of-document-expected.txt b/LayoutTests/editing/selection/tapping-in-table-at-end-of-document-expected.txt
new file mode 100644 (file)
index 0000000..18d961e
--- /dev/null
@@ -0,0 +1,6 @@
+This tests tapping on after a CSS table doesn't cause a hang.
+To manually test, click on the right of the text below inside the red box.
+WebKit should not hang, and you should see PASS below immediately:
+
+PASS
+Click here >
diff --git a/LayoutTests/editing/selection/tapping-in-table-at-end-of-document.html b/LayoutTests/editing/selection/tapping-in-table-at-end-of-document.html
new file mode 100644 (file)
index 0000000..d544c31
--- /dev/null
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<script src="../../resources/ui-helper.js"></script>
+<script>
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+    window.onload = async () => {
+        const table = document.getElementById('table');
+        const rect = table.getBoundingClientRect();
+        await UIHelper.activateAt(rect.x + rect.width / 2, rect.y + 10);
+        setTimeout(() => testRunner.notifyDone(), 0);
+    }
+}
+
+</script>
+</head>
+<body>
+<p>This tests tapping on after a CSS table doesn't cause a hang.<br>
+To manually test, click on the right of the text below inside the red box.<br>
+WebKit should not hang, and you should see PASS below immediately:</p>
+<div id="result"></div>
+<div id="table" onclick="result.textContent = 'PASS'" style="width: 100%; height: 100%; border: solid 10px red; padding: 10px;">
+  <div style="display: table">
+    <div style="display: table-row">
+      <div style="display: table-cell">
+        Click here >
+      </div>
+    </div>
+  </div>
+</div>
+</body>
+</html>
diff --git a/LayoutTests/editing/text-iterator/table-at-end-of-document-expected.txt b/LayoutTests/editing/text-iterator/table-at-end-of-document-expected.txt
new file mode 100644 (file)
index 0000000..44f8a08
--- /dev/null
@@ -0,0 +1,7 @@
+This tests getting the plain text of a CSS table followed by a text. You should see X and Y in two seprate lines below twice:
+
+PASS
+X
+Y
+X
+Y
diff --git a/LayoutTests/editing/text-iterator/table-at-end-of-document.html b/LayoutTests/editing/text-iterator/table-at-end-of-document.html
new file mode 100644 (file)
index 0000000..9a413df
--- /dev/null
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<script>
+
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+window.onload = () => {
+    let result = document.getElementById('container').innerText;
+    document.getElementById('result').textContent = result;
+    document.getElementById('pass-fail').textContent = result == 'X\nY' ? 'PASS' : 'FAIL';
+}
+
+</script>
+</head>
+<body>
+<p>This tests getting the plain text of a CSS table followed by a text.
+You should see X and Y in two seprate lines below twice:</p>
+<div id="pass-fail"></div>
+<pre><span id="result" style="background: #3cf;"></span></pre>
+<div id="container" style="width:100%; height: 100%'">
+  <div style="display: table">
+    <div style="display: table-row">
+      <div id="cell" style="display: table-cell">
+        X
+      </div>
+    </div>
+  </div>
+  Y
+</div>
+</body>
+</html>
index 8d4d603..9052f8e 100644 (file)
@@ -36,10 +36,14 @@ abcdefghijklmnopqrstuvwxyz
 Four zeroes should be visible, nothing else:
 0000
 0000
-0000 There should be more than one green '|' visible (non-monospaced fonts):
-|||0|||
-|||0|||
-|||0|||
+0000
+There should be more than one green '|' visible (non-monospaced fonts):
+|||0
+|||
+|||0
+|||
+|||0
+|||
 This box has a 20px font size. The last two '0's should be the same size.
 0
 0
index 1fa2ac5..a995bcc 100644 (file)
@@ -1,4 +1,3 @@
 This tests whether clicking on an anchor in an iframe with scrolling="no" will scroll to anchor. If clicking on the link below triggers a scroll, the test passes.
 
-
 PASS
index c7a94a0..f33121e 100644 (file)
@@ -1,4 +1,5 @@
 Tests: getting and setting HTMLDivElement::align
+
 Condition(s):
 Testing valid, invalid, and empty values
 
index b8af02e..b8f2818 100644 (file)
@@ -2,6 +2,7 @@
 This test verifies that list-box-style select form controls with no "selected" attributes are properly cleared when reset.
 
 You should see two element IDs below, and the word "SUCCESS" twice:
+
 multiSelectElement: SUCCESS
 
 singleSelectElement: SUCCESS
index 8948e86..a6c10f0 100644 (file)
@@ -1,3 +1,4 @@
 https://bugs.webkit.org/show_bug.cgi?id=102112: There should be a black box below. 
+
 PASS getComputedStyle(document.querySelector("table")).borderTopWidth is "1px"
 
index b59a991..7c0d804 100644 (file)
@@ -6,6 +6,7 @@ https://bugs.webkit.org/show_bug.cgi?id=3248
 
 
 
+
 PASS: event type should be mousedown and is
 PASS: event target should be [object HTMLOptionElement] and is
 PASS: event.pageX should be 22 and is
index ca2d92c..37c320a 100644 (file)
@@ -1,6 +1,7 @@
 These two links should be the same color (orange):
 
 One Two
+
 PASS firstStyle.color became secondStyle.color
 PASS successfullyParsed is true
 
index ddbd1da..04d72e9 100644 (file)
@@ -1,6 +1,7 @@
 These two links should be different colors (green and orange):
 
 One Two
+
 PASS firstStyle.color became different from secondStyle.color
 PASS firstStyle.backgroundColor became different from secondStyle.backgroundColor
 PASS successfullyParsed is true
index 7200cb8..5b9042b 100644 (file)
@@ -1,4 +1,5 @@
 pre-text after-text    Something
+
 Tests for hitTest of element 
 bug 45164: REGRESSION:  Clickable area too large
 
index 6516892..9e7ff7e 100644 (file)
@@ -3,7 +3,6 @@ This tests clicking scrollbars, which should only move the focus if an ancestor
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-
 Focus should remain in the input
 PASS document.activeElement.tagName is "INPUT"
 
index 9e5125e..d387711 100644 (file)
@@ -2,8 +2,10 @@ Output of this test should match HTML5 (no strict SGML comment parsing).
 
 Basic comments:
 PASSED
+
 Comment series:
 PASSED
+
 Dash runs:
 PASSED PASSED PASSED
 
@@ -17,6 +19,7 @@ Compatibility:
 PASSED PASSED
 
 White space after comment close:
+
 Extra comment after markup declaration close:
 FAILED: extra comment end and markup declaration close -->
 PASSED (outer nested comment) -->
index 21debaa..f4bf157 100644 (file)
@@ -2,7 +2,8 @@
 4      
        
                
-               6
+       
+6
 8      
 PASS gFocusedDocument.activeElement.getAttribute("id") is "down"
 PASS gFocusedDocument.activeElement.getAttribute("id") is "8"
index 9291ba1..d1d56a6 100644 (file)
@@ -1,6 +1,6 @@
 PASS Cell in AutoTable has expected size
 PASS Cell in FixedTable has expected size
-Cc:    AutoTableLayout 
+Cc:    AutoTableLayout
 foo
 FixedTableLayout
 Tests that setting the width of an element inside a cell to the computed width of said element does not change the width of the cell itself.
index 8a95913..2c373bd 100644 (file)
@@ -1,3 +1,4 @@
 There should be a black box below. 
+
 PASS getComputedStyle(document.querySelector("table")).borderTopWidth is "1px"
 
index fbc35e9..df5d35d 100644 (file)
@@ -38,6 +38,7 @@ Testing parent and ancestor ops
 Test:see source
 Desired Result: true
 Result:true
+
 Testing basic xsl:apply-templates
 Test:<xsl:apply-templates/>
 Desired Result:element x, element y, element z
index bb29cd8..bbb249d 100644 (file)
@@ -3,3 +3,4 @@ This tests verifies that a large program doesn't crash JavaScript.
 
 This test should generate an out of stack exception, but have no other output. 
 
+
index 3734d5b..c34ad6b 100644 (file)
@@ -1,4 +1,3 @@
 
-
 This tests that invoking a plugin object from a (iframe) document that is no longer visible in a frame doesn't crash the renderer. If this test is successful, the word SUCCESS should be seen below.
 SUCCESS
index 0b961c5..e125abf 100644 (file)
@@ -1,3 +1,21 @@
+2018-05-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Tapping after CSS-based table casues an infinite loop in wordRangeFromPosition
+        https://bugs.webkit.org/show_bug.cgi?id=185465
+        <rdar://problem/35263057>
+
+        Reviewed by Antti Koivisto.
+
+        Rebaselined the tests. h2
+
+        * web-platform-tests/dom/nodes/getElementsByClassName-30-expected.txt: table is generating a new line as expected.
+        * web-platform-tests/html/syntax/parsing/html5lib_menuitem-element-expected.txt: h2 is generating an extra line
+        to emulate its margin as expected.
+        * web-platform-tests/html/syntax/parsing/html5lib_tests11-expected.txt: Ditto.
+        * web-platform-tests/html/syntax/parsing/html5lib_tests21-expected.txt: Ditto.
+        * web-platform-tests/html/syntax/parsing/html5lib_tests25-expected.txt: Ditto.
+        * web-platform-tests/html/syntax/parsing/html5lib_webkit02-expected.txt: Ditto.
+
 2018-05-11  Youenn Fablet  <youenn@apple.com>
 
         Rebase some fetch API tests
index 613ae4e..a78113d 100644 (file)
@@ -22,6 +22,7 @@ PASS html5lib_menuitem-element.html 03664aa93a55daceccc26d99c0aef841d8862af5
 PASS html5lib_menuitem-element.html 6d596b9e342db2306365fbdfb7615377c5b26347 
 PASS html5lib_menuitem-element.html 4b712b488be9ee047c139c1b0cd955bae990b8e5 
 afcd3b1e3317ac609ddab924d836ba1e3873b80f
+
 Input
 
 <!DOCTYPE html><body><menuitem>A<menuitem>B
@@ -48,6 +49,7 @@ Actual
 |       <menuitem>
 |         "B"
 95c0c6923fe609297c1592f2cb82bb9f2d0f5aed
+
 Input
 
 <!DOCTYPE html><body><menuitem>A<menu>B</menu>
@@ -74,6 +76,7 @@ Actual
 |       <menu>
 |         "B"
 e2772fe779cbcefb4458f169a0cd495cf7115845
+
 Input
 
 <!DOCTYPE html><body><menuitem>A<hr>B
index 1a30c21..874d90a 100644 (file)
@@ -18,6 +18,7 @@ PASS html5lib_tests11.html 791437ece7ba684e00162d1dd79dfe540e3621a7
 PASS html5lib_tests11.html af40d26164229c29b9be77ed6dd7dda780cba55c 
 PASS html5lib_tests11.html 16e68d18f8f0fb81013fe77a30b7d396c5081e5e 
 0e5897aafe87e460f84576c2d1d983504d12a7db
+
 Input
 
 <!DOCTYPE html><body><svg attributename='' attributetype='' basefrequency='' baseprofile='' calcmode='' clippathunits='' diffuseconstant='' edgemode='' filterunits='' filterres='' glyphref='' gradienttransform='' gradientunits='' kernelmatrix='' kernelunitlength='' keypoints='' keysplines='' keytimes='' lengthadjust='' limitingconeangle='' markerheight='' markerunits='' markerwidth='' maskcontentunits='' maskunits='' numoctaves='' pathlength='' patterncontentunits='' patterntransform='' patternunits='' pointsatx='' pointsaty='' pointsatz='' preservealpha='' preserveaspectratio='' primitiveunits='' refx='' refy='' repeatcount='' repeatdur='' requiredextensions='' requiredfeatures='' specularconstant='' specularexponent='' spreadmethod='' startoffset='' stddeviation='' stitchtiles='' surfacescale='' systemlanguage='' tablevalues='' targetx='' targety='' textlength='' viewbox='' viewtarget='' xchannelselector='' ychannelselector='' zoomandpan=''></svg>
@@ -156,6 +157,7 @@ Actual
 |       yChannelSelector=""
 |       zoomAndPan=""
 a8f7a23601363454b4a13f66aed99ec9708ae87b
+
 Input
 
 <!DOCTYPE html><body><svg contentScriptType='' contentStyleType='' externalResourcesRequired='' filterRes=''></svg>
@@ -184,6 +186,7 @@ Actual
 |       externalResourcesRequired=""
 |       filterRes=""
 f8f7f6c576acc9eb874acb0dce6988f0f7b6fc5f
+
 Input
 
 <!DOCTYPE html><body><svg CONTENTSCRIPTTYPE='' CONTENTSTYLETYPE='' EXTERNALRESOURCESREQUIRED='' FILTERRES=''></svg>
@@ -212,6 +215,7 @@ Actual
 |       externalResourcesRequired=""
 |       filterRes=""
 fb4dc9f70129a8a045fca3a1e3acee052d0990b3
+
 Input
 
 <!DOCTYPE html><body><svg contentscripttype='' contentstyletype='' externalresourcesrequired='' filterres=''></svg>
index 0ee0a56..5c36cae 100644 (file)
@@ -25,6 +25,7 @@ PASS html5lib_tests21.html 9df59cd349097dca330fefef6c1b1bbbfddadae6
 PASS html5lib_tests21.html 671f606f5cb7033854d99b96b040994f0f451496 
 PASS html5lib_tests21.html caa80af33c7880aaddd17824efff1774ece01325 
 80607dd011814b8d3ef5c9ca380fec044dd5e1aa
+
 Input
 
 <!DOCTYPE html><svg><![CDATA[foo]]]>
@@ -47,6 +48,7 @@ Actual
 |     <svg svg>
 |       "foo]]]>"
 c9f579bf49de2d4c553d03e43772c0d94be474c0
+
 Input
 
 <!DOCTYPE html><svg><![CDATA[foo]]]]]>
index 79754d8..771d690 100644 (file)
@@ -22,6 +22,7 @@ PASS html5lib_tests25.html 057bc2d868d2f365cb2c0b4d07c231d2fa2b23b7
 PASS html5lib_tests25.html 7f684d19be362ec9aa4fe7ecbba4ff3fc9730a43 
 PASS html5lib_tests25.html d79f9119d02447226cc2d151044e6cffc5409e81 
 de4aa726e09215ba9c50b97d257e6c6b880107f1
+
 Input
 
 <!DOCTYPE html><body><command>A
index 035940c..d0bae9b 100644 (file)
@@ -19,6 +19,7 @@ PASS html5lib_webkit02.html b6d2377b0dd710ca812c97b2b65cb5d2e93b0e5b
 PASS html5lib_webkit02.html 21a5b2b413c4db8ed588334b9a50dea9872bbcfa 
 PASS html5lib_webkit02.html 90d3f6f2dff994f63293ca46f7cd50a75cde96a6 
 6e33515b4dc011dd390d433a6358bf68b786b1fd
+
 Input
 
 <b><em><foo><foo><foo><aside></b></em>
index e13958f..f2a4086 100644 (file)
@@ -1,5 +1,6 @@
 Test stack trace detection heuristic.
 
+
 == Running test suite: WI.StackTrace.isLikelyStackTrace
 -- Running test case: notStacktrace
 PASS: Should NOT be a stacktrace.
index c0d77c5..4d6fb80 100644 (file)
@@ -7,6 +7,7 @@ CONSOLE MESSAGE: line 9: warn 1
 CONSOLE MESSAGE: line 9: error 1
 CONSOLE MESSAGE: line 10: error 2
 Tests that JavaScript errors and warnings from inline script tags and external files are sent to the console with correct line and column information.
+
 {"source":"console-api","level":"error","text":"error script","location":"errors.js:1:14","parameters":[{"type":"string"}]}
 {"source":"console-api","level":"warning","text":"warn script","location":"errors.js:1:44","parameters":[{"type":"string"}]}
 {"source":"console-api","level":"error","text":"error script","location":"errors.js:5:18","parameters":[{"type":"string"}]}
index ddcbe1f..4c49a9f 100644 (file)
@@ -18,7 +18,6 @@ RenderMathMLRow
 RenderMathMLScripts
 
 RenderMathMLToken
-
 RenderMathMLUnderOver
 
 RenderMathMLBlock (invalid markup)
index b01d7c2..df3cc3b 100644 (file)
@@ -8,6 +8,7 @@ This test passes if the depth and height of braces match the maximum depth and h
  
 {
 x      y       z       x       y       z       x       y       z       x       y       z       x       y       z 
 {
 1
 2
index 272d32a..5d3ef6c 100644 (file)
@@ -5,6 +5,7 @@ No      Country Capital
 3.     Ukraine Kiev
 All    3 countries     3 capitals
 
+
 table2
 No     Country Capital
 1.     Germany Berlin
index b636323..1275153 100644 (file)
@@ -5,6 +5,7 @@ No      Country Capital
 All    3 countries     3 capitals
 
 
+
 This shows the hierarchy of table roles.
 
 role: AXRole: AXTable
index a8de68c..429ab44 100644 (file)
@@ -1,5 +1,6 @@
 Some text
-Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. here Container
+Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.
+here Container
 Intermediate
 Child
 Container
index c20bd36..60957ed 100644 (file)
@@ -1,4 +1,5 @@
-The text on this element should be selectable. Hovering on this element should cause a highlight. Element at 98, 200 has id "background": PASS
+The text on this element should be selectable. Hovering on this element should cause a highlight.
+Element at 98, 200 has id "background": PASS
 Element at 302, 200 has id "background": PASS
 Element at 200, 98 has id "background": PASS
 Element at 200, 302 has id "background": PASS
index dbf7107..66ff81b 100644 (file)
@@ -1,3 +1,44 @@
+2018-05-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Tapping after CSS-based table casues an infinite loop in wordRangeFromPosition
+        https://bugs.webkit.org/show_bug.cgi?id=185465
+        <rdar://problem/35263057>
+
+        Reviewed by Antti Koivisto.
+
+        The bug was caused by TextIterator not emitting a line break when exiting a CSS-based table when an element
+        with `display: table-row` has an invisible text node. Specifically, TextIterator::exitNode is never called on
+        an element with `table-cell: row` when m_node is a text node with whitespaces which appears after an element
+        with `display: table-cell`.
+
+        For example, for a tree structure like:
+        table-row (R)
+          table-cell (C)
+            "text" (1)
+          " " (2)
+        Getting out of (C) would result in moving onto (2) without generating a line break for (R).
+
+        When this happens in nextBoundary as it tries to find the end of the last word in the table cell, we end up
+        finding the end of the document as the end of the word. As a result, nextWordBoundaryInDirection, the caller
+        of nextBoundary, ends up infinite looping between the positon at the end of the document and the position
+        immediately before the last word in the last table cell when it traverses words backwards.
+
+        This patch fixes the hang by addressing this root cause in TextIterator. Namely, TextIterator now generates
+        a line break when exiting a block while walking up ancestors in TextIterator::advance().
+
+        Tests: editing/selection/tapping-in-table-at-end-of-document.html
+               editing/text-iterator/table-at-end-of-document.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance): Fixed the bug.
+        (WebCore::shouldEmitNewlineAfterNode): Do generate a new line at the end of a document when we're trying to
+        generate every visible poitions even there are no renderers beyond this point. e.g. a position inside the
+        last cell of a table at the end of a document hits this condition.
+        (WebCore::shouldEmitExtraNewlineForNode): Don't emit a line break when the render box's height is 0px
+        to avoid generating many empty lines for empty paragraph and header elements (this function is used to generate
+        a blank line between p's and h1/h2/...'s).
+        (WebCore::TextIterator::exitNode):
+
 2018-05-11  Dean Jackson  <dino@apple.com>
 
         System preview badge doesn't show on <picture> elements
index 4b22a50..0e9c36d 100644 (file)
@@ -536,6 +536,8 @@ void TextIterator::advance()
                         return;
                     }
                     next = nextSibling(m_behavior, *m_node);
+                    if (next && m_node->renderer())
+                        exitNode(m_node);
                 }
             }
             m_fullyClippedStack.pop();            
@@ -998,13 +1000,15 @@ static bool shouldEmitNewlinesBeforeAndAfterNode(Node& node)
         && !renderer->isRubyText();
 }
 
-static bool shouldEmitNewlineAfterNode(Node& node)
+static bool shouldEmitNewlineAfterNode(Node& node, bool emitsCharactersBetweenAllVisiblePositions = false)
 {
     // FIXME: It should be better but slower to create a VisiblePosition here.
     if (!shouldEmitNewlinesBeforeAndAfterNode(node))
         return false;
-    // Check if this is the very last renderer in the document.
-    // If so, then we should not emit a newline.
+
+    // Don't emit a new line at the end of the document unless we're matching the behavior of VisiblePosition.
+    if (emitsCharactersBetweenAllVisiblePositions)
+        return true;
     Node* subsequentNode = &node;
     while ((subsequentNode = NodeTraversal::nextSkippingChildren(*subsequentNode))) {
         if (subsequentNode->renderer())
@@ -1037,8 +1041,12 @@ static bool shouldEmitExtraNewlineForNode(Node& node)
     if (!hasHeaderTag(element) && !is<HTMLParagraphElement>(element))
         return false;
 
-    int bottomMargin = downcast<RenderBox>(*renderer).collapsedMarginAfter();
-    int fontSize = downcast<RenderBox>(*renderer).style().fontDescription().computedPixelSize();
+    auto& renderBox = downcast<RenderBox>(*renderer);
+    if (!renderBox.height())
+        return false;
+
+    int bottomMargin = renderBox.collapsedMarginAfter();
+    int fontSize = renderBox.style().fontDescription().computedPixelSize();
     return bottomMargin * 2 >= fontSize;
 }
 
@@ -1174,7 +1182,7 @@ void TextIterator::exitNode(Node* exitedNode)
     // the logic in _web_attributedStringFromRange match. We'll get that for free when we switch to use
     // TextIterator in _web_attributedStringFromRange.
     // See <rdar://problem/5428427> for an example of how this mismatch will cause problems.
-    if (m_lastTextNode && shouldEmitNewlineAfterNode(*m_node)) {
+    if (m_lastTextNode && shouldEmitNewlineAfterNode(*m_node, m_behavior & TextIteratorEmitsCharactersBetweenAllVisiblePositions)) {
         // use extra newline to represent margin bottom, as needed
         bool addNewline = shouldEmitExtraNewlineForNode(*m_node);