isAnonymousInlineBlock() should exclude any ruby content.

https://bugs.webkit.org/show_bug.cgi?id=152648
<rdar://problem/23872549>

Reviewed by David Hyatt.

isAnonymousInlineBlock is designed for the new Block-Inside-Inline Model
and all other anonymous inline-block renderers (including Ruby) should bail out of it.
(see webkit.org/b/143145)

Source/WebCore:

Test: fast/ruby/ruby-inline-margin-collapse-crash.html

* rendering/RenderObject.cpp:
(WebCore::RenderObject::isAnonymousInlineBlock):
* rendering/RenderObject.h:
(WebCore::RenderObject::isAnonymousInlineBlock): Deleted.

LayoutTests:

* fast/ruby/ruby-inline-margin-collapse-crash-expected.txt: Added.
* fast/ruby/ruby-inline-margin-collapse-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194638 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index d3cd275..d01583f 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,18 @@
+2016-01-06  Zalan Bujtas  <zalan@apple.com>
+
+        isAnonymousInlineBlock() should exclude any ruby content.
+        https://bugs.webkit.org/show_bug.cgi?id=152648
+        <rdar://problem/23872549>
+
+        Reviewed by David Hyatt.
+
+        isAnonymousInlineBlock is designed for the new Block-Inside-Inline Model
+        and all other anonymous inline-block renderers (including Ruby) should bail out of it.
+        (see webkit.org/b/143145)
+
+        * fast/ruby/ruby-inline-margin-collapse-crash-expected.txt: Added.
+        * fast/ruby/ruby-inline-margin-collapse-crash.html: Added.
+
 2016-01-06  Andy VanWagoner  <thetalecrafter@gmail.com>
 
         [ES6] Date.prototype should be a plain object

diff --git a/LayoutTests/fast/ruby/ruby-inline-margin-collapse-crash-expected.txt b/LayoutTests/fast/ruby/ruby-inline-margin-collapse-crash-expected.txt
new file mode 100644 (file)
index 0000000..05917c9
--- /dev/null
+++ b/LayoutTests/fast/ruby/ruby-inline-margin-collapse-crash-expected.txt
@@ -0,0 +1 @@
+Pass if no crash or assert in debug.

diff --git a/LayoutTests/fast/ruby/ruby-inline-margin-collapse-crash.html b/LayoutTests/fast/ruby/ruby-inline-margin-collapse-crash.html
new file mode 100644 (file)
index 0000000..3d95e0f
--- /dev/null
+++ b/LayoutTests/fast/ruby/ruby-inline-margin-collapse-crash.html
@@ -0,0 +1,11 @@
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+</script>
+<style>
+    ruby:after {
+        display: block;
+        content: "bar";
+    }
+</style>
+Pass if no crash or assert in debug.<ruby>

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index dc7e2cf..0f54cb8 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,22 @@
+2016-01-06  Zalan Bujtas  <zalan@apple.com>
+
+        isAnonymousInlineBlock() should exclude any ruby content.
+        https://bugs.webkit.org/show_bug.cgi?id=152648
+        <rdar://problem/23872549>
+
+        Reviewed by David Hyatt.
+
+        isAnonymousInlineBlock is designed for the new Block-Inside-Inline Model
+        and all other anonymous inline-block renderers (including Ruby) should bail out of it.
+        (see webkit.org/b/143145)
+
+        Test: fast/ruby/ruby-inline-margin-collapse-crash.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::isAnonymousInlineBlock):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAnonymousInlineBlock): Deleted.
+
 2016-01-05  Zalan Bujtas  <zalan@apple.com>
 
         showRenderTree: add inline-block/inline/block column.

diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index a9f48ab..8c58d33 100644 (file)
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -57,6 +57,7 @@
 #include "RenderMultiColumnFlowThread.h"
 #include "RenderNamedFlowFragment.h"
 #include "RenderNamedFlowThread.h" 
+#include "RenderRuby.h"
 #include "RenderSVGResourceContainer.h"
 #include "RenderScrollbarPart.h"
 #include "RenderTableRow.h"
@@ -1734,6 +1735,11 @@ bool RenderObject::isComposited() const
     return hasLayer() && downcast<RenderLayerModelObject>(*this).layer()->isComposited();
 }
 
+bool RenderObject::isAnonymousInlineBlock() const
+{
+    return isAnonymous() && style().display() == INLINE_BLOCK && style().styleType() == NOPSEUDO && isRenderBlockFlow() && !isRubyRun() && !isRubyBase() && !isRuby(parent());
+}
+
 bool RenderObject::hitTest(const HitTestRequest& request, HitTestResult& result, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestFilter hitTestFilter)
 {
     bool inside = false;

diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 8647314..dfb1393 100644 (file)
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -472,11 +472,7 @@ public:
 #endif
             ;
     }
-    bool isAnonymousInlineBlock() const
-    {
-        return isAnonymous() && style().display() == INLINE_BLOCK && style().styleType() == NOPSEUDO && isRenderBlockFlow() && !isRubyRun() && !isRubyBase();
-    }
-
+    bool isAnonymousInlineBlock() const;
     bool isElementContinuation() const { return node() && node()->renderer() != this; }
     bool isInlineElementContinuation() const { return isElementContinuation() && isInline(); }
     bool isBlockElementContinuation() const { return isElementContinuation() && !isInline(); }