Once <object> is hidden, its content won't be displayed again if its URL has fragment...
authordbates@webkit.org <dbates@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 10 Aug 2018 17:39:53 +0000 (17:39 +0000)
committerdbates@webkit.org <dbates@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 10 Aug 2018 17:39:53 +0000 (17:39 +0000)
commit13c020654586a2d888de4d8991db3dfc603c760b
tree4264b247109efb7d776f57c020643e86dd3a9a7c
parent1ab2a3136bd2dcb64d3fa97c5b350ee91c47bd53
Once <object> is hidden, its content won't be displayed again if its URL has fragment identifier ("#").
https://bugs.webkit.org/show_bug.cgi?id=187990

Reviewed by Simon Fraser.

Source/WebCore:

Fixes an issue where an HTML object element that behaves like an iframe and references a resource
whose URL contains a fragment would not be repainted when its CSS display property changes.

Rendering of an <object> that behaves like an iframe is handled by a widget (FrameView). When
the CSS display property for an <object> is set to "none" we detach the widget from its renderer
as part of destroying the render tree for the <object>. Subsequently changing the CSS display
to a non-"none"/"contents" value will create a new renderer for <object> R. For an <object> that
behaves like an iframe, we navigate to the resource associated with the <object> reusing the
existing Frame F object created when we first displayed the <object>. Unlike the case where
the URL of the resource does not contain a fragment, navigating to a fragment in the same document
uses a different code path that does not re-associate the FrameView of F with R before it scrolls
the view; => the FrameView of F is not in the view hierarchy. Therefore we do not paint anything
for the content of the <object> and hence the scroll is not observable. Instead we need to ensure
that the FrameView of F installed in the view hierarchy when navigating to an anchor in the same
document.

As a side benefit of this fix we now also repaint an <object> that is programmatically navigated
to a different anchor in the same document.

Tests: fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html
       fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadInSameDocument):

LayoutTests:

Add tests to ensure that we repaint an <object>, whose resource URL contains a fragment, when
its CSS display property changes as well as when its navigated to a different anchor in the same
document.

* fast/repaint/object-as-iframe-hide-and-show-document-at-anchor-expected.txt: Added.
* fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html: Added.
* fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint-expected.txt: Added.
* fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html: Added.
* fast/repaint/resources/red-square-on-top-of-green-square.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234762 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/repaint/object-as-iframe-hide-and-show-document-at-anchor-expected.txt [new file with mode: 0644]
LayoutTests/fast/repaint/object-as-iframe-hide-and-show-document-at-anchor.html [new file with mode: 0644]
LayoutTests/fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint-expected.txt [new file with mode: 0644]
LayoutTests/fast/repaint/object-as-iframe-navigate-to-same-document-anchor-repaint.html [new file with mode: 0644]
LayoutTests/fast/repaint/resources/red-square-on-top-of-green-square.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/loader/FrameLoader.cpp