has both :before, :after content.
https://bugs.webkit.org/show_bug.cgi?id=67656
Reviewed by James Robinson.
Source/WebCore:
Tests: fast/table/table-cell-before-after-content-around-table-block.html
fast/table/table-cell-before-after-content-around-table-row.html
fast/table/table-cell-before-after-content-around-table.html
fast/table/table-row-before-after-content-around-block.html
fast/table/table-row-before-after-content-around-table.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
1. Use the new helper functions findAfterContentRenderer,
anonymousContainer.
2. Rename anonymousChild to better name - beforeChildAnonymousContainer.
* rendering/RenderObject.cpp:
(WebCore::RenderObject::addChild):
When adding a new child, if beforeChild is a table part(
Table/TableSection/TableRow), we need to check if both
:before, :after content are shoved in one of the anonymous child.
If yes, we need to split the :before, :after content before adding
newChild. Easiest approach is to destroy the :before content, then add
the newChild and then call updateBeforeAfterContent to recreate the
:before content.
* rendering/RenderObject.h:
(WebCore::RenderObject::findBeforeContentRenderer): same as
beforePseudoElementRenderer, but ignores text childs since they are
sequentially added.
(WebCore::RenderObject::findAfterContentRenderer): same.
(WebCore::RenderObject::anonymousContainer):
(WebCore::objectIsRelayoutBoundary):
* rendering/RenderTable.cpp:
(WebCore::RenderTable::addChild): use the new helpers and functionally
correct functions - findAfterContentRenderer, anonymousContainer. previous
implementation was wrong since it would not go inside, if :after content
is embedded deeper than one level.
* rendering/RenderTableRow.cpp:
(WebCore::RenderTableRow::addChild): same.
* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::addChild): same.
LayoutTests:
* fast/table/table-cell-before-after-content-around-table-block-expected.png: Added.
* fast/table/table-cell-before-after-content-around-table-block-expected.txt: Added.
* fast/table/table-cell-before-after-content-around-table-block.html: Added.
* fast/table/table-cell-before-after-content-around-table-expected.png: Added.
* fast/table/table-cell-before-after-content-around-table-expected.txt: Added.
* fast/table/table-cell-before-after-content-around-table-row-expected.png: Added.
* fast/table/table-cell-before-after-content-around-table-row-expected.txt: Added.
* fast/table/table-cell-before-after-content-around-table-row.html: Added.
* fast/table/table-cell-before-after-content-around-table.html: Added.
* fast/table/table-row-before-after-content-around-block-expected.png: Added.
* fast/table/table-row-before-after-content-around-block-expected.txt: Added.
* fast/table/table-row-before-after-content-around-block.html: Added.
* fast/table/table-row-before-after-content-around-table-expected.png: Added.
* fast/table/table-row-before-after-content-around-table-expected.txt: Added.
* fast/table/table-row-before-after-content-around-table.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@95461
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2011-09-16 Abhishek Arya <inferno@chromium.org>
+
+ Child not placed correctly when beforeChild (table part)
+ has both :before, :after content.
+ https://bugs.webkit.org/show_bug.cgi?id=67656
+
+ Reviewed by James Robinson.
+
+ * fast/table/table-cell-before-after-content-around-table-block-expected.png: Added.
+ * fast/table/table-cell-before-after-content-around-table-block-expected.txt: Added.
+ * fast/table/table-cell-before-after-content-around-table-block.html: Added.
+ * fast/table/table-cell-before-after-content-around-table-expected.png: Added.
+ * fast/table/table-cell-before-after-content-around-table-expected.txt: Added.
+ * fast/table/table-cell-before-after-content-around-table-row-expected.png: Added.
+ * fast/table/table-cell-before-after-content-around-table-row-expected.txt: Added.
+ * fast/table/table-cell-before-after-content-around-table-row.html: Added.
+ * fast/table/table-cell-before-after-content-around-table.html: Added.
+ * fast/table/table-row-before-after-content-around-block-expected.png: Added.
+ * fast/table/table-row-before-after-content-around-block-expected.txt: Added.
+ * fast/table/table-row-before-after-content-around-block.html: Added.
+ * fast/table/table-row-before-after-content-around-table-expected.png: Added.
+ * fast/table/table-row-before-after-content-around-table-expected.txt: Added.
+ * fast/table/table-row-before-after-content-around-table.html: Added.
+
2011-09-19 Tom Sepez <tsepez@chromium.org>
Fix xssauditor bypass with unterminated closing tag by making the HTMLSourceTracker
--- /dev/null
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x64
+ RenderBlock {HTML} at (0,0) size 800x64
+ RenderBody {BODY} at (8,8) size 784x48 [color=#0000FF]
+ RenderBlock {DIV} at (0,0) size 784x48
+ RenderTable at (0,0) size 64x16 [color=#000000]
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16
+ RenderTableCell (anonymous) at (0,0) size 64x16 [color=#0000FF] [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "ABCD"
+ RenderBlock {DIV} at (0,16) size 784x16
+ RenderText {#text} at (0,0) size 64x16
+ text run at (0,0) width 64: "1234"
+ RenderTable at (0,32) size 64x16 [color=#000000]
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16
+ RenderTableCell (anonymous) at (0,0) size 64x16 [color=#0000FF] [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "EFGH"
--- /dev/null
+<!DOCTYPE html>\r
+<!-- Test passes if you see three blue boxes in three seperate rows. -->\r
+<html style="font: 1em/1 Ahem, sans-serif;">\r
+<style type="text/css">\r
+.container:before {\r
+ content: "ABCD";\r
+ display: table-cell;\r
+}\r
+\r
+.container:after {\r
+ content: "EFGH";\r
+ display: table-cell;\r
+}\r
+\r
+</style>\r
+</head>\r
+<body>\r
+<div class="container">\r
+<div style="display: block">1234</div>\r
+</div>\r
+<script>\r
+document.body.offsetTop;\r
+document.body.style.color = 'blue';\r
+</script>\r
+</html>\r
--- /dev/null
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x64
+ RenderBlock {HTML} at (0,0) size 800x64
+ RenderBody {BODY} at (8,8) size 784x48 [color=#0000FF]
+ RenderBlock {DIV} at (0,0) size 784x48
+ RenderTable at (0,0) size 64x16 [color=#000000]
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16
+ RenderTableCell (anonymous) at (0,0) size 64x16 [color=#0000FF] [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "ABCD"
+ RenderTable {DIV} at (0,16) size 64x16
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16
+ RenderTableCell (anonymous) at (0,0) size 64x16 [r=0 c=0 rs=1 cs=1]
+ RenderText {#text} at (0,0) size 64x16
+ text run at (0,0) width 64: "1234"
+ RenderTable at (0,32) size 64x16 [color=#000000]
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16
+ RenderTableCell (anonymous) at (0,0) size 64x16 [color=#0000FF] [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "EFGH"
--- /dev/null
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x64
+ RenderBlock {HTML} at (0,0) size 800x64
+ RenderBody {BODY} at (8,8) size 784x48 [color=#0000FF]
+ RenderTable {DIV} at (0,0) size 64x48
+ RenderTableSection (anonymous) at (0,0) size 64x48
+ RenderTableRow (anonymous) at (0,0) size 64x16
+ RenderTableCell (anonymous) at (0,0) size 64x16 [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "ABCD"
+ RenderTableRow {DIV} at (0,16) size 64x16
+ RenderTableCell (anonymous) at (0,16) size 64x16 [r=1 c=0 rs=1 cs=1]
+ RenderText {#text} at (0,0) size 64x16
+ text run at (0,0) width 64: "1234"
+ RenderTableRow (anonymous) at (0,32) size 64x16
+ RenderTableCell (anonymous) at (0,32) size 64x16 [r=2 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "EFGH"
--- /dev/null
+<!DOCTYPE html>\r
+<!-- Test passes if you see three blue boxes in three seperate rows. -->\r
+<html style="font: 1em/1 Ahem, sans-serif;">\r
+<style type="text/css">\r
+.container:before {\r
+ content: "ABCD";\r
+ display: table-cell;\r
+}\r
+\r
+.container:after {\r
+ content: "EFGH";\r
+ display: table-cell;\r
+}\r
+\r
+</style>\r
+</head>\r
+<body>\r
+<div class="container" style="display:table">\r
+<div style="display:table-row">1234</div>\r
+</div>\r
+<script>\r
+document.body.offsetTop;\r
+document.body.style.color = 'blue';\r
+</script>\r
+</html>\r
--- /dev/null
+<!DOCTYPE html>\r
+<!-- Test passes if you see three blue boxes in three seperate rows. -->\r
+<html style="font: 1em/1 Ahem, sans-serif;">\r
+<style type="text/css">\r
+.container:before {\r
+ content: "ABCD";\r
+ display: table-cell;\r
+}\r
+\r
+.container:after {\r
+ content: "EFGH";\r
+ display: table-cell;\r
+}\r
+\r
+</style>\r
+</head>\r
+<body>\r
+<div class="container">\r
+<div style="display: table">1234</div>\r
+</div>\r
+<script>\r
+document.body.offsetTop;\r
+document.body.style.color = 'blue';\r
+</script>\r
+</body>\r
+</html>\r
--- /dev/null
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x64
+ RenderBlock {HTML} at (0,0) size 800x64
+ RenderBody {BODY} at (8,8) size 784x48 [color=#0000FF]
+ RenderBlock {DIV} at (0,0) size 784x48
+ RenderTable at (0,0) size 64x16 [color=#000000]
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16 [color=#0000FF]
+ RenderTableCell (anonymous) at (0,0) size 64x16 [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "ABCD"
+ RenderBlock {DIV} at (0,16) size 784x16
+ RenderText {#text} at (0,0) size 64x16
+ text run at (0,0) width 64: "1234"
+ RenderTable at (0,32) size 64x16 [color=#000000]
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16 [color=#0000FF]
+ RenderTableCell (anonymous) at (0,0) size 64x16 [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "EFGH"
--- /dev/null
+<!DOCTYPE html>
+<!-- Test passes if you see three blue boxes in three seperate rows. -->
+<html style="font: 1em/1 Ahem, sans-serif;">
+<style type="text/css">
+.container:before
+{
+ content: "ABCD";
+ display: table-row;
+}
+
+.container:after
+{
+ content: "EFGH";
+ display: table-row;
+}
+
+</style>
+</head>
+<body>
+<div class="container">
+<div style="display: block">1234</div>
+</div>
+<script>
+document.body.offsetTop;
+document.body.style.color = 'blue';
+</script>
+</html>
--- /dev/null
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x64
+ RenderBlock {HTML} at (0,0) size 800x64
+ RenderBody {BODY} at (8,8) size 784x48 [color=#0000FF]
+ RenderBlock {DIV} at (0,0) size 784x48
+ RenderTable at (0,0) size 64x16 [color=#000000]
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16 [color=#0000FF]
+ RenderTableCell (anonymous) at (0,0) size 64x16 [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "ABCD"
+ RenderTable {DIV} at (0,16) size 64x16
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16
+ RenderTableCell (anonymous) at (0,0) size 64x16 [r=0 c=0 rs=1 cs=1]
+ RenderText {#text} at (0,0) size 64x16
+ text run at (0,0) width 64: "1234"
+ RenderTable at (0,32) size 64x16 [color=#000000]
+ RenderTableSection (anonymous) at (0,0) size 64x16
+ RenderTableRow (anonymous) at (0,0) size 64x16 [color=#0000FF]
+ RenderTableCell (anonymous) at (0,0) size 64x16 [r=0 c=0 rs=1 cs=1]
+ RenderText at (0,0) size 64x16
+ text run at (0,0) width 64: "EFGH"
--- /dev/null
+<!DOCTYPE html>
+<!-- Test passes if you see three blue boxes in three seperate rows. -->
+<html style="font: 1em/1 Ahem, sans-serif;">
+<style type="text/css">
+.container:before
+{
+ content: "ABCD";
+ display: table-row;
+}
+
+.container:after
+{
+ content: "EFGH";
+ display: table-row;
+}
+
+</style>
+</head>
+<body>
+<div class="container">
+<div style="display: table">1234</div>
+</div>
+<script>
+document.body.offsetTop;
+document.body.style.color = 'blue';
+</script>
+</html>
+2011-09-16 Abhishek Arya <inferno@chromium.org>
+
+ Child not placed correctly when beforeChild (table part)
+ has both :before, :after content.
+ https://bugs.webkit.org/show_bug.cgi?id=67656
+
+ Reviewed by James Robinson.
+
+ Tests: fast/table/table-cell-before-after-content-around-table-block.html
+ fast/table/table-cell-before-after-content-around-table-row.html
+ fast/table/table-cell-before-after-content-around-table.html
+ fast/table/table-row-before-after-content-around-block.html
+ fast/table/table-row-before-after-content-around-table.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+ 1. Use the new helper functions findAfterContentRenderer,
+ anonymousContainer.
+ 2. Rename anonymousChild to better name - beforeChildAnonymousContainer.
+ * rendering/RenderObject.cpp:
+ (WebCore::RenderObject::addChild):
+ When adding a new child, if beforeChild is a table part(
+ Table/TableSection/TableRow), we need to check if both
+ :before, :after content are shoved in one of the anonymous child.
+ If yes, we need to split the :before, :after content before adding
+ newChild. Easiest approach is to destroy the :before content, then add
+ the newChild and then call updateBeforeAfterContent to recreate the
+ :before content.
+ * rendering/RenderObject.h:
+ (WebCore::RenderObject::findBeforeContentRenderer): same as
+ beforePseudoElementRenderer, but ignores text childs since they are
+ sequentially added.
+ (WebCore::RenderObject::findAfterContentRenderer): same.
+ (WebCore::RenderObject::anonymousContainer):
+ (WebCore::objectIsRelayoutBoundary):
+ * rendering/RenderTable.cpp:
+ (WebCore::RenderTable::addChild): use the new helpers and functionally
+ correct functions - findAfterContentRenderer, anonymousContainer. previous
+ implementation was wrong since it would not go inside, if :after content
+ is embedded deeper than one level.
+ * rendering/RenderTableRow.cpp:
+ (WebCore::RenderTableRow::addChild): same.
+ * rendering/RenderTableSection.cpp:
+ (WebCore::RenderTableSection::addChild): same.
+
2011-09-19 Robert Kroeger <rjkroege@chromium.org>
[chromium] Gesture recognizer fires taptype only every other touch
void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild, RenderObject* beforeChild)
{
// Make sure we don't append things after :after-generated content if we have it.
- if (!beforeChild) {
- RenderObject* lastRenderer = lastChild();
- while (lastRenderer && lastRenderer->isAnonymous() && !isAfterContent(lastRenderer))
- lastRenderer = lastRenderer->lastChild();
- if (lastRenderer && isAfterContent(lastRenderer))
- beforeChild = lastRenderer;
- }
+ if (!beforeChild)
+ beforeChild = findAfterContentRenderer();
// If the requested beforeChild is not one of our children, then this is because
// there is an anonymous container within this object that contains the beforeChild.
if (beforeChild && beforeChild->parent() != this) {
- RenderObject* anonymousChild = beforeChild->parent();
- ASSERT(anonymousChild);
-
- while (anonymousChild->parent() != this)
- anonymousChild = anonymousChild->parent();
-
- ASSERT(anonymousChild->isAnonymous());
+ RenderObject* beforeChildAnonymousContainer = anonymousContainer(beforeChild);
+ ASSERT(beforeChildAnonymousContainer);
+ ASSERT(beforeChildAnonymousContainer->isAnonymous());
- if (anonymousChild->isAnonymousBlock()) {
+ if (beforeChildAnonymousContainer->isAnonymousBlock()) {
// Insert the child into the anonymous block box instead of here.
if (newChild->isInline() || beforeChild->parent()->firstChild() != beforeChild)
beforeChild->parent()->addChild(newChild, beforeChild);
return;
}
- ASSERT(anonymousChild->isTable());
+ ASSERT(beforeChildAnonymousContainer->isTable());
if ((newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP)
|| (newChild->isRenderBlock() && newChild->style()->display() == TABLE_CAPTION)
|| newChild->isTableSection()
|| newChild->isTableRow()
|| newChild->isTableCell()) {
// Insert into the anonymous table.
- anonymousChild->addChild(newChild, beforeChild);
+ beforeChildAnonymousContainer->addChild(newChild, beforeChild);
return;
}
// Go on to insert before the anonymous table.
- beforeChild = anonymousChild;
+ beforeChild = beforeChildAnonymousContainer;
}
// Check for a spanning element in columns.
if (!children)
return;
+ RenderObject* beforeContent = 0;
+ bool beforeChildHasBeforeAndAfterContent = false;
+ if (beforeChild && (beforeChild->isTable() || beforeChild->isTableSection() || beforeChild->isTableRow())) {
+ beforeContent = beforeChild->findBeforeContentRenderer();
+ RenderObject* afterContent = beforeChild->findAfterContentRenderer();
+ if (beforeContent && afterContent) {
+ beforeChildHasBeforeAndAfterContent = true;
+ beforeContent->destroy();
+ }
+ }
+
bool needsTable = false;
if (newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP)
// Just add it...
children->insertChildNode(this, newChild, beforeChild);
}
+
if (newChild->isText() && newChild->style()->textTransform() == CAPITALIZE) {
RefPtr<StringImpl> textToTransform = toRenderText(newChild)->originalText();
if (textToTransform)
toRenderText(newChild)->setText(textToTransform.release(), true);
}
+
+ if (beforeChildHasBeforeAndAfterContent)
+ children->updateBeforeAfterContent(this, BEFORE);
}
void RenderObject::removeChild(RenderObject* oldChild)
static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
static inline bool isBeforeOrAfterContent(const RenderObject* obj) { return obj && obj->isBeforeOrAfterContent(); }
+ inline RenderObject* findBeforeContentRenderer() const
+ {
+ RenderObject* renderer = beforePseudoElementRenderer();
+ return isBeforeContent(renderer) ? renderer : 0;
+ }
+
+ inline RenderObject* findAfterContentRenderer() const
+ {
+ RenderObject* renderer = afterPseudoElementRenderer();
+ return isAfterContent(renderer) ? renderer : 0;
+ }
+
+ inline RenderObject* anonymousContainer(RenderObject* child)
+ {
+ RenderObject* container = child;
+ while (container->parent() != this)
+ container = container->parent();
+
+ ASSERT(container->isAnonymous());
+ return container;
+ }
+
bool childrenInline() const { return m_childrenInline; }
void setChildrenInline(bool b = true) { m_childrenInline = b; }
bool hasColumns() const { return m_hasColumns; }
void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
{
// Make sure we don't append things after :after-generated content if we have it.
- if (!beforeChild && isAfterContent(lastChild()))
- beforeChild = lastChild();
+ if (!beforeChild) {
+ if (RenderObject* afterContentRenderer = findAfterContentRenderer())
+ beforeChild = anonymousContainer(afterContentRenderer);
+ }
bool wrapInAnonymousSection = !child->isPositioned();
void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
{
// Make sure we don't append things after :after-generated content if we have it.
- if (!beforeChild && isAfterContent(lastChild()))
- beforeChild = lastChild();
+ if (!beforeChild) {
+ if (RenderObject* afterContentRenderer = findAfterContentRenderer())
+ beforeChild = anonymousContainer(afterContentRenderer);
+ }
if (!child->isTableCell()) {
RenderObject* last = beforeChild;
void RenderTableSection::addChild(RenderObject* child, RenderObject* beforeChild)
{
// Make sure we don't append things after :after-generated content if we have it.
- if (!beforeChild && isAfterContent(lastChild()))
- beforeChild = lastChild();
+ if (!beforeChild) {
+ if (RenderObject* afterContentRenderer = findAfterContentRenderer())
+ beforeChild = anonymousContainer(afterContentRenderer);
+ }
if (!child->isTableRow()) {
RenderObject* last = beforeChild;
git://git.webkit.org / WebKit.git / commitdiff
