[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373
senorblanco at chromium.org
senorblanco at chromium.org
Thu Apr 8 01:08:29 UTC 2010
The following commit has been merged in the webkit-1.2 branch:
commit 3abf59c8eae38ffc260055da97591431c79b5f5b
Author: senorblanco at chromium.org <senorblanco at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu Jan 14 22:35:33 2010 +0000
WebCore: Fix for crash with gradient on table cell. Pass the correct
background object down to
RenderBoxModelObject::paintFillLayerExtended(). This also allowed a
rework of the fix to bug 18445 by passing the correct RenderObject
from RenderBox::paintRootBoxDecorations() down to
RenderBoxModelObject::paintFillLayerExtended().
https://bugs.webkit.org/show_bug.cgi?id=28426
Reviewed by mitz at webkit.org.
Covered by new layout test: LayoutTests/fast/gradients/crash-on-tr.html
* rendering/RenderBox.cpp:
(WebCore::RenderBox::paintFillLayers):
(WebCore::RenderBox::paintFillLayer):
* rendering/RenderBox.h:
Plumb through the correct background RenderObject.
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintFillLayerExtended):
Use the passed-in background RenderObject (if present) when painting background images. Remove the previous fix for bug 18445.
* rendering/RenderBoxModelObject.h:
Plumb through the correct background RenderObject.
* rendering/RenderTableCell.cpp:
Pass in the correct backgroundObject to paintFillLayers().
(WebCore::RenderTableCell::paintBackgroundsBehindCell):
LayoutTests: New layout test added to exercise fix for bug
http://bugs.webkit.org/show_bug.cgi?id=28426
Reviewed by mitz at webkit.org.
* fast/gradients/crash-on-tr-expected.txt: Added.
* fast/gradients/crash-on-tr.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53291 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 70af328..9168bd0 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2010-01-14 Stephen White <senorblanco at chromium.org>
+
+ Reviewed by mitz at webkit.org.
+
+ New layout test added to exercise fix for bug
+ http://bugs.webkit.org/show_bug.cgi?id=28426
+
+ * fast/gradients/crash-on-tr-expected.txt: Added.
+ * fast/gradients/crash-on-tr.html: Added.
+
2010-01-14 Evan Stade <estade at chromium.org>
Reviewed by Eric Seidel.
diff --git a/LayoutTests/fast/gradients/crash-on-tr-expected.txt b/LayoutTests/fast/gradients/crash-on-tr-expected.txt
new file mode 100644
index 0000000..751e426
--- /dev/null
+++ b/LayoutTests/fast/gradients/crash-on-tr-expected.txt
@@ -0,0 +1,4 @@
+This test should not crash (or ASSERT).
+There should also be a table cell with a gradient below.
+
+Gradient
diff --git a/LayoutTests/fast/gradients/crash-on-tr.html b/LayoutTests/fast/gradients/crash-on-tr.html
new file mode 100644
index 0000000..24b8cb0
--- /dev/null
+++ b/LayoutTests/fast/gradients/crash-on-tr.html
@@ -0,0 +1,21 @@
+<head>
+<style type="text/css">
+.f {
+ background:-webkit-gradient(linear, left top, left bottom, from(#E7E7E7), to(#CFCFCF));
+}
+</style>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+</script>
+</head>
+
+This test should not crash (or ASSERT).<p>
+
+There should also be a table cell with a gradient below.<p>
+
+<table
+<tr class="f">
+<td>Gradient</td>
+</tr>
+</table>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index febde8e..f6d8c06 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,32 @@
+2010-01-14 Stephen White <senorblanco at chromium.org>
+
+ Reviewed by mitz at webkit.org.
+
+ Fix for crash with gradient on table cell. Pass the correct
+ background object down to
+ RenderBoxModelObject::paintFillLayerExtended(). This also allowed a
+ rework of the fix to bug 18445 by passing the correct RenderObject
+ from RenderBox::paintRootBoxDecorations() down to
+ RenderBoxModelObject::paintFillLayerExtended().
+ https://bugs.webkit.org/show_bug.cgi?id=28426
+
+ Covered by new layout test: LayoutTests/fast/gradients/crash-on-tr.html
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::paintFillLayers):
+ (WebCore::RenderBox::paintFillLayer):
+ * rendering/RenderBox.h:
+ Plumb through the correct background RenderObject.
+ * rendering/RenderBoxModelObject.cpp:
+ (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+ Use the passed-in background RenderObject (if present) when painting background images. Remove the previous fix for bug 18445.
+ * rendering/RenderBoxModelObject.h:
+ Plumb through the correct background RenderObject.
+ * rendering/RenderTableCell.cpp:
+ Pass in the correct backgroundObject to paintFillLayers().
+
+ (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+
2010-01-14 Nate Chapin <japhet at chromium.org>
Reviewed by Dimitri Glazkov.
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index 0c3423c..b57121b 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -563,13 +563,14 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
{
const FillLayer* bgLayer = style()->backgroundLayers();
Color bgColor = style()->backgroundColor();
+ RenderObject* bodyObject = 0;
if (!style()->hasBackground() && node() && node()->hasTagName(HTMLNames::htmlTag)) {
// Locate the <body> element using the DOM. This is easier than trying
// to crawl around a render tree with potential :before/:after content and
// anonymous blocks created by inline <body> tags etc. We can locate the <body>
// render object very easily via the DOM.
HTMLElement* body = document()->body();
- RenderObject* bodyObject = (body && body->hasLocalName(bodyTag)) ? body->renderer() : 0;
+ bodyObject = (body && body->hasLocalName(bodyTag)) ? body->renderer() : 0;
if (bodyObject) {
bgLayer = bodyObject->style()->backgroundLayers();
bgColor = bodyObject->style()->backgroundColor();
@@ -597,7 +598,7 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
int bw = max(w + marginLeft() + marginRight() + borderLeft() + borderRight(), rw);
int bh = max(h + marginTop() + marginBottom() + borderTop() + borderBottom(), rh);
- paintFillLayers(paintInfo, bgColor, bgLayer, bx, by, bw, bh);
+ paintFillLayers(paintInfo, bgColor, bgLayer, bx, by, bw, bh, CompositeSourceOver, bodyObject);
if (style()->hasBorder() && style()->display() != INLINE)
paintBorder(paintInfo.context, tx, ty, w, h, style());
@@ -720,18 +721,18 @@ IntRect RenderBox::maskClipRect()
return result;
}
-void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op)
+void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op, RenderObject* backgroundObject)
{
if (!fillLayer)
return;
- paintFillLayers(paintInfo, c, fillLayer->next(), tx, ty, width, height, op);
- paintFillLayer(paintInfo, c, fillLayer, tx, ty, width, height, op);
+ paintFillLayers(paintInfo, c, fillLayer->next(), tx, ty, width, height, op, backgroundObject);
+ paintFillLayer(paintInfo, c, fillLayer, tx, ty, width, height, op, backgroundObject);
}
-void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op)
+void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int width, int height, CompositeOperator op, RenderObject* backgroundObject)
{
- paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, width, height, 0, op);
+ paintFillLayerExtended(paintInfo, c, fillLayer, tx, ty, width, height, 0, op, backgroundObject);
}
void RenderBox::imageChanged(WrappedImagePtr image, const IntRect*)
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index 302b443..d91dd1d 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -305,8 +305,8 @@ protected:
virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
virtual void updateBoxModelInfoFromStyle();
- void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
- void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver);
+ void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator op, RenderObject* backgroundObject);
+ void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, CompositeOperator = CompositeSourceOver, RenderObject* backgroundObject = 0);
void paintMaskImages(const PaintInfo&, int tx, int ty, int width, int height);
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index 98960e0..ad52aa6 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -304,7 +304,7 @@ int RenderBoxModelObject::paddingRight(bool) const
}
-void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op)
+void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, const Color& c, const FillLayer* bgLayer, int tx, int ty, int w, int h, InlineFlowBox* box, CompositeOperator op, RenderObject* backgroundObject)
{
GraphicsContext* context = paintInfo.context;
bool includeLeftEdge = box ? box->includeLeftEdge() : true;
@@ -463,20 +463,7 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
if (!destRect.isEmpty()) {
phase += destRect.location() - destOrigin;
CompositeOperator compositeOp = op == CompositeSourceOver ? bgLayer->composite() : op;
- RenderObject* clientForBackgroundImage = this;
- // Check if this is the root element painting a background layer propagated from <body>,
- // and pass the body's renderer as the client in that case.
- if (isRoot && !style()->hasBackground()) {
- ASSERT(node()->hasTagName(htmlTag));
- HTMLElement* body = document()->body();
- ASSERT(body);
- ASSERT(body->hasLocalName(bodyTag));
- ASSERT(body->renderer());
- if (body) {
- if (RenderObject* bodyRenderer = body->renderer())
- clientForBackgroundImage = bodyRenderer;
- }
- }
+ RenderObject* clientForBackgroundImage = backgroundObject ? backgroundObject : this;
context->drawTiledImage(bg->image(clientForBackgroundImage, tileSize), style()->colorSpace(), destRect, phase, tileSize, compositeOp);
}
}
diff --git a/WebCore/rendering/RenderBoxModelObject.h b/WebCore/rendering/RenderBoxModelObject.h
index c9a4a0a..fae866c 100644
--- a/WebCore/rendering/RenderBoxModelObject.h
+++ b/WebCore/rendering/RenderBoxModelObject.h
@@ -90,7 +90,7 @@ public:
void paintBorder(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, bool begin = true, bool end = true);
bool paintNinePieceImage(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, const NinePieceImage&, CompositeOperator = CompositeSourceOver);
void paintBoxShadow(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, ShadowStyle, bool begin = true, bool end = true);
- void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver);
+ void paintFillLayerExtended(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int width, int height, InlineFlowBox* = 0, CompositeOperator = CompositeSourceOver, RenderObject* backgroundObject = 0);
// The difference between this inline's baseline position and the line's baseline position.
int verticalPosition(bool firstLine) const;
diff --git a/WebCore/rendering/RenderTableCell.cpp b/WebCore/rendering/RenderTableCell.cpp
index 15459ce..538dc3f 100644
--- a/WebCore/rendering/RenderTableCell.cpp
+++ b/WebCore/rendering/RenderTableCell.cpp
@@ -818,7 +818,7 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
paintInfo.context->save();
paintInfo.context->clip(clipRect);
}
- paintFillLayers(paintInfo, c, bgLayer, tx, ty, w, h);
+ paintFillLayers(paintInfo, c, bgLayer, tx, ty, w, h, CompositeSourceOver, backgroundObject);
if (shouldClip)
paintInfo.context->restore();
}
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list