[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-10851-g50815da
inferno at chromium.org
inferno at chromium.org
Wed Dec 22 17:58:51 UTC 2010
The following commit has been merged in the debian/experimental branch:
commit f072ec1f8dc8f008bcf4e5de64bac7ceb12770fe
Author: inferno at chromium.org <inferno at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Fri Dec 3 21:44:21 2010 +0000
2010-11-30 Abhishek Arya <inferno at chromium.org>
Reviewed by Dave Hyatt.
Don't clone an anonymous block, instead create a new one in splitBlocks. Also,
when beforeChild is not in one of our children, then do the processing first
to get its anonymous container before calling splitBlocks.
https://bugs.webkit.org/show_bug.cgi?id=49928
Tests: fast/multicol/span/anonymous-before-child-parent-crash.html
fast/multicol/span/anonymous-split-block-crash.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::splitBlocks):
(WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
2010-12-03 Abhishek Arya <inferno at chromium.org>
Reviewed by Dave Hyatt.
Test passes if we do not crash in splitBlocks while working with anonymous
blocks.
https://bugs.webkit.org/show_bug.cgi?id=49928
* fast/multicol/span/anonymous-before-child-parent-crash.html: Added.
* fast/multicol/span/anonymous-split-block-crash.html: Added.
* platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.checksum: Added.
* platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.png: Added.
* platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.txt: Added.
* platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.checksum: Added.
* platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.png: Added.
* platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.txt: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@73296 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index b2a548d..92d0767 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,20 @@
+2010-12-03 Abhishek Arya <inferno at chromium.org>
+
+ Reviewed by Dave Hyatt.
+
+ Test passes if we do not crash in splitBlocks while working with anonymous
+ blocks.
+ https://bugs.webkit.org/show_bug.cgi?id=49928
+
+ * fast/multicol/span/anonymous-before-child-parent-crash.html: Added.
+ * fast/multicol/span/anonymous-split-block-crash.html: Added.
+ * platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.checksum: Added.
+ * platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.png: Added.
+ * platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.txt: Added.
+ * platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.checksum: Added.
+ * platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.png: Added.
+ * platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.txt: Added.
+
2010-12-03 Jessie Berlin <jberlin at apple.com>
Update the Windows results for controls-without-preload.html to make the bots green. Unreviewed.
diff --git a/LayoutTests/fast/multicol/span/anonymous-before-child-parent-crash.html b/LayoutTests/fast/multicol/span/anonymous-before-child-parent-crash.html
new file mode 100644
index 0000000..c4720fc
--- /dev/null
+++ b/LayoutTests/fast/multicol/span/anonymous-before-child-parent-crash.html
@@ -0,0 +1,31 @@
+<html>
+<style>
+div {
+ border: 5px solid maroon;
+ -webkit-column-count: 2;
+ width: 750px;
+ margin: 1em 0;
+}
+span {
+ display: block;
+ margin: 1em 0;
+}
+h2 {
+ -webkit-column-span: all;
+ background-color: #eeeeee;
+ color: black;
+}
+</style>
+<h2 id="base">PASS</h2>
+<div>
+<span id="one">
+Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Nulla varius enim ac mi. Curabitur sollicitudin felis quis lectus. Quisque adipiscing rhoncus sem. Proin nulla purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel orci sagittis aliquam. Cras convallis adipiscing sem. Nam nonummy enim. Nullam bibendum lobortis neque. Vestibulum velit orci, tempus euismod, pretium quis, interdum vitae, nulla. Phasellus eget ante et tortor condimentum vestibulum.
+Suspendisse hendrerit quam nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit amet, consectetuer adipiscing elit.<dl>
+</span>
+</div>
+<script>
+ one.insertBefore(document.getElementById('base').cloneNode(true), one.firstChild);
+ document.body.offsetTop;
+</script>
+</html>
+
diff --git a/LayoutTests/fast/multicol/span/anonymous-split-block-crash.html b/LayoutTests/fast/multicol/span/anonymous-split-block-crash.html
new file mode 100644
index 0000000..994a4c6
--- /dev/null
+++ b/LayoutTests/fast/multicol/span/anonymous-split-block-crash.html
@@ -0,0 +1,21 @@
+<html>
+<style>
+div {
+ border: 5px solid maroon;
+ -webkit-column-count: 2;
+ margin: 1em 0;
+}
+h2 {
+ -webkit-column-span: all;
+ background-color: #eeeeee;
+ color: black;
+}
+</style>
+<div>
+<junk>
+<h2>PASS</h2>
+Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Nulla varius enim ac mi. Curabitur sollicitudin felis quis lectus. Quisque adipiscing rhoncus sem. Proin nulla purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel orci sagittis aliquam. Cras convallis adipiscing sem. Nam nonummy enim. Nullam bibendum lobortis neque. Vestibulum velit orci, tempus euismod, pretium quis, interdum vitae, nulla. Phasellus eget ante et tortor condimentum vestibulum.
+Suspendisse hendrerit quam nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit amet, consectetuer adipiscing elit.
+</div>
+</html>
+
diff --git a/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.checksum b/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.checksum
new file mode 100644
index 0000000..ef80a41
--- /dev/null
+++ b/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.checksum
@@ -0,0 +1 @@
+3024713b0b5c71d68f6421e9f4ed0b5c
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.png b/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.png
new file mode 100644
index 0000000..8a4228f
Binary files /dev/null and b/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.png differ
diff --git a/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.txt b/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.txt
new file mode 100644
index 0000000..74bcd44
--- /dev/null
+++ b/LayoutTests/platform/mac/fast/multicol/span/anonymous-before-child-parent-crash-expected.txt
@@ -0,0 +1,31 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,8) size 784x576
+ RenderBlock {H2} at (0,0) size 784x28 [bgcolor=#EEEEEE]
+ RenderText {#text} at (0,0) size 58x28
+ text run at (0,0) width 58: "PASS"
+layer at (8,55) size 760x201
+ RenderBlock {DIV} at (0,47) size 760x201 [border: (5px solid #800000)]
+ RenderBlock (anonymous multi-column span) at (5,24) size 750x28
+ RenderBlock {H2} at (0,0) size 750x28 [bgcolor=#EEEEEE]
+ RenderText {#text} at (0,0) size 58x28
+ text run at (0,0) width 58: "PASS"
+layer at (13,126) size 750x109
+ RenderBlock (anonymous multi-column) at (5,71) size 750x109
+ RenderBlock {SPAN} at (0,0) size 367x199
+ RenderBlock (anonymous) at (0,0) size 367x199
+ RenderText {#text} at (0,0) size 362x199
+ text run at (0,0) width 354: "Lorem ipsum dolor sit amet, consectetuer adipiscing elit."
+ text run at (0,18) width 351: "Nulla varius enim ac mi. Curabitur sollicitudin felis quis"
+ text run at (0,36) width 325: "lectus. Quisque adipiscing rhoncus sem. Proin nulla"
+ text run at (0,54) width 358: "purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae"
+ text run at (0,72) width 343: "felis vel orci sagittis aliquam. Cras convallis adipiscing"
+ text run at (0,90) width 340: "sem. Nam nonummy enim. Nullam bibendum lobortis"
+ text run at (0,109) width 344: "neque. Vestibulum velit orci, tempus euismod, pretium"
+ text run at (0,127) width 343: "quis, interdum vitae, nulla. Phasellus eget ante et tortor"
+ text run at (0,145) width 343: "condimentum vestibulum. Suspendisse hendrerit quam"
+ text run at (0,163) width 362: "nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor"
+ text run at (0,181) width 229: "sit amet, consectetuer adipiscing elit."
+ RenderBlock {DL} at (0,215) size 367x0
diff --git a/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.checksum b/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.checksum
new file mode 100644
index 0000000..42f84c8
--- /dev/null
+++ b/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.checksum
@@ -0,0 +1 @@
+fe9772e50ad2ccd04fc52d051410c44d
\ No newline at end of file
diff --git a/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.png b/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.png
new file mode 100644
index 0000000..b84f6b5
Binary files /dev/null and b/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.png differ
diff --git a/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.txt b/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.txt
new file mode 100644
index 0000000..2ff0501
--- /dev/null
+++ b/LayoutTests/platform/mac/fast/multicol/span/anonymous-split-block-crash-expected.txt
@@ -0,0 +1,29 @@
+layer at (0,0) size 800x600
+ RenderView at (0,0) size 800x600
+layer at (0,0) size 800x600
+ RenderBlock {HTML} at (0,0) size 800x600
+ RenderBody {BODY} at (8,16) size 784x568
+layer at (8,16) size 784x184
+ RenderBlock {DIV} at (0,0) size 784x184 [border: (5px solid #800000)]
+ RenderBlock (anonymous multi-column span) at (5,132) size 774x28
+ RenderBlock {H2} at (0,0) size 774x28 [bgcolor=#EEEEEE]
+ RenderText {#text} at (0,0) size 58x28
+ text run at (0,0) width 58: "PASS"
+layer at (13,21) size 774x108
+ RenderBlock (anonymous multi-column) at (5,5) size 774x108
+ RenderBlock (anonymous) at (0,0) size 379x198
+ RenderInline {JUNK} at (0,0) size 369x198
+ RenderText {#text} at (0,0) size 0x0
+ RenderText {#text} at (0,0) size 369x198
+ text run at (0,0) width 354: "Lorem ipsum dolor sit amet, consectetuer adipiscing elit."
+ text run at (0,18) width 351: "Nulla varius enim ac mi. Curabitur sollicitudin felis quis"
+ text run at (0,36) width 368: "lectus. Quisque adipiscing rhoncus sem. Proin nulla purus,"
+ text run at (0,54) width 368: "vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel"
+ text run at (0,72) width 358: "orci sagittis aliquam. Cras convallis adipiscing sem. Nam"
+ text run at (0,90) width 318: "nonummy enim. Nullam bibendum lobortis neque."
+ text run at (0,108) width 332: "Vestibulum velit orci, tempus euismod, pretium quis,"
+ text run at (0,126) width 309: "interdum vitae, nulla. Phasellus eget ante et tortor"
+ text run at (0,144) width 369: "condimentum vestibulum. Suspendisse hendrerit quam nec"
+ text run at (0,162) width 354: "felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit"
+ text run at (0,180) width 211: "amet, consectetuer adipiscing elit."
+ RenderBlock (anonymous) at (0,198) size 379x0
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index e0834e0..32b4021 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2010-11-30 Abhishek Arya <inferno at chromium.org>
+
+ Reviewed by Dave Hyatt.
+
+ Don't clone an anonymous block, instead create a new one in splitBlocks. Also,
+ when beforeChild is not in one of our children, then do the processing first
+ to get its anonymous container before calling splitBlocks.
+ https://bugs.webkit.org/show_bug.cgi?id=49928
+
+ Tests: fast/multicol/span/anonymous-before-child-parent-crash.html
+ fast/multicol/span/anonymous-split-block-crash.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::splitBlocks):
+ (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+
2010-12-03 Mark Rowe <mrowe at apple.com>
Reviewed by Eric Seidel.
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index e00277c..63daf98 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -400,8 +400,13 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
RenderObject* beforeChild, RenderBoxModelObject* oldCont)
{
// Create a clone of this inline.
- RenderBlock* cloneBlock = clone();
- cloneBlock->setContinuation(oldCont);
+ RenderBlock* cloneBlock;
+ if (isAnonymousBlock())
+ cloneBlock = createAnonymousBlock();
+ else {
+ cloneBlock = clone();
+ cloneBlock->setContinuation(oldCont);
+ }
// Now take all of the children from beforeChild to the end and remove
// them from |this| and place them in the clone.
@@ -410,7 +415,8 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
moveChildrenTo(cloneBlock, beforeChild, 0);
// Hook |clone| up as the continuation of the middle block.
- middleBlock->setContinuation(cloneBlock);
+ if (!cloneBlock->isAnonymousBlock())
+ middleBlock->setContinuation(cloneBlock);
// We have been reparented and are now under the fromBlock. We need
// to walk up our block parent chain until we hit the containing anonymous columns block.
@@ -419,13 +425,13 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
RenderBoxModelObject* currChild = this;
while (curr && curr != fromBlock) {
- ASSERT(curr->isRenderBlock() && !curr->isAnonymousBlock());
+ ASSERT(curr->isRenderBlock());
RenderBlock* blockCurr = toRenderBlock(curr);
// Create a new clone.
RenderBlock* cloneChild = cloneBlock;
- cloneBlock = blockCurr->clone();
+ cloneBlock = blockCurr->isAnonymousBlock() ? blockCurr->createAnonymousBlock() : blockCurr->clone();
// Insert our child clone as the first child.
cloneBlock->children()->appendChildNode(cloneBlock, cloneChild);
@@ -623,41 +629,6 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
beforeChild = lastRenderer->lastChild();
}
- // Check for a spanning element in columns.
- RenderBlock* columnsBlockAncestor = columnsBlockForSpanningElement(newChild);
- if (columnsBlockAncestor) {
- // We are placing a column-span element inside a block.
- RenderBlock* newBox = createAnonymousColumnSpanBlock();
-
- if (columnsBlockAncestor != this) {
- // We are nested inside a multi-column element and are being split by the span. We have to break up
- // our block into continuations.
- RenderBoxModelObject* oldContinuation = continuation();
- setContinuation(newBox);
-
- // Someone may have put a <p> inside a <q>, causing a split. When this happens, the :after content
- // has to move into the inline continuation. Call updateBeforeAfterContent to ensure that our :after
- // content gets properly destroyed.
- bool isLastChild = (beforeChild == lastChild());
- if (document()->usesBeforeAfterRules())
- children()->updateBeforeAfterContent(this, AFTER);
- if (isLastChild && beforeChild != lastChild())
- beforeChild = 0; // We destroyed the last child, so now we need to update our insertion
- // point to be 0. It's just a straight append now.
-
- splitFlow(beforeChild, newBox, newChild, oldContinuation);
- return;
- }
-
- // We have to perform a split of this block's children. This involves creating an anonymous block box to hold
- // the column-spanning |newChild|. We take all of the children from before |newChild| and put them into
- // one anonymous columns block, and all of the children after |newChild| go into another anonymous block.
- makeChildrenAnonymousColumnBlocks(beforeChild, newBox, newChild);
- return;
- }
-
- bool madeBoxesNonInline = false;
-
// If the requested beforeChild is not one of our children, then this is because
// there is an anonymous container within this object that contains the beforeChild.
if (beforeChild && beforeChild->parent() != this) {
@@ -693,6 +664,41 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
beforeChild = anonymousChild;
}
+ // Check for a spanning element in columns.
+ RenderBlock* columnsBlockAncestor = columnsBlockForSpanningElement(newChild);
+ if (columnsBlockAncestor) {
+ // We are placing a column-span element inside a block.
+ RenderBlock* newBox = createAnonymousColumnSpanBlock();
+
+ if (columnsBlockAncestor != this) {
+ // We are nested inside a multi-column element and are being split by the span. We have to break up
+ // our block into continuations.
+ RenderBoxModelObject* oldContinuation = continuation();
+ setContinuation(newBox);
+
+ // Someone may have put a <p> inside a <q>, causing a split. When this happens, the :after content
+ // has to move into the inline continuation. Call updateBeforeAfterContent to ensure that our :after
+ // content gets properly destroyed.
+ bool isLastChild = (beforeChild == lastChild());
+ if (document()->usesBeforeAfterRules())
+ children()->updateBeforeAfterContent(this, AFTER);
+ if (isLastChild && beforeChild != lastChild())
+ beforeChild = 0; // We destroyed the last child, so now we need to update our insertion
+ // point to be 0. It's just a straight append now.
+
+ splitFlow(beforeChild, newBox, newChild, oldContinuation);
+ return;
+ }
+
+ // We have to perform a split of this block's children. This involves creating an anonymous block box to hold
+ // the column-spanning |newChild|. We take all of the children from before |newChild| and put them into
+ // one anonymous columns block, and all of the children after |newChild| go into another anonymous block.
+ makeChildrenAnonymousColumnBlocks(beforeChild, newBox, newChild);
+ return;
+ }
+
+ bool madeBoxesNonInline = false;
+
// A block has to either have all of its children inline, or all of its children as blocks.
// So, if our children are currently inline and a block child has to be inserted, we move all our
// inline children into anonymous block boxes.
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list