Attachment 393562 Details for Bug 209095 – Patch

[patch] Patch

bug-209095-20200313171829.patch (text/plain), 4.20 KB, created by alan on 2020-03-13 17:18:30 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: alan

Created: 2020-03-13 17:18:30 PDT

Size: 4.20 KB

patch

obsolete

>Subversion Revision: 258083
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 2663c4e68225006892a78473b8fbeb0f268258be..c76706bf8837b03d5394d63664195360c9e7c7b0 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,25 @@
>+2020-03-13  Zalan Bujtas  <zalan@apple.com>
>+
>+        [Tree building] Block::attachIgnoringContinuation should allow inline tables as before child container
>+        https://bugs.webkit.org/show_bug.cgi?id=209095
>+        <rdar://problem/59837588>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        It's perfectly valid to have an inline table as the anonymous container for the before child.
>+        It'll get wrapped inside an anonymous block right before we insert the block box candidate, so
>+        the final result will be something like:
>+
>+        new block level child (this is the child we are inserting)
>+        anonymous block wrapper
>+          inline table (this is the before child's inline container)
>+            before child 
>+
>+        Test: fast/table/before-child-is-inline-table.html
>+
>+        * rendering/updating/RenderTreeBuilderBlock.cpp:
>+        (WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation):
>+
> 2020-03-12  Zalan Bujtas  <zalan@apple.com>
> 
>         RenderTreeNeedsLayoutChecker asserts with imported/w3c/web-platform-tests/css/css-position/position-absolute-crash-chrome-005.html
>diff --git a/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp b/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
>index 9b74e0b8965030ccacca441e6fe402877371938f..2e2c82a239bfd7b070bffd54690dc9808974ea3d 100644
>--- a/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
>+++ b/Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
>@@ -173,7 +173,7 @@ void RenderTreeBuilder::Block::attachIgnoringContinuation(RenderBlock& parent, R
>                 m_builder.attach(parent, WTFMove(child), beforeChildContainer);
>                 return;
>             }
>-            RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!beforeChildContainer->isInline());
>+            RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!beforeChildContainer->isInline() || beforeChildContainer->isTable());
> 
>             // If the requested beforeChild is not one of our children, then this is because
>             // there is an anonymous container within this object that contains the beforeChild.
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index da121ba59a353fc0faa258fb0c933d9378570690..d38485050d1d391cf3fe6efbe91fa631ad77a549 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,14 @@
>+2020-03-13  Zalan Bujtas  <zalan@apple.com>
>+
>+        [Tree building] Block::attachIgnoringContinuation should allow inline tables as before child container
>+        https://bugs.webkit.org/show_bug.cgi?id=209095
>+        <rdar://problem/59837588>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * fast/table/before-child-is-inline-table-expected.txt: Added.
>+        * fast/table/before-child-is-inline-table.html: Added.
>+
> 2020-03-12  Zalan Bujtas  <zalan@apple.com>
> 
>         RenderTreeNeedsLayoutChecker asserts with imported/w3c/web-platform-tests/css/css-position/position-absolute-crash-chrome-005.html
>diff --git a/LayoutTests/fast/table/before-child-is-inline-table-expected.txt b/LayoutTests/fast/table/before-child-is-inline-table-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..166765e5d20797c47ba4f1f3b5a607d27113b05d
>--- /dev/null
>+++ b/LayoutTests/fast/table/before-child-is-inline-table-expected.txt
>@@ -0,0 +1 @@
>+Pass if no crash or assert.
>diff --git a/LayoutTests/fast/table/before-child-is-inline-table.html b/LayoutTests/fast/table/before-child-is-inline-table.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..b82a82222e23ce5078a2cb7a0131870bda9da924
>--- /dev/null
>+++ b/LayoutTests/fast/table/before-child-is-inline-table.html
>@@ -0,0 +1,18 @@
>+<style>
>+.table-caption {
>+    display: table-cell;
>+}
>+embed {
>+    padding-top: 1vw;
>+    display: block;
>+}
>+summary {
>+    display: inline;
>+}
>+</style>
>+<details><summary><embed type><div class=table-caption></div></summary></details>
>+Pass if no crash or assert.
>+<script>
>+if (window.testRunner)
>+    testRunner.dumpAsText();
>+</script>

Actions: View | Formatted Diff | Diff

Attachments on bug 209095: 393562