Merged anonymous blocks should invalidate simple line layout path.

alanbaradlay · alanbaradlay · commit ab5ea5036d6c · 2015-05-19T17:49:40.000Z
https://bugs.webkit.org/show_bug.cgi?id=145104 rdar://problem/20980930 Reviewed by Antti Koivisto. When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout. This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path. Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout. Source/WebCore: Test: fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html * rendering/RenderElement.cpp: (WebCore::RenderElement::insertChildInternal): LayoutTests: * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt: Added. * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html: Added. Canonical link: https://commits.webkit.org/163176@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@184577 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,18 @@
+2015-05-19  Zalan Bujtas  <zalan@apple.com>
+
+        Merged anonymous blocks should invalidate simple line layout path.
+        https://bugs.webkit.org/show_bug.cgi?id=145104
+        rdar://problem/20980930
+
+        Reviewed by Antti Koivisto.
+
+        When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
+        This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
+        Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
+
+        * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt: Added.
+        * fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html: Added.
+
 2015-05-14  Chris Fleizach  <cfleizach@apple.com>
 
         AX: Select text mechanism returns results outside of text control regions
diff --git a/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt b/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout-expected.txt
@@ -0,0 +1,2 @@
+Pass if no crash or assert in debug.
+foo
diff --git a/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html b/LayoutTests/fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests when 2 anonymous blocks are merged and the 'to' block has simple line layout path.</title>
+</head>
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+</script>
+</head>
+<body>
+<div>Pass if no crash or assert in debug.</div>foo<div id="removethis"></div><span>
+<script>
+    document.body.offsetWidth;
+    var elem = document.getElementById("removethis");
+    elem.parentNode.removeChild(elem);
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2015-05-19  Zalan Bujtas  <zalan@apple.com>
+
+        Merged anonymous blocks should invalidate simple line layout path.
+        https://bugs.webkit.org/show_bug.cgi?id=145104
+        rdar://problem/20980930
+
+        Reviewed by Antti Koivisto.
+
+        When anonymous blocks are merged together, it's not guaranteed that the final block can use simple line layout.
+        This patch ensures that the flow block, where the other block's content gets moved to, is no longer on simple line layout path.
+        Whether the final flow block ends up using inline boxes or simple line layout will be determined during the next layout.
+
+        Test: fast/block/crash-when-anonymous-blocks-are-merged-with-simple-line-layout.html
+
+        * rendering/RenderElement.cpp:
+        (WebCore::RenderElement::insertChildInternal):
+
 2015-05-19  Beth Dakin  <bdakin@apple.com>
 
         Crash in WebCore::RenderLayer::updateScrollbarsAfterLayout
diff --git a/Source/WebCore/rendering/RenderElement.cpp b/Source/WebCore/rendering/RenderElement.cpp
@@ -593,6 +593,8 @@ void RenderElement::insertChildInternal(RenderObject* newChild, RenderObject* be
 
     if (AXObjectCache* cache = document().axObjectCache())
         cache->childrenChanged(this, newChild);
+    if (is<RenderBlockFlow>(*this))
+        downcast<RenderBlockFlow>(*this).invalidateLineLayoutPath();
 }
 
 void RenderElement::removeChildInternal(RenderObject& oldChild, NotifyChildrenType notifyChildren)

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Pass if no crash or assert in debug.`
	`2`	`+foo`
Original file line number	Diff line number	Diff line change
`@@ -593,6 +593,8 @@ void RenderElement::insertChildInternal(RenderObject* newChild, RenderObject* be`
`593`	`593`
`594`	`594`	`if (AXObjectCache* cache = document().axObjectCache())`
`595`	`595`	`cache->childrenChanged(this, newChild);`
	`596`	`+ if (is<RenderBlockFlow>(*this))`
	`597`	`+ downcast<RenderBlockFlow>(*this).invalidateLineLayoutPath();`
`596`	`598`	`}`
`597`	`599`
`598`	`600`	`void RenderElement::removeChildInternal(RenderObject& oldChild, NotifyChildrenType notifyChildren)`