[webkit-changes] [WebKit/WebKit] 0ff58f: Fix traversal for moved out elements by mapping pl...

[Chirag Shah]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 0ff58f04d04d4c6b1aa1e2635dce38903db82f9a
      https://github.com/WebKit/WebKit/commit/0ff58f04d04d4c6b1aa1e2635dce38903db82f9a
  Author: Chirag M Shah <chirag_m_shah at apple.com>
  Date:   2023-01-25 (Wed, 25 Jan 2023)

  Changed paths:
    A LayoutTests/fast/rendering/render-multi-column-set-invalidate-crash-expected.txt
    A LayoutTests/fast/rendering/render-multi-column-set-invalidate-crash.html
    M Source/WebCore/rendering/RenderLayerModelObject.cpp
    M Source/WebCore/rendering/RenderMultiColumnFlow.cpp
    M Source/WebCore/rendering/RenderMultiColumnFlow.h
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp

  Log Message:
  -----------
  Fix traversal for moved out elements by mapping placeholders
https://bugs.webkit.org/show_bug.cgi?id=251126
rdar://94017781

Reviewed by Alan Baradlay.

Before this change, when we used to traverse the ancestor chain for
autoinline validation in
propagateRepaintToParentWithOutlineAutoIfNeeded, we just looked at the
direct parent of the moved out element. That was incorrect, because the
moved out elements have a placeholder inserted in their original
position and hence we need to look it up in the enclosing scope. This
change fixes that.

* LayoutTests/fast/rendering/render-multi-column-set-invalidate-crash-expected.txt: Added.
* LayoutTests/fast/rendering/render-multi-column-set-invalidate-crash.html: Added.
* Source/WebCore/rendering/RenderLayerModelObject.cpp:
(WebCore::RenderLayerModelObject::willBeRemovedFromTree):
* Source/WebCore/rendering/RenderMultiColumnFlow.cpp:
(WebCore::RenderMultiColumnFlow::findColumnSpannerPlaceholder const):
* Source/WebCore/rendering/RenderMultiColumnFlow.h:
* Source/WebCore/rendering/RenderObject.cpp:
(WebCore::RenderObject::propagateRepaintToParentWithOutlineAutoIfNeeded const):
* Source/WebCore/rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::detachFromRenderElement):

Canonical link: https://commits.webkit.org/259412@main