[webkit-changes] [WebKit/WebKit] c3bc98: Fix spanner reset logic

[Rob Buis]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: c3bc98d2edafe692e7aa90fa8d6c188e4c7b0168
      https://github.com/WebKit/WebKit/commit/c3bc98d2edafe692e7aa90fa8d6c188e4c7b0168
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2023-05-22 (Mon, 22 May 2023)

  Changed paths:
    A LayoutTests/fast/multicol/crash-when-constructing-nested-columns2-expected.txt
    A LayoutTests/fast/multicol/crash-when-constructing-nested-columns2.html
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp

  Log Message:
  -----------
  Fix spanner reset logic
https://bugs.webkit.org/show_bug.cgi?id=245374
rdar://98438399

Reviewed by Alan Baradlay.

In restoreColumnSpannersForContainer we want to reset the spanners to their original position
and remove the placeholders, however in some cases the attach step will call multiColumnDescendantInserted
and re-insert placeholders. To fix this, prevent calling the spanner processing logic by
multiColumnDescendantInserted by introducing a new flag gRestoringColumnSpannersForContainer.

* LayoutTests/fast/multicol/crash-when-constructing-nested-columns2-expected.txt: Added.
* LayoutTests/fast/multicol/crash-when-constructing-nested-columns2.html: Added.
* Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::restoreColumnSpannersForContainer):
(WebCore::RenderTreeBuilder::MultiColumn::multiColumnDescendantInserted):
(WebCore::RenderTreeBuilder::MultiColumn::processPossibleSpannerDescendant):

Originally-landed-as: 260286.15 at webkit-2023.2-embargoed (028f984310b6). https://bugs.webkit.org/show_bug.cgi?id=245374
Canonical link: https://commits.webkit.org/264361@main


  Commit: 18b93e6b5e09f167e09d9ac7770996e3760e2cb5
      https://github.com/WebKit/WebKit/commit/18b93e6b5e09f167e09d9ac7770996e3760e2cb5
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2023-05-22 (Mon, 22 May 2023)

  Changed paths:
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderObject.h

  Log Message:
  -----------
  Improve isInsideMulticolumnFlow lambda for top-layer elements
https://bugs.webkit.org/show_bug.cgi?id=245374
rdar://98438399

Reviewed by Alan Baradlay.

Improve isInsideMulticolumnFlow lambda for top-layer elements.
Top-layer elements can skip many ancestors since the containing
block is the RenderView. So instead of checking the fragmentedFlowRoot
boundary, check the containing block fragmented flow state.

* Source/WebCore/rendering/RenderObject.cpp:
(WebCore::RenderObject::setFragmentedFlowStateIncludingDescendants):
(WebCore::RenderObject::initializeFragmentedFlowStateOnInsertion):
(WebCore::RenderObject::resetFragmentedFlowStateOnRemoval):
* Source/WebCore/rendering/RenderObject.h:

Originally-landed-as: 260286.14 at webkit-2023.2-embargoed (0888aabefd69). https://bugs.webkit.org/show_bug.cgi?id=245374
Canonical link: https://commits.webkit.org/264362@main


Compare: https://github.com/WebKit/WebKit/compare/92eaeb4b37d9...18b93e6b5e09