<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[162972] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/162972">162972</a></dd>
<dt>Author</dt> <dd>mmaxfield@apple.com</dd>
<dt>Date</dt> <dd>2014-01-28 15:36:04 -0800 (Tue, 28 Jan 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
https://bugs.webkit.org/show_bug.cgi?id=114586

Reviewed by Dave Hyatt.

Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8

If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
Instead, we should make it a subclass of RenderElement, so that it can be split properly.

Source/WebCore:

Test: fast/css-generated-content/quote-first-letter.html

* dom/PseudoElement.cpp:
(WebCore::PseudoElement::didRecalcStyle):
* rendering/RenderQuote.cpp:
(WebCore::RenderQuote::RenderQuote):
(WebCore::RenderQuote::willBeDestroyed):
(WebCore::RenderQuote::willBeRemovedFromTree):
(WebCore::RenderQuote::styleDidChange):
(WebCore::RenderQuote::updateText):
(WebCore::RenderQuote::computeText):
(WebCore::RenderQuote::updateDepth):
* rendering/RenderQuote.h:
* rendering/style/ContentData.cpp:
(WebCore::QuoteContentData::createContentRenderer):

LayoutTests:

This adds a test to make sure that the splitting behavior occurs, as well as updates existing tests that
didn't use the splitting behavior.

* fast/css-generated-content/quote-first-letter-expected.html: Added.
* fast/css-generated-content/quote-first-letter.html: Added.
* platform/mac/fast/css-generated-content/005-expected.txt:
* platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt:
* platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt:
* platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsplatformmacfastcssgeneratedcontent005expectedtxt">trunk/LayoutTests/platform/mac/fast/css-generated-content/005-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacfastcssgeneratedcontentbeforeAfterinterdocumentexpectedtxt">trunk/LayoutTests/platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacfastcssgeneratedcontentnestedtableswithbeforeaftercontentcrashexpectedtxt">trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacfastcssgeneratedcontentnoopenclosequoteexpectedtxt">trunk/LayoutTests/platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoredomPseudoElementcpp">trunk/Source/WebCore/dom/PseudoElement.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderImagecpp">trunk/Source/WebCore/rendering/RenderImage.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderImageh">trunk/Source/WebCore/rendering/RenderImage.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderQuotecpp">trunk/Source/WebCore/rendering/RenderQuote.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderQuoteh">trunk/Source/WebCore/rendering/RenderQuote.h</a></li>
<li><a href="#trunkSourceWebCorerenderingstyleContentDatacpp">trunk/Source/WebCore/rendering/style/ContentData.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingstyleRenderStylecpp">trunk/Source/WebCore/rendering/style/RenderStyle.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingstyleRenderStyleh">trunk/Source/WebCore/rendering/style/RenderStyle.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastcssgeneratedcontentquotefirstletterexpectedhtml">trunk/LayoutTests/fast/css-generated-content/quote-first-letter-expected.html</a></li>
<li><a href="#trunkLayoutTestsfastcssgeneratedcontentquotefirstletterhtml">trunk/LayoutTests/fast/css-generated-content/quote-first-letter.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/LayoutTests/ChangeLog        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -1,3 +1,25 @@
</span><ins>+2014-01-23  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
+
+        ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
+        https://bugs.webkit.org/show_bug.cgi?id=114586
+
+        Reviewed by Dave Hyatt.
+
+        Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8
+
+        If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
+        Instead, we should make it a subclass of RenderElement, so that it can be split properly.
+
+        This adds a test to make sure that the splitting behavior occurs, as well as updates existing tests that
+        didn't use the splitting behavior.
+
+        * fast/css-generated-content/quote-first-letter-expected.html: Added.
+        * fast/css-generated-content/quote-first-letter.html: Added.
+        * platform/mac/fast/css-generated-content/005-expected.txt:
+        * platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt:
+        * platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt:
+        * platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt:
+
</ins><span class="cx"> 2014-01-28  Carlos Alberto Lopez Perez  &lt;clopez@igalia.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed GTK gardening.
</span></span></pre></div>
<a id="trunkLayoutTestsfastcssgeneratedcontentquotefirstletterexpectedhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/css-generated-content/quote-first-letter-expected.html (0 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/css-generated-content/quote-first-letter-expected.html                                (rev 0)
+++ trunk/LayoutTests/fast/css-generated-content/quote-first-letter-expected.html        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;style&gt;
+    .quote { color: red; }
+    .line { position: absolute; top: 50px; left: 10px; }
+&lt;/style&gt;
+
+&quot; &quot;
+
+&lt;span class=&quot;line&quot;&gt;
+    &lt;span class=&quot;quote&quot;&gt;'&lt;/span&gt;Should not crash or assert and all four quotes should be displayed.'
+&lt;/span&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastcssgeneratedcontentquotefirstletterhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/css-generated-content/quote-first-letter.html (0 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/css-generated-content/quote-first-letter.html                                (rev 0)
+++ trunk/LayoutTests/fast/css-generated-content/quote-first-letter.html        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;style&gt;
+    .first-letter:first-letter { color: red; }
+    span { position: absolute; top: 50px; left: 10px; }
+&lt;/style&gt;
+
+&lt;q&gt;
+    &lt;span&gt;
+        &lt;q&gt;Should not crash or assert and all four quotes should be displayed.&lt;/q&gt;
+    &lt;/span&gt;
+&lt;/q&gt;
+
+&lt;script&gt;
+document.body.offsetTop;
+document.querySelector(&quot;span&quot;).className = 'first-letter';
+&lt;/script&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacfastcssgeneratedcontent005expectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/mac/fast/css-generated-content/005-expected.txt (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac/fast/css-generated-content/005-expected.txt        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/LayoutTests/platform/mac/fast/css-generated-content/005-expected.txt        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -7,7 +7,8 @@
</span><span class="cx">         RenderInline {Q} at (0,0) size 158x18
</span><span class="cx">           RenderInline (generated) at (0,0) size 7x18
</span><span class="cx">             RenderQuote at (0,0) size 7x18
</span><del>-              text run at (0,0) width 7: &quot;\&quot;&quot;
</del><ins>+              RenderText at (0,0) size 7x18
+                text run at (0,0) width 7: &quot;\&quot;&quot;
</ins><span class="cx">           RenderText {#text} at (7,0) size 151x18
</span><span class="cx">             text run at (7,0) width 151: &quot;Quotes should surround&quot;
</span><span class="cx">       RenderBlock (anonymous) at (0,34) size 784x0
</span><span class="lines">@@ -17,6 +18,7 @@
</span><span class="cx">           RenderText {#text} at (0,0) size 53x18
</span><span class="cx">             text run at (0,0) width 53: &quot;this text.&quot;
</span><span class="cx">           RenderInline (generated) at (0,0) size 7x18
</span><del>-            RenderQuote at (53,0) size 7x18
-              text run at (53,0) width 7: &quot;\&quot;&quot;
</del><ins>+            RenderQuote at (0,0) size 7x18
+              RenderText at (53,0) size 7x18
+                text run at (53,0) width 7: &quot;\&quot;&quot;
</ins><span class="cx">         RenderText {#text} at (0,0) size 0x0
</span></span></pre></div>
<a id="trunkLayoutTestsplatformmacfastcssgeneratedcontentbeforeAfterinterdocumentexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/LayoutTests/platform/mac/fast/css-generated-content/beforeAfter-interdocument-expected.txt        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -19,7 +19,8 @@
</span><span class="cx">           RenderInline {Q} at (0,0) size 158x18
</span><span class="cx">             RenderInline (generated) at (0,0) size 7x18
</span><span class="cx">               RenderQuote at (0,0) size 7x18
</span><del>-                text run at (0,0) width 7: &quot;\&quot;&quot;
</del><ins>+                RenderText at (0,0) size 7x18
+                  text run at (0,0) width 7: &quot;\&quot;&quot;
</ins><span class="cx">             RenderText {#text} at (7,0) size 151x18
</span><span class="cx">               text run at (7,0) width 151: &quot;Quotes should surround&quot;
</span><span class="cx">         RenderBlock (anonymous) at (0,34) size 784x0
</span><span class="lines">@@ -29,5 +30,6 @@
</span><span class="cx">             RenderText {#text} at (0,0) size 53x18
</span><span class="cx">               text run at (0,0) width 53: &quot;this text.&quot;
</span><span class="cx">             RenderInline (generated) at (0,0) size 7x18
</span><del>-              RenderQuote at (53,0) size 7x18
-                text run at (53,0) width 7: &quot;\&quot;&quot;
</del><ins>+              RenderQuote at (0,0) size 7x18
+                RenderText at (53,0) size 7x18
+                  text run at (53,0) width 7: &quot;\&quot;&quot;
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacfastcssgeneratedcontentnestedtableswithbeforeaftercontentcrashexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/LayoutTests/platform/mac/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -16,9 +16,11 @@
</span><span class="cx">                     RenderTableCell (anonymous) at (0,0) size 32x16 [r=0 c=0 rs=1 cs=1]
</span><span class="cx">                       RenderInline (generated) at (0,0) size 16x16
</span><span class="cx">                         RenderQuote at (0,0) size 16x16
</span><del>-                          text run at (0,0) width 16: &quot;\&quot;&quot;
</del><ins>+                          RenderText at (0,0) size 16x16
+                            text run at (0,0) width 16: &quot;\&quot;&quot;
</ins><span class="cx">                       RenderInline (generated) at (0,0) size 16x16
</span><del>-                        RenderQuote at (16,0) size 16x16
-                          text run at (16,0) width 16: &quot;\&quot;&quot;
</del><ins>+                        RenderQuote at (0,0) size 16x16
+                          RenderText at (16,0) size 16x16
+                            text run at (16,0) width 16: &quot;\&quot;&quot;
</ins><span class="cx">       RenderText {#text} at (0,0) size 0x0
</span><span class="cx">       RenderText {#text} at (0,0) size 0x0
</span></span></pre></div>
<a id="trunkLayoutTestsplatformmacfastcssgeneratedcontentnoopenclosequoteexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/LayoutTests/platform/mac/fast/css-generated-content/no-openclose-quote-expected.txt        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -7,11 +7,11 @@
</span><span class="cx">         RenderInline (generated) at (0,0) size 8x18
</span><span class="cx">           RenderText at (0,0) size 8x18
</span><span class="cx">             text run at (0,0) width 8: &quot;*&quot;
</span><del>-          RenderQuote at (0,0) size 0x0
</del><ins>+          RenderQuote at (0,0) size 0x18
</ins><span class="cx">         RenderText {#text} at (8,0) size 425x18
</span><span class="cx">           text run at (8,0) width 114: &quot;This is some text. &quot;
</span><span class="cx">           text run at (122,0) width 311: &quot;It should have a single asterisk before and after it.&quot;
</span><span class="cx">         RenderInline (generated) at (0,0) size 8x18
</span><span class="cx">           RenderText at (433,0) size 8x18
</span><span class="cx">             text run at (433,0) width 8: &quot;*&quot;
</span><del>-          RenderQuote at (0,0) size 0x0
</del><ins>+          RenderQuote at (0,0) size 0x18
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/ChangeLog        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -1,3 +1,31 @@
</span><ins>+2014-01-23  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
+
+        ASSERT_WITH_SECURITY_IMPLICATION in WebCore::InlineTextBox::paint
+        https://bugs.webkit.org/show_bug.cgi?id=114586
+
+        Reviewed by Dave Hyatt.
+
+        Taken mostly from https://chromium.googlesource.com/chromium/blink/+/cb2297db16f2e9328cb4dd8b552093d6b22340a8
+
+        If RenderQuote is a subclass of RenderObject, it can't be split by the first-letter CSS pseudoclass.
+        Instead, we should make it a subclass of RenderElement, so that it can be split properly.
+
+        Test: fast/css-generated-content/quote-first-letter.html
+
+        * dom/PseudoElement.cpp:
+        (WebCore::PseudoElement::didRecalcStyle):
+        * rendering/RenderQuote.cpp:
+        (WebCore::RenderQuote::RenderQuote):
+        (WebCore::RenderQuote::willBeDestroyed):
+        (WebCore::RenderQuote::willBeRemovedFromTree):
+        (WebCore::RenderQuote::styleDidChange):
+        (WebCore::RenderQuote::updateText):
+        (WebCore::RenderQuote::computeText):
+        (WebCore::RenderQuote::updateDepth):
+        * rendering/RenderQuote.h:
+        * rendering/style/ContentData.cpp:
+        (WebCore::QuoteContentData::createContentRenderer):
+
</ins><span class="cx"> 2014-01-28  Antti Koivisto  &lt;antti@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Document::topDocument() should return a reference
</span></span></pre></div>
<a id="trunkSourceWebCoredomPseudoElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/PseudoElement.cpp (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/PseudoElement.cpp        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/dom/PseudoElement.cpp        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -112,9 +112,10 @@
</span><span class="cx">     RenderObject* renderer = this-&gt;renderer();
</span><span class="cx">     for (RenderObject* child = renderer-&gt;nextInPreOrder(renderer); child; child = child-&gt;nextInPreOrder(renderer)) {
</span><span class="cx">         // We only manage the style for the generated content which must be images or text.
</span><del>-        if (!child-&gt;isRenderImage())
</del><ins>+        if (!child-&gt;isRenderImage() &amp;&amp; !child-&gt;isQuote())
</ins><span class="cx">             continue;
</span><del>-        toRenderImage(*child).setStyle(RenderImage::createStyleInheritingFromPseudoStyle(renderer-&gt;style()));
</del><ins>+        PassRef&lt;RenderStyle&gt; createdStyle = RenderStyle::createStyleInheritingFromPseudoStyle(renderer-&gt;style());
+        toRenderElement(*child).setStyle(std::move(createdStyle));
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderImagecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderImage.cpp (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderImage.cpp        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/rendering/RenderImage.cpp        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -142,18 +142,6 @@
</span><span class="cx">     imageResource().shutdown();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PassRef&lt;RenderStyle&gt; RenderImage::createStyleInheritingFromPseudoStyle(const RenderStyle&amp; pseudoStyle)
-{
-    ASSERT(pseudoStyle.styleType() == BEFORE || pseudoStyle.styleType() == AFTER);
-
-    // Images are special and must inherit the pseudoStyle so the width and height of
-    // the pseudo element doesn't change the size of the image. In all other cases we
-    // can just share the style.
-    auto style = RenderStyle::create();
-    style.get().inheritFrom(&amp;pseudoStyle);
-    return style;
-}
-
</del><span class="cx"> // If we'll be displaying either alt text or an image, add some padding.
</span><span class="cx"> static const unsigned short paddingWidth = 4;
</span><span class="cx"> static const unsigned short paddingHeight = 4;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderImageh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderImage.h (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderImage.h        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/rendering/RenderImage.h        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -39,9 +39,6 @@
</span><span class="cx">     RenderImage(Document&amp;, PassRef&lt;RenderStyle&gt;, StyleImage* = nullptr);
</span><span class="cx">     virtual ~RenderImage();
</span><span class="cx"> 
</span><del>-    // Create a RenderStyle for generated content by inheriting from a pseudo style.
-    static PassRef&lt;RenderStyle&gt; createStyleInheritingFromPseudoStyle(const RenderStyle&amp;);
-
</del><span class="cx">     RenderImageResource&amp; imageResource() { return *m_imageResource; }
</span><span class="cx">     const RenderImageResource&amp; imageResource() const { return *m_imageResource; }
</span><span class="cx">     CachedImage* cachedImage() const { return imageResource().cachedImage(); }
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderQuotecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderQuote.cpp (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderQuote.cpp        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/rendering/RenderQuote.cpp        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -24,14 +24,15 @@
</span><span class="cx"> #include &quot;RenderQuote.h&quot;
</span><span class="cx"> 
</span><span class="cx"> #include &quot;QuotesData.h&quot;
</span><ins>+#include &quot;RenderTextFragment.h&quot;
</ins><span class="cx"> #include &quot;RenderView.h&quot;
</span><span class="cx"> 
</span><span class="cx"> using namespace WTF::Unicode;
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-RenderQuote::RenderQuote(Document&amp; document, QuoteType quote)
-    : RenderText(document, emptyString())
</del><ins>+RenderQuote::RenderQuote(Document&amp; document, PassRef&lt;RenderStyle&gt; style, QuoteType quote)
+    : RenderInline(document, std::move(style))
</ins><span class="cx">     , m_type(quote)
</span><span class="cx">     , m_depth(-1)
</span><span class="cx">     , m_next(0)
</span><span class="lines">@@ -50,19 +51,19 @@
</span><span class="cx"> void RenderQuote::willBeDestroyed()
</span><span class="cx"> {
</span><span class="cx">     detachQuote();
</span><del>-    RenderText::willBeDestroyed();
</del><ins>+    RenderInline::willBeDestroyed();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderQuote::willBeRemovedFromTree()
</span><span class="cx"> {
</span><del>-    RenderText::willBeRemovedFromTree();
</del><ins>+    RenderInline::willBeRemovedFromTree();
</ins><span class="cx">     detachQuote();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderQuote::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
</span><span class="cx"> {
</span><del>-    RenderText::styleDidChange(diff, oldStyle);
-    setText(originalText(), true);
</del><ins>+    RenderInline::styleDidChange(diff, oldStyle);
+    updateText();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> const unsigned maxDistinctQuoteCharacters = 16;
</span><span class="lines">@@ -336,8 +337,28 @@
</span><span class="cx">     return apostropheString;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-String RenderQuote::originalText() const
</del><ins>+void RenderQuote::updateText()
</ins><span class="cx"> {
</span><ins>+    String text = computeText();
+    if (m_text == text)
+        return;
+
+    while (RenderObject* child = firstChild())
+        child-&gt;destroy();
+
+    if (text == emptyString() || text == String()) {
+        m_text = String();
+        return;
+    }
+
+    m_text = text;
+
+    RenderTextFragment* fragment = new RenderTextFragment(document(), m_text.impl());
+    addChild(fragment);
+}
+
+String RenderQuote::computeText() const
+{
</ins><span class="cx">     if (m_depth &lt; 0)
</span><span class="cx">         return emptyString();
</span><span class="cx">     bool isOpenQuote = false;
</span><span class="lines">@@ -452,7 +473,7 @@
</span><span class="cx">     if (m_depth == depth)
</span><span class="cx">         return;
</span><span class="cx">     m_depth = depth;
</span><del>-    setText(originalText(), true);
</del><ins>+    updateText();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderQuoteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderQuote.h (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderQuote.h        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/rendering/RenderQuote.h        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -23,13 +23,13 @@
</span><span class="cx"> #ifndef RenderQuote_h
</span><span class="cx"> #define RenderQuote_h
</span><span class="cx"> 
</span><del>-#include &quot;RenderText.h&quot;
</del><ins>+#include &quot;RenderInline.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><del>-class RenderQuote final : public RenderText {
</del><ins>+class RenderQuote final : public RenderInline {
</ins><span class="cx"> public:
</span><del>-    RenderQuote(Document&amp;, QuoteType);
</del><ins>+    RenderQuote(Document&amp;, PassRef&lt;RenderStyle&gt;, QuoteType);
</ins><span class="cx">     virtual ~RenderQuote();
</span><span class="cx"> 
</span><span class="cx">     void attachQuote();
</span><span class="lines">@@ -40,10 +40,11 @@
</span><span class="cx">     virtual void willBeDestroyed() override;
</span><span class="cx">     virtual const char* renderName() const override { return &quot;RenderQuote&quot;; }
</span><span class="cx">     virtual bool isQuote() const override { return true; };
</span><del>-    virtual String originalText() const override;
</del><span class="cx">     virtual void styleDidChange(StyleDifference, const RenderStyle*) override;
</span><span class="cx">     virtual void willBeRemovedFromTree() override;
</span><span class="cx"> 
</span><ins>+    String computeText() const;
+    void updateText();
</ins><span class="cx">     void updateDepth();
</span><span class="cx"> 
</span><span class="cx">     QuoteType m_type;
</span><span class="lines">@@ -51,6 +52,7 @@
</span><span class="cx">     RenderQuote* m_next;
</span><span class="cx">     RenderQuote* m_previous;
</span><span class="cx">     bool m_isAttached;
</span><ins>+    String m_text;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> RENDER_OBJECT_TYPE_CASTS(RenderQuote, isQuote())
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingstyleContentDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/style/ContentData.cpp (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/style/ContentData.cpp        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/rendering/style/ContentData.cpp        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -49,7 +49,7 @@
</span><span class="cx"> 
</span><span class="cx"> RenderPtr&lt;RenderObject&gt; ImageContentData::createContentRenderer(Document&amp; document, const RenderStyle&amp; pseudoStyle) const
</span><span class="cx"> {
</span><del>-    auto image = createRenderer&lt;RenderImage&gt;(document, RenderImage::createStyleInheritingFromPseudoStyle(pseudoStyle), m_image.get());
</del><ins>+    auto image = createRenderer&lt;RenderImage&gt;(document, RenderStyle::createStyleInheritingFromPseudoStyle(pseudoStyle), m_image.get());
</ins><span class="cx">     image-&gt;initializeStyle();
</span><span class="cx">     image-&gt;setAltText(altText());
</span><span class="cx">     return std::move(image);
</span><span class="lines">@@ -67,9 +67,11 @@
</span><span class="cx">     return createRenderer&lt;RenderCounter&gt;(document, *m_counter);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RenderPtr&lt;RenderObject&gt; QuoteContentData::createContentRenderer(Document&amp; document, const RenderStyle&amp;) const
</del><ins>+RenderPtr&lt;RenderObject&gt; QuoteContentData::createContentRenderer(Document&amp; document, const RenderStyle&amp; pseudoStyle) const
</ins><span class="cx"> {
</span><del>-    return createRenderer&lt;RenderQuote&gt;(document, m_quote);
</del><ins>+    auto quote = createRenderer&lt;RenderQuote&gt;(document, RenderStyle::createStyleInheritingFromPseudoStyle(pseudoStyle), m_quote);
+    quote-&gt;initializeStyle();
+    return std::move(quote);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingstyleRenderStylecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/style/RenderStyle.cpp (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/style/RenderStyle.cpp        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/rendering/style/RenderStyle.cpp        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -107,6 +107,18 @@
</span><span class="cx">     return adoptRef(*new RenderStyle(*other));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+PassRef&lt;RenderStyle&gt; RenderStyle::createStyleInheritingFromPseudoStyle(const RenderStyle&amp; pseudoStyle)
+{
+    ASSERT(pseudoStyle.styleType() == BEFORE || pseudoStyle.styleType() == AFTER);
+
+    // Images are special and must inherit the pseudoStyle so the width and height of
+    // the pseudo element doesn't change the size of the image. In all other cases we
+    // can just share the style.
+    auto style = RenderStyle::create();
+    style.get().inheritFrom(&amp;pseudoStyle);
+    return style;
+}
+
</ins><span class="cx"> ALWAYS_INLINE RenderStyle::RenderStyle()
</span><span class="cx">     : m_box(defaultStyle().m_box)
</span><span class="cx">     , visual(defaultStyle().visual)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingstyleRenderStyleh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/style/RenderStyle.h (162971 => 162972)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/style/RenderStyle.h        2014-01-28 23:30:29 UTC (rev 162971)
+++ trunk/Source/WebCore/rendering/style/RenderStyle.h        2014-01-28 23:36:04 UTC (rev 162972)
</span><span class="lines">@@ -352,6 +352,9 @@
</span><span class="cx">     static PassRef&lt;RenderStyle&gt; createAnonymousStyleWithDisplay(const RenderStyle* parentStyle, EDisplay);
</span><span class="cx">     static PassRef&lt;RenderStyle&gt; clone(const RenderStyle*);
</span><span class="cx"> 
</span><ins>+    // Create a RenderStyle for generated content by inheriting from a pseudo style.
+    static PassRef&lt;RenderStyle&gt; createStyleInheritingFromPseudoStyle(const RenderStyle&amp; pseudoStyle);
+
</ins><span class="cx">     enum IsAtShadowBoundary {
</span><span class="cx">         AtShadowBoundary,
</span><span class="cx">         NotAtShadowBoundary,
</span></span></pre>
</div>
</div>

</body>
</html>