<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[162956] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/162956">162956</a></dd>
<dt>Author</dt> <dd>mmaxfield@apple.com</dd>
<dt>Date</dt> <dd>2014-01-28 13:53:22 -0800 (Tue, 28 Jan 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Fixing several incorrect assumptions with handling isolated inlines.
https://bugs.webkit.org/show_bug.cgi?id=127608
Reviewed by Dave Hyatt.
Source/WebCore:
First, when an isolated inline spans multiple lines, we aren't guaranteed
to exit BidiResolver with a nested inline count of zero. Removing the
assert that says otherwise.
Previously in constructBidiRunsForSegment, we called bidiFirst in
an attempt to properly setup the isolatedResolver for any dom/style
that applied, but this only worked on the first line the isolated
inline appeared in. Adding a function that approaches this properly
by recursing through the parents of the starting object for the line
and post-fixing direction attributes to the resolver.
Finally, addressing an issue where the line following a removed isolated
inline (with a continuation) failed to be marked dirty.
Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/72698f203b1c50900e535b80945563b92b7eef23
Tests: fast/text/nested-bidi-assert.html
fast/text/nested-bidi-with-continuation-crash.html
* platform/text/BidiResolver.h:
(WebCore::Run>::~BidiResolver):
* rendering/RenderBlockLineLayout.cpp:
(WebCore::setupResolverToResumeInIsolate):
(WebCore::constructBidiRunsForSegment):
* rendering/RenderLineBoxList.cpp:
(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
LayoutTests:
See file-specific info.
Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/72698f203b1c50900e535b80945563b92b7eef23
* fast/text/nested-bidi-assert-expected.txt: Added.
* fast/text/nested-bidi-assert.html: Added. Tests that no crash occurs
when an isolated inline spans several lines
* fast/text/nested-bidi-with-continuation-crash-expected.txt: Added.
* fast/text/nested-bidi-with-continuation-crash.html: Added. Tests that
no crash occurs when additional isolates need to be set up for a
continuation</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreplatformtextBidiResolverh">trunk/Source/WebCore/platform/text/BidiResolver.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockLineLayoutcpp">trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLineBoxListcpp">trunk/Source/WebCore/rendering/RenderLineBoxList.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfasttextnestedbidiassertexpectedtxt">trunk/LayoutTests/fast/text/nested-bidi-assert-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfasttextnestedbidiasserthtml">trunk/LayoutTests/fast/text/nested-bidi-assert.html</a></li>
<li><a href="#trunkLayoutTestsfasttextnestedbidiwithcontinuationcrashexpectedtxt">trunk/LayoutTests/fast/text/nested-bidi-with-continuation-crash-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfasttextnestedbidiwithcontinuationcrashhtml">trunk/LayoutTests/fast/text/nested-bidi-with-continuation-crash.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (162955 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2014-01-28 21:42:37 UTC (rev 162955)
+++ trunk/LayoutTests/ChangeLog 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -1,3 +1,22 @@
</span><ins>+2014-01-28 Myles C. Maxfield <mmaxfield@apple.com>
+
+ Fixing several incorrect assumptions with handling isolated inlines.
+ https://bugs.webkit.org/show_bug.cgi?id=127608
+
+ Reviewed by Dave Hyatt.
+
+ See file-specific info.
+
+ Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/72698f203b1c50900e535b80945563b92b7eef23
+
+ * fast/text/nested-bidi-assert-expected.txt: Added.
+ * fast/text/nested-bidi-assert.html: Added. Tests that no crash occurs
+ when an isolated inline spans several lines
+ * fast/text/nested-bidi-with-continuation-crash-expected.txt: Added.
+ * fast/text/nested-bidi-with-continuation-crash.html: Added. Tests that
+ no crash occurs when additional isolates need to be set up for a
+ continuation
+
</ins><span class="cx"> 2014-01-28 Antti Koivisto <antti@apple.com>
</span><span class="cx">
</span><span class="cx"> Rebase fast/repaint/background-shorthand-with-gradient-and-height-changes.html after https://trac.webkit.org/r162947
</span></span></pre></div>
<a id="trunkLayoutTestsfasttextnestedbidiassertexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/text/nested-bidi-assert-expected.txt (0 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/text/nested-bidi-assert-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/text/nested-bidi-assert-expected.txt 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+Test passes if there are no asserts in debug builds.
</ins></span></pre></div>
<a id="trunkLayoutTestsfasttextnestedbidiasserthtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/text/nested-bidi-assert.html (0 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/text/nested-bidi-assert.html (rev 0)
+++ trunk/LayoutTests/fast/text/nested-bidi-assert.html 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+<!DOCTYPE html>
+<div id="test"><output><br><output>foo<br>bar<output>baz</output></output></output><br></div>
+<div>Test passes if there are no asserts in debug builds.</div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+var div = document.getElementById("test");
+div.offsetTop;
+div.parentNode.removeChild(div);
+</script>
</ins><span class="cx">\ No newline at end of file
</span></span></pre></div>
<a id="trunkLayoutTestsfasttextnestedbidiwithcontinuationcrashexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/text/nested-bidi-with-continuation-crash-expected.txt (0 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/text/nested-bidi-with-continuation-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/text/nested-bidi-with-continuation-crash-expected.txt 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+Test passes if no crashes with asan.
</ins></span></pre></div>
<a id="trunkLayoutTestsfasttextnestedbidiwithcontinuationcrashhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/text/nested-bidi-with-continuation-crash.html (0 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/text/nested-bidi-with-continuation-crash.html (rev 0)
+++ trunk/LayoutTests/fast/text/nested-bidi-with-continuation-crash.html 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -0,0 +1,38 @@
</span><ins>+<!DOCTYPE html>
+<body onload="runTest();">
+<script>
+function reference(domNode)
+{
+ this.domNode = domNode;
+}
+function walk(a, currentPrefix, index, domNode)
+{
+ if (domNode == null)
+ return;
+ newPrefix = currentPrefix + "_" + index;
+ walk(a, currentPrefix, index + 1, domNode.nextSibling);
+ walk(a, newPrefix, 0, domNode.firstChild);
+ a[newPrefix] = new reference(domNode);
+}
+function clearAllNodes()
+{
+ var a = new Array();
+ walk(a, "", 0, document.body);
+ for (key in a)
+ {
+ document.body.offsetTop;
+ a[key].domNode.parentNode.removeChild(a[key].domNode);
+ }
+}
+function runTest() {
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ clearAllNodes();
+ document.write("Test passes if no crashes with asan.")
+}
+</script>
+<output> <div> <pre> <div> </div></div>f<div> </div>
+<output>o</output>
+<a><u><textarea></textarea>
+<br></br>
+</u>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (162955 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-01-28 21:42:37 UTC (rev 162955)
+++ trunk/Source/WebCore/ChangeLog 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -1,3 +1,37 @@
</span><ins>+2014-01-28 Myles C. Maxfield <mmaxfield@apple.com>
+
+ Fixing several incorrect assumptions with handling isolated inlines.
+ https://bugs.webkit.org/show_bug.cgi?id=127608
+
+ Reviewed by Dave Hyatt.
+
+ First, when an isolated inline spans multiple lines, we aren't guaranteed
+ to exit BidiResolver with a nested inline count of zero. Removing the
+ assert that says otherwise.
+
+ Previously in constructBidiRunsForSegment, we called bidiFirst in
+ an attempt to properly setup the isolatedResolver for any dom/style
+ that applied, but this only worked on the first line the isolated
+ inline appeared in. Adding a function that approaches this properly
+ by recursing through the parents of the starting object for the line
+ and post-fixing direction attributes to the resolver.
+
+ Finally, addressing an issue where the line following a removed isolated
+ inline (with a continuation) failed to be marked dirty.
+
+ Merged from Blink: https://chromium.googlesource.com/chromium/blink/+/72698f203b1c50900e535b80945563b92b7eef23
+
+ Tests: fast/text/nested-bidi-assert.html
+ fast/text/nested-bidi-with-continuation-crash.html
+
+ * platform/text/BidiResolver.h:
+ (WebCore::Run>::~BidiResolver):
+ * rendering/RenderBlockLineLayout.cpp:
+ (WebCore::setupResolverToResumeInIsolate):
+ (WebCore::constructBidiRunsForSegment):
+ * rendering/RenderLineBoxList.cpp:
+ (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+
</ins><span class="cx"> 2014-01-28 Antti Koivisto <antti@apple.com>
</span><span class="cx">
</span><span class="cx"> REGRESSION(r162837): 5% regression on html5-full-render and 3% regression in DoYouEvenBench
</span></span></pre></div>
<a id="trunkSourceWebCoreplatformtextBidiResolverh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/platform/text/BidiResolver.h (162955 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/platform/text/BidiResolver.h 2014-01-28 21:42:37 UTC (rev 162955)
+++ trunk/Source/WebCore/platform/text/BidiResolver.h 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -307,10 +307,8 @@
</span><span class="cx"> template <class Iterator, class Run>
</span><span class="cx"> BidiResolver<Iterator, Run>::~BidiResolver()
</span><span class="cx"> {
</span><del>- // The owner of this resolver should have handled the isolated runs
- // or should never have called enterIsolate().
</del><ins>+ // The owner of this resolver should have handled the isolated runs.
</ins><span class="cx"> ASSERT(m_isolatedRuns.isEmpty());
</span><del>- ASSERT(!m_nestedIsolateCount);
</del><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockLineLayoutcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp (162955 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2014-01-28 21:42:37 UTC (rev 162955)
+++ trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -872,6 +872,15 @@
</span><span class="cx"> lastRootBox()->appendFloat(floatingObject->renderer());
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+static inline void setupResolverToResumeInIsolate(InlineBidiResolver& resolver, RenderObject* root, RenderObject* startObject)
+{
+ if (root != startObject) {
+ RenderObject* parent = startObject->parent();
+ setupResolverToResumeInIsolate(resolver, root, parent);
+ notifyObserverEnteredObject(&resolver, startObject);
+ }
+}
+
</ins><span class="cx"> // FIXME: BidiResolver should have this logic.
</span><span class="cx"> static inline void constructBidiRunsForSegment(InlineBidiResolver& topResolver, BidiRunList<BidiRun>& bidiRuns, const InlineIterator& endOfRuns, VisualDirectionOverride override, bool previousLineBrokeCleanly)
</span><span class="cx"> {
</span><span class="lines">@@ -906,10 +915,7 @@
</span><span class="cx"> }
</span><span class="cx"> isolatedResolver.setStatus(BidiStatus(direction, isOverride(unicodeBidi)));
</span><span class="cx">
</span><del>- // FIXME: The fact that we have to construct an Iterator here
- // currently prevents this code from moving into BidiResolver.
- if (!bidiFirstSkippingEmptyInlines(*isolatedInline, &isolatedResolver))
- continue;
</del><ins>+ setupResolverToResumeInIsolate(isolatedResolver, isolatedInline, &startObj);
</ins><span class="cx">
</span><span class="cx"> // The starting position is the beginning of the first run within the isolate that was identified
</span><span class="cx"> // during the earlier call to createBidiRunsForLine. This can be but is not necessarily the
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLineBoxListcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLineBoxList.cpp (162955 => 162956)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2014-01-28 21:42:37 UTC (rev 162955)
+++ trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2014-01-28 21:53:22 UTC (rev 162956)
</span><span class="lines">@@ -396,7 +396,8 @@
</span><span class="cx"> // space, the search for |child|'s linebox will go past the leading space to the previous linebox and select that
</span><span class="cx"> // one as |box|. If we hit that situation here, dirty the |box| actually containing the child too.
</span><span class="cx"> bool insertedAfterLeadingSpace = box->lineBreakObj() == child->previousSibling();
</span><del>- if (adjacentBox && (adjacentBox->lineBreakObj() == child || child->isBR() || (curr && curr->isBR()) || insertedAfterLeadingSpace))
</del><ins>+ if (adjacentBox && (adjacentBox->lineBreakObj() == child || child->isBR() || (curr && curr->isBR())
+ || insertedAfterLeadingSpace || isIsolated(container->style().unicodeBidi())))
</ins><span class="cx"> adjacentBox->markDirty();
</span><span class="cx"> }
</span><span class="cx"> }
</span></span></pre>
</div>
</div>
</body>
</html>