<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[168791] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/168791">168791</a></dd>
<dt>Author</dt> <dd>abucur@adobe.com</dd>
<dt>Date</dt> <dd>2014-05-13 23:33:48 -0700 (Tue, 13 May 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>[CSS Regions] Assertion failure in some cases with inline blocks
https://bugs.webkit.org/show_bug.cgi?id=132859

Reviewed by Mihnea Ovidenie.

Source/WebCore:
The patch hardens the conditions when the region range caches are
populated to avoid desynchronizations when objects move during layout.
This is true especially in the case of the boxes found inside
inline blocks, that get their range from the containing line.

There is a new function |computedRegionRangeForBox| that will always
return a region range for a box using a best effort algorithm. This should
be used only when there's no need to cache region information.

This change also allows better control over the lifecycle of the
|RenderBoxRegionInfo| objects stored on the regions. We can now iterate
over the full range of the box when cleaning up the region box info. The
same applies for the width change detection function.

Test: fast/regions/inline-block-shifted-region.html

* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::updateRegionForLine): Don't set the containing
region if the block doesn't have a range. The returned value would not
be correctly clamped.
* rendering/RenderBox.cpp:
(WebCore::RenderBlock::hasRegionRangeInFlowThread):
* rendering/RenderBox.h:
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::removeRenderBoxRegionInfo): Iterate only over
the range of the box, not from the start of the region chain.
(WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock): Same as
above.
(WebCore::RenderFlowThread::hasCachedRegionRangeForBox):
(WebCore::RenderFlowThread::getRegionRangeForBoxFromCachedInfo):
(WebCore::RenderFlowThread::getRegionRangeForBox):
(WebCore::RenderFlowThread::computedRegionRangeForBox): Best effort function
to determine the range of a box. It will always return something as long
as the flow thread has regions.
(WebCore::RenderFlowThread::objectShouldFragmentInFlowRegion): Use the new function
to determine the range.
* rendering/RenderFlowThread.h:
* rendering/RenderNamedFlowThread.cpp:
(WebCore::RenderNamedFlowThread::absoluteQuadsForBox): Use the new function to determine
the range.

LayoutTests:
Test that moving lines with inline blocks doesn't cause an assertion.

* fast/regions/inline-block-shifted-region-expected.txt: Added.
* fast/regions/inline-block-shifted-region.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockLineLayoutcpp">trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxcpp">trunk/Source/WebCore/rendering/RenderBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxh">trunk/Source/WebCore/rendering/RenderBox.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadcpp">trunk/Source/WebCore/rendering/RenderFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadh">trunk/Source/WebCore/rendering/RenderFlowThread.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderNamedFlowThreadcpp">trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastregionsinlineblockshiftedregionexpectedtxt">trunk/LayoutTests/fast/regions/inline-block-shifted-region-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastregionsinlineblockshiftedregionhtml">trunk/LayoutTests/fast/regions/inline-block-shifted-region.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (168790 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-05-14 06:32:56 UTC (rev 168790)
+++ trunk/LayoutTests/ChangeLog        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2014-05-13  Andrei Bucur  &lt;abucur@adobe.com&gt;
+
+        [CSS Regions] Assertion failure in some cases with inline blocks
+        https://bugs.webkit.org/show_bug.cgi?id=132859
+
+        Reviewed by Mihnea Ovidenie.
+
+        Test that moving lines with inline blocks doesn't cause an assertion.
+
+        * fast/regions/inline-block-shifted-region-expected.txt: Added.
+        * fast/regions/inline-block-shifted-region.html: Added.
+
</ins><span class="cx"> 2014-05-13  Hans Muller  &lt;hmuller@adobe.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [CSS Shapes] line height grows around polygon and incorrectly causes text to wrap to next line
</span></span></pre></div>
<a id="trunkLayoutTestsfastregionsinlineblockshiftedregionexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/regions/inline-block-shifted-region-expected.txt (0 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/regions/inline-block-shifted-region-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/regions/inline-block-shifted-region-expected.txt        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -0,0 +1,3 @@
</span><ins>+Test for [CSS Regions] Assertion failure in some cases with inline blocks. The test passes if there is no crash.
+
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastregionsinlineblockshiftedregionhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/regions/inline-block-shifted-region.html (0 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/regions/inline-block-shifted-region.html                                (rev 0)
+++ trunk/LayoutTests/fast/regions/inline-block-shifted-region.html        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -0,0 +1,64 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;style type=&quot;text/css&quot;&gt;
+    .region {
+        -webkit-flow-from: flow;
+        height: 120px;
+        width: 300px;
+        float: left;
+    }
+
+    #content {
+        -webkit-flow-into: flow;
+        margin-top: 50px;
+        font-family: Ahem;
+        font-size: 12px;
+    }
+
+    #one {
+        background-color: green;
+        width: 100px;
+        height: 100px;
+    }
+    #two {
+        width: 10px;
+        height: 10px;
+        background-color: blue;
+    }
+
+    #inlineblock {
+        display: inline-block;
+        background-color: blue;
+        padding: 10px;
+    }
+
+    #boxonline {
+        background-color: green;
+    }
+
+    #outside {
+        border: thin solid red;
+        margin: 5px;
+    }
+&lt;/style&gt;
+&lt;/head&gt;
+&lt;body&gt;
+    &lt;p&gt;Test for &lt;a href=&quot;https://bugs.webkit.org/show_bug.cgi?id=132859&quot;&gt;[CSS Regions] Assertion failure in some cases with inline blocks&lt;/a&gt;. The test passes if there is no crash.&lt;/p&gt;
+    &lt;div class=&quot;region&quot;&gt;&lt;/div&gt;
+    &lt;div class=&quot;region&quot;&gt;&lt;/div&gt;
+
+    &lt;div id=&quot;content&quot;&gt;&lt;div id=&quot;outside&quot;&gt;AAA&lt;br/&gt;AAA&lt;br/&gt;AAA&lt;br/&gt;AAA&lt;br/&gt;&lt;div id=&quot;inlineblock&quot;&gt;&lt;div id=&quot;boxonline&quot;&gt;A&lt;/div&gt;&lt;/div&gt;&lt;/br&gt;AAA&lt;/div&gt;&lt;/div&gt;
+
+    &lt;script&gt;
+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    document.body.offsetTop;
+    document.getElementById(&quot;content&quot;).style.marginTop = &quot;0px&quot;;
+    document.body.offsetTop;
+    document.body.removeChild(document.getElementById(&quot;content&quot;));
+    document.body.offsetTop;
+    &lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (168790 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-05-14 06:32:56 UTC (rev 168790)
+++ trunk/Source/WebCore/ChangeLog        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -1,3 +1,51 @@
</span><ins>+2014-05-13  Andrei Bucur  &lt;abucur@adobe.com&gt;
+
+        [CSS Regions] Assertion failure in some cases with inline blocks
+        https://bugs.webkit.org/show_bug.cgi?id=132859
+
+        Reviewed by Mihnea Ovidenie.
+
+        The patch hardens the conditions when the region range caches are
+        populated to avoid desynchronizations when objects move during layout.
+        This is true especially in the case of the boxes found inside
+        inline blocks, that get their range from the containing line.
+
+        There is a new function |computedRegionRangeForBox| that will always
+        return a region range for a box using a best effort algorithm. This should
+        be used only when there's no need to cache region information.
+
+        This change also allows better control over the lifecycle of the
+        |RenderBoxRegionInfo| objects stored on the regions. We can now iterate
+        over the full range of the box when cleaning up the region box info. The
+        same applies for the width change detection function.
+
+        Test: fast/regions/inline-block-shifted-region.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlockFlow::updateRegionForLine): Don't set the containing
+        region if the block doesn't have a range. The returned value would not
+        be correctly clamped.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBlock::hasRegionRangeInFlowThread):
+        * rendering/RenderBox.h:
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::removeRenderBoxRegionInfo): Iterate only over
+        the range of the box, not from the start of the region chain.
+        (WebCore::RenderFlowThread::logicalWidthChangedInRegionsForBlock): Same as
+        above.
+        (WebCore::RenderFlowThread::hasCachedRegionRangeForBox):
+        (WebCore::RenderFlowThread::getRegionRangeForBoxFromCachedInfo):
+        (WebCore::RenderFlowThread::getRegionRangeForBox):
+        (WebCore::RenderFlowThread::computedRegionRangeForBox): Best effort function
+        to determine the range of a box. It will always return something as long
+        as the flow thread has regions.
+        (WebCore::RenderFlowThread::objectShouldFragmentInFlowRegion): Use the new function
+        to determine the range.
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderNamedFlowThread.cpp:
+        (WebCore::RenderNamedFlowThread::absoluteQuadsForBox): Use the new function to determine
+        the range.
+
</ins><span class="cx"> 2014-05-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Fix &quot;ASSERTION FAILED: m_representation == PlatformLayerRepresentation&quot; with UI-side compositing
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockLineLayoutcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp (168790 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp        2014-05-14 06:32:56 UTC (rev 168790)
+++ trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -1928,10 +1928,14 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(lineBox);
</span><span class="cx"> 
</span><del>-    if (auto containingRegion = regionAtBlockOffset(lineBox-&gt;lineTopWithLeading()))
-        lineBox-&gt;setContainingRegion(*containingRegion);
-    else
</del><ins>+    if (!hasRegionRangeInFlowThread())
</ins><span class="cx">         lineBox-&gt;clearContainingRegion();
</span><ins>+    else {
+        if (auto containingRegion = regionAtBlockOffset(lineBox-&gt;lineTopWithLeading()))
+            lineBox-&gt;setContainingRegion(*containingRegion);
+        else
+            lineBox-&gt;clearContainingRegion();
+    }
</ins><span class="cx"> 
</span><span class="cx">     RootInlineBox* prevLineBox = lineBox-&gt;prevRootBox();
</span><span class="cx">     if (!prevLineBox)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (168790 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBox.cpp        2014-05-14 06:32:56 UTC (rev 168790)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -150,6 +150,15 @@
</span><span class="cx">     return region;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+bool RenderBox::hasRegionRangeInFlowThread() const
+{
+    RenderFlowThread* flowThread = flowThreadContainingBlock();
+    if (!flowThread || !flowThread-&gt;hasValidRegionInfo())
+        return false;
+
+    return flowThread-&gt;hasCachedRegionRangeForBox(this);
+}
+
</ins><span class="cx"> LayoutRect RenderBox::clientBoxRectInRegion(RenderRegion* region) const
</span><span class="cx"> {
</span><span class="cx">     if (!region)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBox.h (168790 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBox.h        2014-05-14 06:32:56 UTC (rev 168790)
+++ trunk/Source/WebCore/rendering/RenderBox.h        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -383,6 +383,7 @@
</span><span class="cx">     LayoutRect borderBoxRectInRegion(RenderRegion*, RenderBoxRegionInfoFlags = CacheRenderBoxRegionInfo) const;
</span><span class="cx">     LayoutRect clientBoxRectInRegion(RenderRegion*) const;
</span><span class="cx">     RenderRegion* clampToStartAndEndRegions(RenderRegion*) const;
</span><ins>+    bool hasRegionRangeInFlowThread() const;
</ins><span class="cx">     virtual LayoutUnit offsetFromLogicalTopOfFirstPage() const;
</span><span class="cx">     
</span><span class="cx">     void positionLineBox(InlineElementBox&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.cpp (168790 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-05-14 06:32:56 UTC (rev 168790)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -578,12 +578,13 @@
</span><span class="cx"> 
</span><span class="cx">     RenderRegion* startRegion = nullptr;
</span><span class="cx">     RenderRegion* endRegion = nullptr;
</span><del>-    getRegionRangeForBox(box, startRegion, endRegion);
-
-    for (auto&amp; region : m_regionList) {
-        region-&gt;removeRenderBoxRegionInfo(box);
-        if (region == endRegion)
-            break;
</del><ins>+    if (getRegionRangeForBox(box, startRegion, endRegion)) {
+        for (auto it = m_regionList.find(startRegion), end = m_regionList.end(); it != end; ++it) {
+            RenderRegion* region = *it;
+            region-&gt;removeRenderBoxRegionInfo(box);
+            if (region == endRegion)
+                break;
+        }
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><span class="lines">@@ -640,9 +641,11 @@
</span><span class="cx"> 
</span><span class="cx">     RenderRegion* startRegion = nullptr;
</span><span class="cx">     RenderRegion* endRegion = nullptr;
</span><del>-    getRegionRangeForBox(block, startRegion, endRegion);
</del><ins>+    if (!getRegionRangeForBox(block, startRegion, endRegion))
+        return;
</ins><span class="cx"> 
</span><del>-    for (auto&amp; region : m_regionList) {
</del><ins>+    for (auto it = m_regionList.find(startRegion), end = m_regionList.end(); it != end; ++it) {
+        RenderRegion* region = *it;
</ins><span class="cx">         ASSERT(!region-&gt;needsLayout() || region-&gt;isRenderRegionSet());
</span><span class="cx"> 
</span><span class="cx">         // We have no information computed for this region so we need to do it.
</span><span class="lines">@@ -754,14 +757,7 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(box);
</span><span class="cx"> 
</span><del>-    if (m_regionRangeMap.contains(box))
-        return true;
-
-    InlineElementBox* boxWrapper = box-&gt;inlineBoxWrapper();
-    if (boxWrapper &amp;&amp; boxWrapper-&gt;root().containingRegion())
-        return true;
-
-    return false;
</del><ins>+    return m_regionRangeMap.contains(box);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool RenderFlowThread::getRegionRangeForBoxFromCachedInfo(const RenderBox* box, RenderRegion*&amp; startRegion, RenderRegion*&amp; endRegion) const
</span><span class="lines">@@ -779,13 +775,6 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    InlineElementBox* boxWrapper = box-&gt;inlineBoxWrapper();
-    if (boxWrapper &amp;&amp; boxWrapper-&gt;root().containingRegion()) {
-        startRegion = endRegion = boxWrapper-&gt;root().containingRegion();
-        ASSERT(m_regionList.contains(startRegion) &amp;&amp; m_regionList.contains(endRegion));
-        return true;
-    }
-
</del><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -805,12 +794,31 @@
</span><span class="cx">     if (getRegionRangeForBoxFromCachedInfo(box, startRegion, endRegion))
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    // Check if the box is contained in an unsplittable box.
-    // If the unsplittable box has region range, then the start and end region for the box
-    // should be equal with the region for the unsplittable box if any.
</del><ins>+    return false;
+}
+
+bool RenderFlowThread::computedRegionRangeForBox(const RenderBox* box, RenderRegion*&amp; startRegion, RenderRegion*&amp; endRegion) const
+{
+    ASSERT(box);
+
+    startRegion = endRegion = nullptr;
+    if (!hasValidRegionInfo()) // We clear the ranges when we invalidate the regions.
+        return false;
+
+    if (getRegionRangeForBox(box, startRegion, endRegion))
+        return true;
+
+    // Search the region range using the information provided by the
+    // containing block chain.
</ins><span class="cx">     RenderBox* cb = const_cast&lt;RenderBox*&gt;(box);
</span><del>-    RenderBox* cbToUse = nullptr;
-    while (!cb-&gt;isRenderFlowThread() &amp;&amp; !cbToUse) {
</del><ins>+    while (!cb-&gt;isRenderFlowThread()) {
+        InlineElementBox* boxWrapper = cb-&gt;inlineBoxWrapper();
+        if (boxWrapper &amp;&amp; boxWrapper-&gt;root().containingRegion()) {
+            startRegion = endRegion = boxWrapper-&gt;root().containingRegion();
+            ASSERT(m_regionList.contains(startRegion));
+            return true;
+        }
+
</ins><span class="cx">         // FIXME: Use the containingBlock() value once we patch all the layout systems to be region range aware
</span><span class="cx">         // (e.g. if we use containingBlock() the shadow controls of a video element won't get the range from the
</span><span class="cx">         // video box because it's not a block; they need to be patched separately).
</span><span class="lines">@@ -818,17 +826,15 @@
</span><span class="cx">         cb = cb-&gt;parent()-&gt;enclosingBox();
</span><span class="cx">         ASSERT(cb);
</span><span class="cx"> 
</span><del>-        if (hasCachedRegionRangeForBox(cb))
-            cbToUse = cb;
</del><ins>+        // If a box doesn't have a cached region range it usually means the box belongs to a line so startRegion should be equal with endRegion.
+        // FIXME: Find the cases when this startRegion should not be equal with endRegion and make sure these boxes have cached region ranges.
+        if (hasCachedRegionRangeForBox(cb)) {
+            startRegion = endRegion = const_cast&lt;RenderFlowThread*&gt;(this)-&gt;regionAtBlockOffset(cb, box-&gt;offsetFromLogicalTopOfFirstPage(), true, DisallowRegionAutoGeneration);
+            return true;
+        }
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    // If a box doesn't have a cached region range it usually means the box belongs to a line so startRegion should be equal with endRegion.
-    // FIXME: Find the cases when this startRegion should not be equal with endRegion and make sure these boxes have cached region ranges.
-    if (cbToUse) {
-        startRegion = endRegion = const_cast&lt;RenderFlowThread*&gt;(this)-&gt;regionAtBlockOffset(cbToUse, box-&gt;offsetFromLogicalTopOfFirstPage(), true, DisallowRegionAutoGeneration);
-        return true;
-    }
-
</del><ins>+    ASSERT_NOT_REACHED();
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -864,7 +870,7 @@
</span><span class="cx">     RenderRegion* enclosingBoxEndRegion = nullptr;
</span><span class="cx">     // If the box has no range, do not check regionInRange. Boxes inside inlines do not get ranges.
</span><span class="cx">     // Instead, the containing RootInlineBox will abort when trying to paint inside the wrong region.
</span><del>-    if (getRegionRangeForBox(enclosingBox, enclosingBoxStartRegion, enclosingBoxEndRegion)
</del><ins>+    if (computedRegionRangeForBox(enclosingBox, enclosingBoxStartRegion, enclosingBoxEndRegion)
</ins><span class="cx">         &amp;&amp; !regionInRange(region, enclosingBoxStartRegion, enclosingBoxEndRegion))
</span><span class="cx">         return false;
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.h (168790 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.h        2014-05-14 06:32:56 UTC (rev 168790)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.h        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -143,6 +143,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual void setRegionRangeForBox(const RenderBox*, RenderRegion*, RenderRegion*);
</span><span class="cx">     bool getRegionRangeForBox(const RenderBox*, RenderRegion*&amp; startRegion, RenderRegion*&amp; endRegion) const;
</span><ins>+    bool computedRegionRangeForBox(const RenderBox*, RenderRegion*&amp; startRegion, RenderRegion*&amp; endRegion) const;
</ins><span class="cx">     bool hasCachedRegionRangeForBox(const RenderBox*) const;
</span><span class="cx"> 
</span><span class="cx">     // Check if the object is in region and the region is part of this flow thread.
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderNamedFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp (168790 => 168791)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp        2014-05-14 06:32:56 UTC (rev 168790)
+++ trunk/Source/WebCore/rendering/RenderNamedFlowThread.cpp        2014-05-14 06:33:48 UTC (rev 168791)
</span><span class="lines">@@ -820,7 +820,7 @@
</span><span class="cx">     RenderRegion* startRegion = nullptr;
</span><span class="cx">     RenderRegion* endRegion = nullptr;
</span><span class="cx">     // If the box doesn't have a range, we don't know how it is fragmented so fallback to the default behaviour.
</span><del>-    if (!getRegionRangeForBox(renderer, startRegion, endRegion))
</del><ins>+    if (!computedRegionRangeForBox(renderer, startRegion, endRegion))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     for (auto iter = m_regionList.find(startRegion), end = m_regionList.end(); iter != end; ++iter) {
</span></span></pre>
</div>
</div>

</body>
</html>