<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[207985] releases/WebKitGTK/webkit-2.14</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/207985">207985</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-10-27 03:56:19 -0700 (Thu, 27 Oct 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/207804">r207804</a> - Do not update selection rect on dirty lineboxes.
https://bugs.webkit.org/show_bug.cgi?id=163862
&lt;rdar://problem/28813156&gt;

Reviewed by Simon Fraser.

Source/WebCore:

In certain cases RenderBlock::updateFirstLetter() triggers
unwanted render tree mutation while the caller assumes intact renderers.
This patch ensures that no renderers gets destroyed while computing the preferred widths
when we are outside of layout context.

Test: fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::computePreferredLogicalWidths):
(WebCore::RenderBlock::updateFirstLetter):
* rendering/RenderBlock.h:
* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
* rendering/RenderRubyRun.cpp:
(WebCore::RenderRubyRun::updateFirstLetter):
* rendering/RenderRubyRun.h:
* rendering/RenderTable.cpp:
(WebCore::RenderTable::updateFirstLetter):
* rendering/RenderTable.h:
* rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::updateFirstLetter):
* rendering/svg/RenderSVGText.h:

LayoutTests:

* fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt: Added.
* fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit214LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingRenderBlockcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingRenderBlockh">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingRenderListItemcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingRenderRubyRuncpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingRenderRubyRunh">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingRenderTablecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingRenderTableh">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingsvgRenderSVGTextcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorerenderingsvgRenderSVGTexth">releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit214LayoutTestsfastcssgeneratedcontentdynamicfirstletterselectionclearcrashexpectedtxt">releases/WebKitGTK/webkit-2.14/LayoutTests/fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit214LayoutTestsfastcssgeneratedcontentdynamicfirstletterselectionclearcrashhtml">releases/WebKitGTK/webkit-2.14/LayoutTests/fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit214LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2016-10-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
+
+        Do not update selection rect on dirty lineboxes.
+        https://bugs.webkit.org/show_bug.cgi?id=163862
+        &lt;rdar://problem/28813156&gt;
+
+        Reviewed by Simon Fraser.
+
+        * fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt: Added.
+        * fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html: Added.
+
</ins><span class="cx"> 2016-10-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Do not mutate the render tree while collecting selection repaint rects.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214LayoutTestsfastcssgeneratedcontentdynamicfirstletterselectionclearcrashexpectedtxt"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.14/LayoutTests/fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt (0 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/LayoutTests/fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt                                (rev 0)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -0,0 +1,2 @@
</span><ins>+Pass if
+no crash.
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit214LayoutTestsfastcssgeneratedcontentdynamicfirstletterselectionclearcrashhtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.14/LayoutTests/fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html (0 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/LayoutTests/fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html                                (rev 0)
+++ releases/WebKitGTK/webkit-2.14/LayoutTests/fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -0,0 +1,32 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;title&gt;This tests that we can clear selection properly on dynamic content with first letter.&lt;/title&gt;
+&lt;style&gt;
+.floatClass::first-letter {
+  float: right;
+}
+
+#innerBody {
+ column-count: 2;
+}
+
+&lt;/style&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;li id=li style=&quot;float: right;&quot;&gt;Pass if&lt;span style=&quot;float: right;&quot;&gt;&lt;/span&gt;&lt;/li&gt;&lt;body id=innerBody style=&quot;height: 100px&quot;&gt;&lt;span id=span style=&quot;display: none;&quot;&gt;&lt;/span&gt;no crash.&lt;/body&gt;
+&lt;script&gt;
+  if (window.testRunner)
+    testRunner.dumpAsText();
+  innerBody.style.webkitWritingMode = &quot;vertical-rl&quot;;
+  innerBody.className = &quot;floatClass&quot;;
+
+  document.getSelection().setBaseAndExtent(span, 0, innerBody, innerBody.childNodes.length);
+  window.getSelection().modify(&quot;extend&quot;, &quot;left&quot;, &quot;documentboundary&quot;);
+  innerBody.scrollIntoViewIfNeeded(true);
+  li.style.cssText = &quot;float: right; height: 40px; width: 40px;&quot;;
+  document.body.offsetHeight;
+  li.style.cssText = &quot;&quot;;
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -1,3 +1,34 @@
</span><ins>+2016-10-24  Zalan Bujtas  &lt;zalan@apple.com&gt;
+
+        Do not update selection rect on dirty lineboxes.
+        https://bugs.webkit.org/show_bug.cgi?id=163862
+        &lt;rdar://problem/28813156&gt;
+
+        Reviewed by Simon Fraser.
+
+        In certain cases RenderBlock::updateFirstLetter() triggers
+        unwanted render tree mutation while the caller assumes intact renderers.
+        This patch ensures that no renderers gets destroyed while computing the preferred widths
+        when we are outside of layout context.
+
+        Test: fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computePreferredLogicalWidths):
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderBlock.h:
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::updateFirstLetter):
+        * rendering/RenderRubyRun.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::updateFirstLetter):
+        * rendering/RenderTable.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::updateFirstLetter):
+        * rendering/svg/RenderSVGText.h:
+
</ins><span class="cx"> 2016-10-21  Zalan Bujtas  &lt;zalan@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Do not mutate the render tree while collecting selection repaint rects.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingRenderBlockcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.cpp (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.cpp        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.cpp        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -2758,7 +2758,9 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(preferredLogicalWidthsDirty());
</span><span class="cx"> 
</span><del>-    updateFirstLetter();
</del><ins>+    // FIXME: Do not even try to reshuffle first letter renderers when we are not in layout
+    // until after webkit.org/b/163848 is fixed.
+    updateFirstLetter(view().frameView().isInRenderTreeLayout() ? RenderTreeMutationIsAllowed::Yes : RenderTreeMutationIsAllowed::No);
</ins><span class="cx"> 
</span><span class="cx">     m_minPreferredLogicalWidth = 0;
</span><span class="cx">     m_maxPreferredLogicalWidth = 0;
</span><span class="lines">@@ -3308,7 +3310,7 @@
</span><span class="cx">         firstLetterContainer = nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderBlock::updateFirstLetter()
</del><ins>+void RenderBlock::updateFirstLetter(RenderTreeMutationIsAllowed mutationAllowedOrNot)
</ins><span class="cx"> {
</span><span class="cx">     RenderObject* firstLetterObj;
</span><span class="cx">     RenderElement* firstLetterContainer;
</span><span class="lines">@@ -3329,6 +3331,8 @@
</span><span class="cx">     if (!is&lt;RenderText&gt;(*firstLetterObj))
</span><span class="cx">         return;
</span><span class="cx"> 
</span><ins>+    if (mutationAllowedOrNot != RenderTreeMutationIsAllowed::Yes)
+        return;
</ins><span class="cx">     // Our layout state is not valid for the repaints we are going to trigger by
</span><span class="cx">     // adding and removing children of firstLetterContainer.
</span><span class="cx">     LayoutStateDisabler layoutStateDisabler(view());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingRenderBlockh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.h (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.h        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.h        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -243,7 +243,8 @@
</span><span class="cx">     LayoutUnit collapsedMarginBeforeForChild(const RenderBox&amp; child) const;
</span><span class="cx">     LayoutUnit collapsedMarginAfterForChild(const RenderBox&amp; child) const;
</span><span class="cx"> 
</span><del>-    virtual void updateFirstLetter();
</del><ins>+    enum class RenderTreeMutationIsAllowed { Yes, No };
+    virtual void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes);
</ins><span class="cx">     void getFirstLetter(RenderObject*&amp; firstLetter, RenderElement*&amp; firstLetterContainer, RenderObject* skipObject = nullptr);
</span><span class="cx"> 
</span><span class="cx">     virtual void scrollbarsChanged(bool /*horizontalScrollbarChanged*/, bool /*verticalScrollbarChanged*/) { }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingRenderListItemcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -268,7 +268,7 @@
</span><span class="cx">     if (!m_marker)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    // FIXME: Do not even try reposition the marker when we are not in layout
</del><ins>+    // FIXME: Do not even try to reposition the marker when we are not in layout
</ins><span class="cx">     // until after we fixed webkit.org/b/163789.
</span><span class="cx">     if (!view().frameView().isInRenderTreeLayout())
</span><span class="cx">         return;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingRenderRubyRuncpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.cpp (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.cpp        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.cpp        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -101,7 +101,7 @@
</span><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderRubyRun::updateFirstLetter()
</del><ins>+void RenderRubyRun::updateFirstLetter(RenderTreeMutationIsAllowed)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingRenderRubyRunh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.h (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.h        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.h        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -60,7 +60,7 @@
</span><span class="cx">     void removeChild(RenderObject&amp;) override;
</span><span class="cx"> 
</span><span class="cx">     RenderBlock* firstLineBlock() const override;
</span><del>-    void updateFirstLetter() override;
</del><ins>+    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) override;
</ins><span class="cx"> 
</span><span class="cx">     void getOverhang(bool firstLine, RenderObject* startRenderer, RenderObject* endRenderer, float&amp; startOverhang, float&amp; endOverhang) const;
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingRenderTablecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.cpp (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.cpp        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.cpp        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -1458,7 +1458,7 @@
</span><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderTable::updateFirstLetter()
</del><ins>+void RenderTable::updateFirstLetter(RenderTreeMutationIsAllowed)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingRenderTableh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.h (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.h        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.h        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -303,7 +303,7 @@
</span><span class="cx">     void invalidateCachedColumnOffsets();
</span><span class="cx"> 
</span><span class="cx">     RenderBlock* firstLineBlock() const final;
</span><del>-    void updateFirstLetter() final;
</del><ins>+    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) final;
</ins><span class="cx">     
</span><span class="cx">     void updateLogicalWidth() final;
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingsvgRenderSVGTextcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.cpp (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.cpp        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.cpp        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -545,7 +545,7 @@
</span><span class="cx"> 
</span><span class="cx"> // Fix for &lt;rdar://problem/8048875&gt;. We should not render :first-letter CSS Style
</span><span class="cx"> // in a SVG text element context.
</span><del>-void RenderSVGText::updateFirstLetter()
</del><ins>+void RenderSVGText::updateFirstLetter(RenderTreeMutationIsAllowed)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorerenderingsvgRenderSVGTexth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.h (207984 => 207985)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.h        2016-10-27 10:45:54 UTC (rev 207984)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.h        2016-10-27 10:56:19 UTC (rev 207985)
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx">     std::unique_ptr&lt;RootInlineBox&gt; createRootInlineBox() override;
</span><span class="cx"> 
</span><span class="cx">     RenderBlock* firstLineBlock() const override;
</span><del>-    void updateFirstLetter() override;
</del><ins>+    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) override;
</ins><span class="cx"> 
</span><span class="cx">     bool shouldHandleSubtreeMutations() const;
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>