<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[210001] trunk/Source/WebCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/210001">210001</a></dd>
<dt>Author</dt> <dd>zalan@apple.com</dd>
<dt>Date</dt> <dd>2016-12-19 15:41:45 -0800 (Mon, 19 Dec 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Do not position detached list item marker.
https://bugs.webkit.org/show_bug.cgi?id=166035
<rdar://problem/29175235>
Reviewed by Simon Fraser.
In certain (non-reproducible) cases, the list item marker can get detached from the tree
during layout and when in RenderListItem::positionListMarker() we dereference the marker's parent, we crash.
In addition to the null check, this patch adds an ASSERTION to catch such cases early on.
Unable to reproduce.
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::moveChildTo):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::removeChildInternal):
* rendering/RenderElement.h:
* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::layout):
(WebCore::RenderListItem::positionListMarker):
* rendering/RenderListItem.h:
* rendering/RenderListMarker.h:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxModelObjectcpp">trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderElementcpp">trunk/Source/WebCore/rendering/RenderElement.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderElementh">trunk/Source/WebCore/rendering/RenderElement.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderListItemcpp">trunk/Source/WebCore/rendering/RenderListItem.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderListItemh">trunk/Source/WebCore/rendering/RenderListItem.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderListMarkerh">trunk/Source/WebCore/rendering/RenderListMarker.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (210000 => 210001)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2016-12-19 23:39:05 UTC (rev 210000)
+++ trunk/Source/WebCore/ChangeLog 2016-12-19 23:41:45 UTC (rev 210001)
</span><span class="lines">@@ -1,3 +1,28 @@
</span><ins>+2016-12-19 Zalan Bujtas <zalan@apple.com>
+
+ Do not position detached list item marker.
+ https://bugs.webkit.org/show_bug.cgi?id=166035
+ <rdar://problem/29175235>
+
+ Reviewed by Simon Fraser.
+
+ In certain (non-reproducible) cases, the list item marker can get detached from the tree
+ during layout and when in RenderListItem::positionListMarker() we dereference the marker's parent, we crash.
+ In addition to the null check, this patch adds an ASSERTION to catch such cases early on.
+
+ Unable to reproduce.
+
+ * rendering/RenderBoxModelObject.cpp:
+ (WebCore::RenderBoxModelObject::moveChildTo):
+ * rendering/RenderElement.cpp:
+ (WebCore::RenderElement::removeChildInternal):
+ * rendering/RenderElement.h:
+ * rendering/RenderListItem.cpp:
+ (WebCore::RenderListItem::layout):
+ (WebCore::RenderListItem::positionListMarker):
+ * rendering/RenderListItem.h:
+ * rendering/RenderListMarker.h:
+
</ins><span class="cx"> 2016-12-19 Gavin Barraclough <barraclough@apple.com>
</span><span class="cx">
</span><span class="cx"> [CSS Parser] Enable CSS Deferred Parsing
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxModelObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp (210000 => 210001)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp 2016-12-19 23:39:05 UTC (rev 210000)
+++ trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp 2016-12-19 23:41:45 UTC (rev 210001)
</span><span class="lines">@@ -57,6 +57,9 @@
</span><span class="cx"> #include "Settings.h"
</span><span class="cx"> #include "TransformState.h"
</span><span class="cx"> #include <wtf/NeverDestroyed.h>
</span><ins>+#if !ASSERT_DISABLED
+#include <wtf/SetForScope.h>
+#endif
</ins><span class="cx">
</span><span class="cx"> namespace WebCore {
</span><span class="cx">
</span><span class="lines">@@ -2495,6 +2498,9 @@
</span><span class="cx">
</span><span class="cx"> void RenderBoxModelObject::moveChildTo(RenderBoxModelObject* toBoxModelObject, RenderObject* child, RenderObject* beforeChild, bool fullRemoveInsert)
</span><span class="cx"> {
</span><ins>+#if !ASSERT_DISABLED
+ SetForScope<bool> reparentingChild(m_reparentingChild, true);
+#endif
</ins><span class="cx"> // We assume that callers have cleared their positioned objects list for child moves (!fullRemoveInsert) so the
</span><span class="cx"> // positioned renderer maps don't become stale. It would be too slow to do the map lookup on each call.
</span><span class="cx"> ASSERT(!fullRemoveInsert || !is<RenderBlock>(*this) || !downcast<RenderBlock>(*this).hasPositionedObjects());
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderElementcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderElement.cpp (210000 => 210001)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderElement.cpp 2016-12-19 23:39:05 UTC (rev 210000)
+++ trunk/Source/WebCore/rendering/RenderElement.cpp 2016-12-19 23:41:45 UTC (rev 210001)
</span><span class="lines">@@ -56,6 +56,9 @@
</span><span class="cx"> #include "RenderLayerCompositor.h"
</span><span class="cx"> #include "RenderLineBreak.h"
</span><span class="cx"> #include "RenderListItem.h"
</span><ins>+#if !ASSERT_DISABLED
+#include "RenderListMarker.h"
+#endif
</ins><span class="cx"> #include "RenderNamedFlowThread.h"
</span><span class="cx"> #include "RenderRegion.h"
</span><span class="cx"> #include "RenderTableCaption.h"
</span><span class="lines">@@ -641,6 +644,11 @@
</span><span class="cx">
</span><span class="cx"> if (AXObjectCache* cache = document().existingAXObjectCache())
</span><span class="cx"> cache->childrenChanged(this);
</span><ins>+#if !ASSERT_DISABLED
+ // Check if the marker gets detached while laying out the list item.
+ if (is<RenderListMarker>(oldChild))
+ ASSERT(m_reparentingChild || !downcast<RenderListMarker>(oldChild).listItem().inLayout());
+#endif
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> RenderBlock* RenderElement::containingBlockForFixedPosition() const
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderElementh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderElement.h (210000 => 210001)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderElement.h 2016-12-19 23:39:05 UTC (rev 210000)
+++ trunk/Source/WebCore/rendering/RenderElement.h 2016-12-19 23:41:45 UTC (rev 210001)
</span><span class="lines">@@ -273,6 +273,9 @@
</span><span class="cx">
</span><span class="cx"> void removeFromRenderFlowThreadIncludingDescendants(bool shouldUpdateState);
</span><span class="cx"> void adjustFlowThreadStateOnContainingBlockChangeIfNeeded();
</span><ins>+#if !ASSERT_DISABLED
+ bool m_reparentingChild { false };
+#endif
</ins><span class="cx">
</span><span class="cx"> private:
</span><span class="cx"> RenderElement(ContainerNode&, RenderStyle&&, BaseTypeFlags);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderListItemcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderListItem.cpp (210000 => 210001)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderListItem.cpp 2016-12-19 23:39:05 UTC (rev 210000)
+++ trunk/Source/WebCore/rendering/RenderListItem.cpp 2016-12-19 23:41:45 UTC (rev 210001)
</span><span class="lines">@@ -38,6 +38,9 @@
</span><span class="cx"> #include "RenderTable.h"
</span><span class="cx"> #include "RenderView.h"
</span><span class="cx"> #include "StyleInheritedData.h"
</span><ins>+#if !ASSERT_DISABLED
+#include <wtf/SetForScope.h>
+#endif
</ins><span class="cx"> #include <wtf/StackStats.h>
</span><span class="cx"> #include <wtf/StdLibExtras.h>
</span><span class="cx">
</span><span class="lines">@@ -317,6 +320,9 @@
</span><span class="cx"> ASSERT(needsLayout());
</span><span class="cx">
</span><span class="cx"> insertOrMoveMarkerRendererIfNeeded();
</span><ins>+#if !ASSERT_DISABLED
+ SetForScope<bool> inListItemLayout(m_inLayout, true);
+#endif
</ins><span class="cx"> RenderBlockFlow::layout();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -341,96 +347,100 @@
</span><span class="cx">
</span><span class="cx"> void RenderListItem::positionListMarker()
</span><span class="cx"> {
</span><del>- if (m_marker && m_marker->parent()->isBox() && !m_marker->isInside() && m_marker->inlineBoxWrapper()) {
- LayoutUnit markerOldLogicalLeft = m_marker->logicalLeft();
- LayoutUnit blockOffset = 0;
- LayoutUnit lineOffset = 0;
- for (RenderBox* o = m_marker->parentBox(); o != this; o = o->parentBox()) {
- blockOffset += o->logicalTop();
- lineOffset += o->logicalLeft();
- }
</del><ins>+ if (!m_marker || !m_marker->parent() || !m_marker->parent()->isBox())
+ return;
</ins><span class="cx">
</span><del>- bool adjustOverflow = false;
- LayoutUnit markerLogicalLeft;
- bool hitSelfPaintingLayer = false;
-
- const RootInlineBox& rootBox = m_marker->inlineBoxWrapper()->root();
- LayoutUnit lineTop = rootBox.lineTop();
- LayoutUnit lineBottom = rootBox.lineBottom();
</del><ins>+ if (m_marker->isInside() || !m_marker->inlineBoxWrapper())
+ return;
</ins><span class="cx">
</span><del>- // FIXME: Need to account for relative positioning in the layout overflow.
- if (style().isLeftToRightDirection()) {
- LayoutUnit leftLineOffset = logicalLeftOffsetForLine(blockOffset, logicalLeftOffsetForLine(blockOffset, DoNotIndentText), false);
- markerLogicalLeft = leftLineOffset - lineOffset - paddingStart() - borderStart() + m_marker->marginStart();
- m_marker->inlineBoxWrapper()->adjustLineDirectionPosition(markerLogicalLeft - markerOldLogicalLeft);
- for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
- LayoutRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect(lineTop, lineBottom);
- LayoutRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect(lineTop, lineBottom);
- if (markerLogicalLeft < newLogicalVisualOverflowRect.x() && !hitSelfPaintingLayer) {
- newLogicalVisualOverflowRect.setWidth(newLogicalVisualOverflowRect.maxX() - markerLogicalLeft);
- newLogicalVisualOverflowRect.setX(markerLogicalLeft);
- if (box == &rootBox)
- adjustOverflow = true;
- }
- if (markerLogicalLeft < newLogicalLayoutOverflowRect.x()) {
- newLogicalLayoutOverflowRect.setWidth(newLogicalLayoutOverflowRect.maxX() - markerLogicalLeft);
- newLogicalLayoutOverflowRect.setX(markerLogicalLeft);
- if (box == &rootBox)
- adjustOverflow = true;
- }
- box->setOverflowFromLogicalRects(newLogicalLayoutOverflowRect, newLogicalVisualOverflowRect, lineTop, lineBottom);
- if (box->renderer().hasSelfPaintingLayer())
- hitSelfPaintingLayer = true;
</del><ins>+ LayoutUnit markerOldLogicalLeft = m_marker->logicalLeft();
+ LayoutUnit blockOffset = 0;
+ LayoutUnit lineOffset = 0;
+ for (RenderBox* o = m_marker->parentBox(); o != this; o = o->parentBox()) {
+ blockOffset += o->logicalTop();
+ lineOffset += o->logicalLeft();
+ }
+
+ bool adjustOverflow = false;
+ LayoutUnit markerLogicalLeft;
+ bool hitSelfPaintingLayer = false;
+
+ const RootInlineBox& rootBox = m_marker->inlineBoxWrapper()->root();
+ LayoutUnit lineTop = rootBox.lineTop();
+ LayoutUnit lineBottom = rootBox.lineBottom();
+
+ // FIXME: Need to account for relative positioning in the layout overflow.
+ if (style().isLeftToRightDirection()) {
+ LayoutUnit leftLineOffset = logicalLeftOffsetForLine(blockOffset, logicalLeftOffsetForLine(blockOffset, DoNotIndentText), false);
+ markerLogicalLeft = leftLineOffset - lineOffset - paddingStart() - borderStart() + m_marker->marginStart();
+ m_marker->inlineBoxWrapper()->adjustLineDirectionPosition(markerLogicalLeft - markerOldLogicalLeft);
+ for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
+ LayoutRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect(lineTop, lineBottom);
+ LayoutRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect(lineTop, lineBottom);
+ if (markerLogicalLeft < newLogicalVisualOverflowRect.x() && !hitSelfPaintingLayer) {
+ newLogicalVisualOverflowRect.setWidth(newLogicalVisualOverflowRect.maxX() - markerLogicalLeft);
+ newLogicalVisualOverflowRect.setX(markerLogicalLeft);
+ if (box == &rootBox)
+ adjustOverflow = true;
</ins><span class="cx"> }
</span><del>- } else {
- LayoutUnit rightLineOffset = logicalRightOffsetForLine(blockOffset, logicalRightOffsetForLine(blockOffset, DoNotIndentText), false);
- markerLogicalLeft = rightLineOffset - lineOffset + paddingStart() + borderStart() + m_marker->marginEnd();
- m_marker->inlineBoxWrapper()->adjustLineDirectionPosition(markerLogicalLeft - markerOldLogicalLeft);
- for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
- LayoutRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect(lineTop, lineBottom);
- LayoutRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect(lineTop, lineBottom);
- if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalVisualOverflowRect.maxX() && !hitSelfPaintingLayer) {
- newLogicalVisualOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - newLogicalVisualOverflowRect.x());
- if (box == &rootBox)
- adjustOverflow = true;
- }
- if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalLayoutOverflowRect.maxX()) {
- newLogicalLayoutOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - newLogicalLayoutOverflowRect.x());
- if (box == &rootBox)
- adjustOverflow = true;
- }
- box->setOverflowFromLogicalRects(newLogicalLayoutOverflowRect, newLogicalVisualOverflowRect, lineTop, lineBottom);
-
- if (box->renderer().hasSelfPaintingLayer())
- hitSelfPaintingLayer = true;
</del><ins>+ if (markerLogicalLeft < newLogicalLayoutOverflowRect.x()) {
+ newLogicalLayoutOverflowRect.setWidth(newLogicalLayoutOverflowRect.maxX() - markerLogicalLeft);
+ newLogicalLayoutOverflowRect.setX(markerLogicalLeft);
+ if (box == &rootBox)
+ adjustOverflow = true;
</ins><span class="cx"> }
</span><ins>+ box->setOverflowFromLogicalRects(newLogicalLayoutOverflowRect, newLogicalVisualOverflowRect, lineTop, lineBottom);
+ if (box->renderer().hasSelfPaintingLayer())
+ hitSelfPaintingLayer = true;
</ins><span class="cx"> }
</span><del>-
- if (adjustOverflow) {
- LayoutRect markerRect(markerLogicalLeft + lineOffset, blockOffset, m_marker->width(), m_marker->height());
- if (!style().isHorizontalWritingMode())
- markerRect = markerRect.transposedRect();
- RenderBox* o = m_marker;
- bool propagateVisualOverflow = true;
- bool propagateLayoutOverflow = true;
- do {
- o = o->parentBox();
- if (o->hasOverflowClip())
- propagateVisualOverflow = false;
- if (is<RenderBlock>(*o)) {
- if (propagateVisualOverflow)
- downcast<RenderBlock>(*o).addVisualOverflow(markerRect);
- if (propagateLayoutOverflow)
- downcast<RenderBlock>(*o).addLayoutOverflow(markerRect);
- }
- if (o->hasOverflowClip())
- propagateLayoutOverflow = false;
- if (o->hasSelfPaintingLayer())
- propagateVisualOverflow = false;
- markerRect.moveBy(-o->location());
- } while (o != this && propagateVisualOverflow && propagateLayoutOverflow);
</del><ins>+ } else {
+ LayoutUnit rightLineOffset = logicalRightOffsetForLine(blockOffset, logicalRightOffsetForLine(blockOffset, DoNotIndentText), false);
+ markerLogicalLeft = rightLineOffset - lineOffset + paddingStart() + borderStart() + m_marker->marginEnd();
+ m_marker->inlineBoxWrapper()->adjustLineDirectionPosition(markerLogicalLeft - markerOldLogicalLeft);
+ for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
+ LayoutRect newLogicalVisualOverflowRect = box->logicalVisualOverflowRect(lineTop, lineBottom);
+ LayoutRect newLogicalLayoutOverflowRect = box->logicalLayoutOverflowRect(lineTop, lineBottom);
+ if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalVisualOverflowRect.maxX() && !hitSelfPaintingLayer) {
+ newLogicalVisualOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - newLogicalVisualOverflowRect.x());
+ if (box == &rootBox)
+ adjustOverflow = true;
+ }
+ if (markerLogicalLeft + m_marker->logicalWidth() > newLogicalLayoutOverflowRect.maxX()) {
+ newLogicalLayoutOverflowRect.setWidth(markerLogicalLeft + m_marker->logicalWidth() - newLogicalLayoutOverflowRect.x());
+ if (box == &rootBox)
+ adjustOverflow = true;
+ }
+ box->setOverflowFromLogicalRects(newLogicalLayoutOverflowRect, newLogicalVisualOverflowRect, lineTop, lineBottom);
+
+ if (box->renderer().hasSelfPaintingLayer())
+ hitSelfPaintingLayer = true;
</ins><span class="cx"> }
</span><span class="cx"> }
</span><ins>+
+ if (adjustOverflow) {
+ LayoutRect markerRect(markerLogicalLeft + lineOffset, blockOffset, m_marker->width(), m_marker->height());
+ if (!style().isHorizontalWritingMode())
+ markerRect = markerRect.transposedRect();
+ RenderBox* o = m_marker;
+ bool propagateVisualOverflow = true;
+ bool propagateLayoutOverflow = true;
+ do {
+ o = o->parentBox();
+ if (o->hasOverflowClip())
+ propagateVisualOverflow = false;
+ if (is<RenderBlock>(*o)) {
+ if (propagateVisualOverflow)
+ downcast<RenderBlock>(*o).addVisualOverflow(markerRect);
+ if (propagateLayoutOverflow)
+ downcast<RenderBlock>(*o).addLayoutOverflow(markerRect);
+ }
+ if (o->hasOverflowClip())
+ propagateLayoutOverflow = false;
+ if (o->hasSelfPaintingLayer())
+ propagateVisualOverflow = false;
+ markerRect.moveBy(-o->location());
+ } while (o != this && propagateVisualOverflow && propagateLayoutOverflow);
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void RenderListItem::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderListItemh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderListItem.h (210000 => 210001)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderListItem.h 2016-12-19 23:39:05 UTC (rev 210000)
+++ trunk/Source/WebCore/rendering/RenderListItem.h 2016-12-19 23:41:45 UTC (rev 210001)
</span><span class="lines">@@ -57,6 +57,9 @@
</span><span class="cx">
</span><span class="cx"> void didDestroyListMarker() { m_marker = nullptr; }
</span><span class="cx">
</span><ins>+#if !ASSERT_DISABLED
+ bool inLayout() const { return m_inLayout; }
+#endif
</ins><span class="cx"> private:
</span><span class="cx"> const char* renderName() const override { return "RenderListItem"; }
</span><span class="cx">
</span><span class="lines">@@ -84,7 +87,9 @@
</span><span class="cx"> int m_explicitValue;
</span><span class="cx"> RenderListMarker* m_marker;
</span><span class="cx"> mutable int m_value;
</span><del>-
</del><ins>+#if !ASSERT_DISABLED
+ bool m_inLayout { false };
+#endif
</ins><span class="cx"> bool m_hasExplicitValue : 1;
</span><span class="cx"> mutable bool m_isValueUpToDate : 1;
</span><span class="cx"> bool m_notInList : 1;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderListMarkerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderListMarker.h (210000 => 210001)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderListMarker.h 2016-12-19 23:39:05 UTC (rev 210000)
+++ trunk/Source/WebCore/rendering/RenderListMarker.h 2016-12-19 23:41:45 UTC (rev 210001)
</span><span class="lines">@@ -44,6 +44,10 @@
</span><span class="cx">
</span><span class="cx"> void updateMarginsAndContent();
</span><span class="cx">
</span><ins>+#if !ASSERT_DISABLED
+ RenderListItem& listItem() const { return m_listItem; }
+#endif
+
</ins><span class="cx"> private:
</span><span class="cx"> void element() const = delete;
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>