<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[210369] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/210369">210369</a></dd>
<dt>Author</dt> <dd>zalan@apple.com</dd>
<dt>Date</dt> <dd>2017-01-05 12:24:59 -0800 (Thu, 05 Jan 2017)</dd>
</dl>
<h3>Log Message</h3>
<pre>Mark the dedicated root linebox for trailing floats in empty inlines dirty.
https://bugs.webkit.org/show_bug.cgi?id=166732
<rdar://problem/29100419>
Reviewed by Antti Koivisto.
Source/WebCore:
We normally attach floating boxes to the last root linebox. However when the floatbox is preceded by a <br>
we generate a dedicated root linebox (TrailingFloatsRootInlineBox) for the floatbox.
When this floatbox is a RenderInline descendant and this RenderInline does not generate lineboxes (it's ancestor RenderBlockFlow does)
we have to make sure that this special root linebox gets marked dirty when the associated floatbox changes.
(Unfortunately through the recursive calls on dirtyLinesFromChangedChild(), we lose the information about
the "changed child" since the inlines propagates the marking logic to the RenderBlockFlow, see FIXME.)
Test: fast/inline/trailing-floats-inline-crash2.html
* rendering/RenderLineBoxList.cpp:
(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
LayoutTests:
* fast/inline/trailing-floats-inline-crash2-expected.txt: Added.
* fast/inline/trailing-floats-inline-crash2.html: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLineBoxListcpp">trunk/Source/WebCore/rendering/RenderLineBoxList.cpp</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastinlinetrailingfloatsinlinecrash2expectedtxt">trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastinlinetrailingfloatsinlinecrash2html">trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2.html</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (210368 => 210369)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2017-01-05 20:15:27 UTC (rev 210368)
+++ trunk/LayoutTests/ChangeLog 2017-01-05 20:24:59 UTC (rev 210369)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2017-01-05 Zalan Bujtas <zalan@apple.com>
+
+ Mark the dedicated root linebox for trailing floats in empty inlines dirty.
+ https://bugs.webkit.org/show_bug.cgi?id=166732
+ <rdar://problem/29100419>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/inline/trailing-floats-inline-crash2-expected.txt: Added.
+ * fast/inline/trailing-floats-inline-crash2.html: Added.
+
</ins><span class="cx"> 2017-01-04 Brian Burg <bburg@apple.com>
</span><span class="cx">
</span><span class="cx"> Web Inspector: Test.html should support globals reportInternalError, reportUnhandledRejection, reportUncaughtException
</span></span></pre></div>
<a id="trunkLayoutTestsfastinlinetrailingfloatsinlinecrash2expectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt (0 => 210369)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2-expected.txt 2017-01-05 20:24:59 UTC (rev 210369)
</span><span class="lines">@@ -0,0 +1,5 @@
</span><ins>+PASS if no crash or assert.
+
+
+foobar foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar
+
</ins></span></pre></div>
<a id="trunkLayoutTestsfastinlinetrailingfloatsinlinecrash2html"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2.html (0 => 210369)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2.html (rev 0)
+++ trunk/LayoutTests/fast/inline/trailing-floats-inline-crash2.html 2017-01-05 20:24:59 UTC (rev 210369)
</span><span class="lines">@@ -0,0 +1,18 @@
</span><ins>+<!DOCTYPE html>
+<html>
+<head>
+<style>
+ :last-child {float:left;}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+PASS if no crash or assert.
+<div></div><br><div><pre></pre><br><span><strike>
+foobar foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar<br><input></strike><script>
+document.body.offsetHeight;</script></span></div>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (210368 => 210369)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2017-01-05 20:15:27 UTC (rev 210368)
+++ trunk/Source/WebCore/ChangeLog 2017-01-05 20:24:59 UTC (rev 210369)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2017-01-05 Zalan Bujtas <zalan@apple.com>
+
+ Mark the dedicated root linebox for trailing floats in empty inlines dirty.
+ https://bugs.webkit.org/show_bug.cgi?id=166732
+ <rdar://problem/29100419>
+
+ Reviewed by Antti Koivisto.
+
+ We normally attach floating boxes to the last root linebox. However when the floatbox is preceded by a <br>
+ we generate a dedicated root linebox (TrailingFloatsRootInlineBox) for the floatbox.
+ When this floatbox is a RenderInline descendant and this RenderInline does not generate lineboxes (it's ancestor RenderBlockFlow does)
+ we have to make sure that this special root linebox gets marked dirty when the associated floatbox changes.
+ (Unfortunately through the recursive calls on dirtyLinesFromChangedChild(), we lose the information about
+ the "changed child" since the inlines propagates the marking logic to the RenderBlockFlow, see FIXME.)
+
+ Test: fast/inline/trailing-floats-inline-crash2.html
+
+ * rendering/RenderLineBoxList.cpp:
+ (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+
</ins><span class="cx"> 2017-01-05 Antoine Quint <graouts@apple.com>
</span><span class="cx">
</span><span class="cx"> [Cocoa] Both modern-media-controls/images/iOS modern-media-controls/images/macOS are installed on both platforms
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLineBoxListcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLineBoxList.cpp (210368 => 210369)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2017-01-05 20:15:27 UTC (rev 210368)
+++ trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2017-01-05 20:24:59 UTC (rev 210369)
</span><span class="lines">@@ -323,8 +323,8 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // Try to figure out which line box we belong in. First try to find a previous
- // line box by examining our siblings. If we didn't find a line box, then use our
</del><ins>+ // Try to figure out which line box we belong in. First try to find a previous
+ // line box by examining our siblings. If we didn't find a line box, then use our
</ins><span class="cx"> // parent's first line box.
</span><span class="cx"> RootInlineBox* box = nullptr;
</span><span class="cx"> RenderObject* current;
</span><span class="lines">@@ -370,11 +370,11 @@
</span><span class="cx"> if (box) {
</span><span class="cx"> box->markDirty();
</span><span class="cx">
</span><del>- // dirty the adjacent lines that might be affected
</del><ins>+ // Dirty the adjacent lines that might be affected.
</ins><span class="cx"> // NOTE: we dirty the previous line because RootInlineBox objects cache
</span><span class="cx"> // the address of the first object on the next line after a BR, which we may be
</span><del>- // invalidating here. For more info, see how RenderBlock::layoutInlineChildren
- // calls setLineBreakInfo with the result of findNextLineBreak. findNextLineBreak,
</del><ins>+ // invalidating here. For more info, see how RenderBlock::layoutInlineChildren
+ // calls setLineBreakInfo with the result of findNextLineBreak. findNextLineBreak,
</ins><span class="cx"> // despite the name, actually returns the first RenderObject after the BR.
</span><span class="cx"> // <rdar://problem/3849947> "Typing after pasting line does not appear until after window resize."
</span><span class="cx"> if (RootInlineBox* prevBox = box->prevRootBox())
</span><span class="lines">@@ -384,11 +384,13 @@
</span><span class="cx"> // necessary some of the time, in situations involving BRs.
</span><span class="cx"> if (RootInlineBox* nextBox = box->nextRootBox()) {
</span><span class="cx"> nextBox->markDirty();
</span><del>-
- // Special root box for floats may be added at the end of the list. If this occurs with BRs we need to invalidate it explicitly.
- if (auto* nextNextBox = nextBox->nextRootBox()) {
- if (nextNextBox->isTrailingFloatsRootInlineBox())
- nextNextBox->markDirty();
</del><ins>+ // Dedicated linebox for floats may be added as the last rootbox. If this occurs with BRs inside inlines that propagte their lineboxes to
+ // the parent flow, we need to invalidate it explicitly.
+ // FIXME: We should be able to figure out the actual "changed child" even when we are calling through empty inlines recursively.
+ if (is<RenderInline>(child) && !downcast<RenderInline>(child).firstLineBoxIncludingCulling()) {
+ auto* lastRootBox = nextBox->blockFlow().lastRootBox();
+ if (lastRootBox->isTrailingFloatsRootInlineBox() && !lastRootBox->isDirty())
+ lastRootBox->markDirty();
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> }
</span></span></pre>
</div>
</div>
</body>
</html>