<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[248223] releases/WebKitGTK/webkit-2.24</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/248223">248223</a></dd>
<dt>Author</dt> <dd>mcatanzaro@igalia.com</dd>
<dt>Date</dt> <dd>2019-08-03 20:22:48 -0700 (Sat, 03 Aug 2019)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/245158">r245158</a> - Do not mix inline and block level boxes.
https://bugs.webkit.org/show_bug.cgi?id=197462
<rdar://problem/50369362>

Reviewed by Antti Koivisto.

Source/WebCore:

This patch tightens the remove-anonymous-wrappers logic by checking if the removal would
produce an inline-block sibling mix.
When a block level box is removed from the tree, we check if after the removal the anonymous sibling block
boxes are still needed or whether we can removed them as well (and have only inline level child boxes).
In addition to checking if the container is anonymous and is part of a continuation, we also need to check
if collapsing it (and by that moving its children one level up) would cause a inline-block box mix.

Test: fast/ruby/continuation-and-column-spanner-crash.html

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):
* rendering/updating/RenderTreeBuilderContinuation.cpp:
(WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):

LayoutTests:

* fast/ruby/continuation-and-column-spanner-crash-expected.txt: Added.
* fast/ruby/continuation-and-column-spanner-crash.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit224LayoutTestsChangeLog">releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit224SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit224SourceWebCorerenderingupdatingRenderTreeBuildercpp">releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit224SourceWebCorerenderingupdatingRenderTreeBuilderContinuationcpp">releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit224LayoutTestsfastrubycontinuationandcolumnspannercrashexpectedtxt">releases/WebKitGTK/webkit-2.24/LayoutTests/fast/ruby/continuation-and-column-spanner-crash-expected.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit224LayoutTestsfastrubycontinuationandcolumnspannercrashhtml">releases/WebKitGTK/webkit-2.24/LayoutTests/fast/ruby/continuation-and-column-spanner-crash.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit224LayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog (248222 => 248223)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog     2019-08-04 03:22:45 UTC (rev 248222)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog        2019-08-04 03:22:48 UTC (rev 248223)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2019-05-08  Zalan Bujtas  <zalan@apple.com>
+
+        Do not mix inline and block level boxes.
+        https://bugs.webkit.org/show_bug.cgi?id=197462
+        <rdar://problem/50369362>
+
+        Reviewed by Antti Koivisto.
+
+        * fast/ruby/continuation-and-column-spanner-crash-expected.txt: Added.
+        * fast/ruby/continuation-and-column-spanner-crash.html: Added.
+
</ins><span class="cx"> 2019-05-04  Tadeu Zagallo  <tzagallo@apple.com>
</span><span class="cx"> 
</span><span class="cx">         TypedArrays should not store properties that are canonical numeric indices
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit224LayoutTestsfastrubycontinuationandcolumnspannercrashexpectedtxt"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/ruby/continuation-and-column-spanner-crash-expected.txt (0 => 248223)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/ruby/continuation-and-column-spanner-crash-expected.txt                          (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/ruby/continuation-and-column-spanner-crash-expected.txt     2019-08-04 03:22:48 UTC (rev 248223)
</span><span class="lines">@@ -0,0 +1,2 @@
</span><ins>+PASS if no crash or assert. 
+
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit224LayoutTestsfastrubycontinuationandcolumnspannercrashhtml"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.24/LayoutTests/fast/ruby/continuation-and-column-spanner-crash.html (0 => 248223)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.24/LayoutTests/fast/ruby/continuation-and-column-spanner-crash.html                          (rev 0)
+++ releases/WebKitGTK/webkit-2.24/LayoutTests/fast/ruby/continuation-and-column-spanner-crash.html     2019-08-04 03:22:48 UTC (rev 248223)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+PASS if no crash or assert.
+<ruby><rtc><span><details open="false"><span id=span2></span></details></span><div id=div3></div></rtc><rt id=rt2></rt></ruby><script>
+document.body.offsetHeight;
+rt2.remove();
+span2.remove();
+document.body.offsetHeight;
+div3.style.cssText = "column-span: all";
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit224SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog (248222 => 248223)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog  2019-08-04 03:22:45 UTC (rev 248222)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog     2019-08-04 03:22:48 UTC (rev 248223)
</span><span class="lines">@@ -1,3 +1,25 @@
</span><ins>+2019-05-09  Zalan Bujtas  <zalan@apple.com>
+
+        Do not mix inline and block level boxes.
+        https://bugs.webkit.org/show_bug.cgi?id=197462
+        <rdar://problem/50369362>
+
+        Reviewed by Antti Koivisto.
+
+        This patch tightens the remove-anonymous-wrappers logic by checking if the removal would
+        produce an inline-block sibling mix.
+        When a block level box is removed from the tree, we check if after the removal the anonymous sibling block
+        boxes are still needed or whether we can removed them as well (and have only inline level child boxes).
+        In addition to checking if the container is anonymous and is part of a continuation, we also need to check
+        if collapsing it (and by that moving its children one level up) would cause a inline-block box mix.
+
+        Test: fast/ruby/continuation-and-column-spanner-crash.html
+
+        * rendering/updating/RenderTreeBuilder.cpp:
+        (WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):
+        * rendering/updating/RenderTreeBuilderContinuation.cpp:
+        (WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):
+
</ins><span class="cx"> 2019-03-20  Michael Catanzaro  <mcatanzaro@igalia.com>
</span><span class="cx"> 
</span><span class="cx">         Remove copyRef() calls added in r243163
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit224SourceWebCorerenderingupdatingRenderTreeBuildercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp (248222 => 248223)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp   2019-08-04 03:22:45 UTC (rev 248222)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilder.cpp      2019-08-04 03:22:48 UTC (rev 248223)
</span><span class="lines">@@ -683,15 +683,28 @@
</span><span class="cx">     // otherwise we can proceed to stripping solitary anonymous wrappers from the inlines.
</span><span class="cx">     // FIXME: We should also handle split inlines here - we exclude them at the moment by returning
</span><span class="cx">     // if we find a continuation.
</span><del>-    auto* current = blockParent.firstChild();
-    while (current && ((current->isAnonymousBlock() && !downcast<RenderBlock>(*current).isContinuation()) || current->style().isFloating() || current->style().hasOutOfFlowPosition()))
-        current = current->nextSibling();
</del><ins>+    Optional<bool> shouldAllChildrenBeInline;
+    for (auto* current = blockParent.firstChild(); current; current = current->nextSibling()) {
+        if (current->style().isFloating() || current->style().hasOutOfFlowPosition())
+            continue;
+        if (!current->isAnonymousBlock() || downcast<RenderBlock>(*current).isContinuation())
+            return;
+        // Anonymous block not in continuation. Check if it holds a set of inline or block children and try not to mix them.
+        auto* firstChild = current->firstChildSlow();
+        if (!firstChild)
+            continue;
+        auto isInlineLevelBox = firstChild->isInline();
+        if (!shouldAllChildrenBeInline.hasValue()) {
+            shouldAllChildrenBeInline = isInlineLevelBox;
+            continue;
+        }
+        // Mixing inline and block level boxes?
+        if (*shouldAllChildrenBeInline != isInlineLevelBox)
+            return;
+    }
</ins><span class="cx"> 
</span><del>-    if (current)
-        return;
-
-    RenderObject* next;
-    for (current = blockParent.firstChild(); current; current = next) {
</del><ins>+    RenderObject* next = nullptr;
+    for (auto* current = blockParent.firstChild(); current; current = next) {
</ins><span class="cx">         next = current->nextSibling();
</span><span class="cx">         if (current->isAnonymousBlock())
</span><span class="cx">             blockBuilder().dropAnonymousBoxChild(blockParent, downcast<RenderBlock>(*current));
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit224SourceWebCorerenderingupdatingRenderTreeBuilderContinuationcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.cpp (248222 => 248223)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.cpp       2019-08-04 03:22:45 UTC (rev 248222)
+++ releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.cpp  2019-08-04 03:22:48 UTC (rev 248223)
</span><span class="lines">@@ -37,8 +37,11 @@
</span><span class="cx"> 
</span><span class="cx"> void RenderTreeBuilder::Continuation::cleanupOnDestroy(RenderBoxModelObject& renderer)
</span><span class="cx"> {
</span><del>-    if (!renderer.continuation() || renderer.isContinuation())
</del><ins>+    if (!renderer.continuation() || renderer.isContinuation()) {
+        if (renderer.hasContinuationChainNode())
+            renderer.removeFromContinuationChain();
</ins><span class="cx">         return;
</span><ins>+    }
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(renderer.hasContinuationChainNode());
</span><span class="cx">     ASSERT(renderer.continuationChainNode());
</span></span></pre>
</div>
</div>

</body>
</html>