<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[284871] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/284871">284871</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2021-10-26 09:00:24 -0700 (Tue, 26 Oct 2021)</dd>
</dl>

<h3>Log Message</h3>
<pre>ASSERT(parent->element()) triggered in Styleable::fromRenderer
https://bugs.webkit.org/show_bug.cgi?id=232185

Patch by Gabriel Nava Marino <gnavamarino@apple.com> on 2021-10-26
Reviewed by Tim Nguyen and Antti Koivisto.

Source/WebCore:

The marker renderer can be set as a child of RenderMultiColumnFlowThread
instead of RenderListItem in some instances. RenderMultiColumnFlowThread is
an anonymous box and doesn't have an associated element, so we instead should
loop through the parents until we find the RenderListItem which does have an
associated element.

Test: fast/animation/css-animation-marker-crash.html

* style/Styleable.cpp:
(WebCore::Styleable::fromRenderer):

LayoutTests:

* fast/animation/css-animation-marker-crash-expected.txt: Added.
* fast/animation/css-animation-marker-crash.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorestyleStyleablecpp">trunk/Source/WebCore/style/Styleable.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastanimationcssanimationmarkercrashexpectedtxt">trunk/LayoutTests/fast/animation/css-animation-marker-crash-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastanimationcssanimationmarkercrashhtml">trunk/LayoutTests/fast/animation/css-animation-marker-crash.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (284870 => 284871)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog      2021-10-26 15:55:48 UTC (rev 284870)
+++ trunk/LayoutTests/ChangeLog 2021-10-26 16:00:24 UTC (rev 284871)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2021-10-26  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        ASSERT(parent->element()) triggered in Styleable::fromRenderer
+        https://bugs.webkit.org/show_bug.cgi?id=232185
+
+        Reviewed by Tim Nguyen and Antti Koivisto.
+
+        * fast/animation/css-animation-marker-crash-expected.txt: Added.
+        * fast/animation/css-animation-marker-crash.html: Added.
+
</ins><span class="cx"> 2021-10-26  Martin Robinson  <mrobinson@webkit.org>
</span><span class="cx"> 
</span><span class="cx">         Update import of css/css-transform WPT tests
</span></span></pre></div>
<a id="trunkLayoutTestsfastanimationcssanimationmarkercrashexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/animation/css-animation-marker-crash-expected.txt (0 => 284871)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/animation/css-animation-marker-crash-expected.txt                         (rev 0)
+++ trunk/LayoutTests/fast/animation/css-animation-marker-crash-expected.txt    2021-10-26 16:00:24 UTC (rev 284871)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+PASS if this doesn't crash
</ins></span></pre></div>
<a id="trunkLayoutTestsfastanimationcssanimationmarkercrashhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/animation/css-animation-marker-crash.html (0 => 284871)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/animation/css-animation-marker-crash.html                         (rev 0)
+++ trunk/LayoutTests/fast/animation/css-animation-marker-crash.html    2021-10-26 16:00:24 UTC (rev 284871)
</span><span class="lines">@@ -0,0 +1,19 @@
</span><ins>+<style>
+  @keyframes a0 {
+    from {
+      opacity: 0;
+    }
+  }
+  ::marker {
+    animation-name: a0;
+    animation-duration: 1ms;
+  }
+  li {
+    columns: 3;
+  }
+</style>
+<li>PASS if this doesn't crash</li>
+<script>
+  if (window.testRunner)
+      testRunner.dumpAsText(); 
+</script>
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (284870 => 284871)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog   2021-10-26 15:55:48 UTC (rev 284870)
+++ trunk/Source/WebCore/ChangeLog      2021-10-26 16:00:24 UTC (rev 284871)
</span><span class="lines">@@ -1,3 +1,21 @@
</span><ins>+2021-10-26  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        ASSERT(parent->element()) triggered in Styleable::fromRenderer
+        https://bugs.webkit.org/show_bug.cgi?id=232185
+
+        Reviewed by Tim Nguyen and Antti Koivisto.
+
+        The marker renderer can be set as a child of RenderMultiColumnFlowThread
+        instead of RenderListItem in some instances. RenderMultiColumnFlowThread is
+        an anonymous box and doesn't have an associated element, so we instead should
+        loop through the parents until we find the RenderListItem which does have an
+        associated element.
+
+        Test: fast/animation/css-animation-marker-crash.html
+
+        * style/Styleable.cpp:
+        (WebCore::Styleable::fromRenderer):
+
</ins><span class="cx"> 2021-10-26  Philippe Normand  <pnormand@igalia.com>
</span><span class="cx"> 
</span><span class="cx">         REGRESSION(242280@main) fast/mediastream/captureStream/canvas3d.html is timing out
</span></span></pre></div>
<a id="trunkSourceWebCorestyleStyleablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/style/Styleable.cpp (284870 => 284871)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/style/Styleable.cpp 2021-10-26 15:55:48 UTC (rev 284870)
+++ trunk/Source/WebCore/style/Styleable.cpp    2021-10-26 16:00:24 UTC (rev 284871)
</span><span class="lines">@@ -61,11 +61,12 @@
</span><span class="cx">         }
</span><span class="cx">         break;
</span><span class="cx">     case PseudoId::Marker:
</span><del>-        if (auto* parent = renderer.parent()) {
-            ASSERT(parent->element());
-            ASSERT(is<RenderListItem>(parent));
-            ASSERT(downcast<RenderListItem>(*parent).markerRenderer() == &renderer);
-            return Styleable(*parent->element(), PseudoId::Marker);
</del><ins>+        if (auto* ancestor = renderer.parent()) {
+            while (ancestor && !ancestor->element())
+                ancestor = ancestor->parent();
+            ASSERT(is<RenderListItem>(ancestor));
+            ASSERT(downcast<RenderListItem>(ancestor)->markerRenderer() == &renderer);
+            return Styleable(*ancestor->element(), PseudoId::Marker);
</ins><span class="cx">         }
</span><span class="cx">         break;
</span><span class="cx">     case PseudoId::After:
</span></span></pre>
</div>
</div>

</body>
</html>