Cherry-pick 272448.104@safari-7618-branch (8737c03). https://bugs.web…

…kit.org/show_bug.cgi?id=267198 ASAN_ILL | WebCore::RenderTableSection::layoutRows; WebCore::RenderTable::simplifiedNormalFlowLayout; WebCore::RenderBlock::simplifiedLayout. https://bugs.webkit.org/show_bug.cgi?id=267198 rdar://113940614 Reviewed by Alan Baradlay. Always setChildNeedsLayout for sections to make sure normalChildNeedsLayout is flagged, as for pagination we need to run a full layout on child table sections even when the initial change, otherwise requires simplified layout only. * LayoutTests/fast/multicol/pagination/pagination-diry-sections-crash-expected.txt: Added. * LayoutTests/fast/multicol/pagination/pagination-diry-sections-crash.html: Added. * LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt: re-baseline again, adding end of line back. * Source/WebCore/rendering/RenderTable.cpp: (WebCore::RenderTable::markForPaginationRelayoutIfNeeded): Canonical link: https://commits.webkit.org/272448.104@safari-7618-branch Canonical link: https://commits.webkit.org/274313.66@webkitglib/2.44
WebKit · Mar 11, 2024 · 73ee7cb · 73ee7cb
1 parent a625ceb
commit 73ee7cb
Show file tree

Hide file tree

Showing 4 changed files with 57 additions and 2 deletions.
diff --git a/LayoutTests/fast/multicol/pagination/pagination-diry-sections-crash-expected.txt b/LayoutTests/fast/multicol/pagination/pagination-diry-sections-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no assert in Debug.
diff --git a/LayoutTests/fast/multicol/pagination/pagination-diry-sections-crash.html b/LayoutTests/fast/multicol/pagination/pagination-diry-sections-crash.html
@@ -0,0 +1,54 @@
+<head style="display:none">
+    <style>
+        i,
+        :invalid {
+            position: absolute;
+        }
+
+        *:empty {
+            -webkit-column-rule-width: medium;
+        }
+
+        *:scope,
+        ruby {
+            overflow-y: -webkit-paged-y;
+            column-rule-width: 81em;
+            position: static;
+        }
+
+        :read-only {
+            display: table-row-group;
+            perspective: 0px;
+        }
+    </style>
+</head>
+
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+
+    function main() {
+        try { 
+            var attrs = document.getElementsByTagName("select"); 
+            var v118 = attrs.item(42 % attrs.length); 
+            x2.after(v118); 
+        } catch { }
+    }
+</script>
+
+<body onload="main()">
+    PASS if no assert in Debug.
+    <ol>
+    </ol>
+    <menu>
+        <menu>
+        </menu>
+        <object>
+        </object>
+    </menu>
+    <cite id="x2">
+        <i lang="jw">
+            <select></select>
+        </i>
+    </cite>
+</body>
diff --git a/...ted/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt b/...ted/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt
@@ -36,3 +36,4 @@ msup:
 munder:
 munderover:
 semantics:
+
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
@@ -1679,8 +1679,7 @@ void RenderTable::markForPaginationRelayoutIfNeeded()
         return;
 
     // When a table moves, we have to dirty all of the sections too.
-    if (!needsLayout())
-        setChildNeedsLayout(MarkOnlyThis);
+    setChildNeedsLayout(MarkOnlyThis);
     for (auto& child : childrenOfType<RenderTableSection>(*this)) {
         if (!child.needsLayout())
             child.setChildNeedsLayout(MarkOnlyThis);