Please sign in to comment.
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Folding anonymous blocks should not result in deleting content.
https://bugs.webkit.org/show_bug.cgi?id=184339 <rdar://problem/37327428> Reviewed by Antti Koivisto. Source/WebCore: While folding multiple anonymous blocks (moving the children from next sibling over to previous sibling) we should ensure that the block we are about to destroy does not gain new descendants. In case of 4 sibling anonymous blocks (A B C D), while destroying B 1. we move C's children to A and destroy C. 2. While destroying C, we notice B and C as sibling anonymous blocks and we move D's children over to B (even though B is going to be destroyed as we climb back on the stack). In this patch, B is detached from the tree before we start moving renderers around so that a subsequent folding won't find B anymore as a candidate. Test: fast/block/crash-while-folding-anonymous-blocks.html * rendering/updating/RenderTreeBuilderBlock.cpp: (WebCore::RenderTreeBuilder::Block::detach): LayoutTests: * fast/block/crash-when-subtree-is-still-attached-expected.txt: Progressing. This test does not intend to remove "foobar" text at all. * fast/block/crash-while-folding-anonymous-blocks-expected.txt: Added. * fast/block/crash-while-folding-anonymous-blocks.html: Added. Canonical link: https://commits.webkit.org/199896@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230313 268f45cc-cd09-0410-ab3c-d52691b4dbfc
- Loading branch information
Showing with 80 additions and 9 deletions.
- +13 −0 LayoutTests/ChangeLog
- +1 −0 LayoutTests/fast/block/crash-when-subtree-is-still-attached-expected.txt
- +1 −0 LayoutTests/fast/block/crash-while-folding-anonymous-blocks-expected.txt
- +33 −0 LayoutTests/fast/block/crash-while-folding-anonymous-blocks.html
- +23 −0 Source/WebCore/ChangeLog
- +9 −9 Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp