Skip to content
Permalink
Browse files
[RenderTreeBuilder] Cleanup the inline box wrappers when moving subtrees
https://bugs.webkit.org/show_bug.cgi?id=224342
<rdar://76349279>

Reviewed by Antti Koivisto.

When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should release its inline box wrapper. This inline box wrapper (e.g. InlineFlowBox)
will eventually be destroy during the subsequent line layout of the original BFC.

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::move):


Canonical link: https://commits.webkit.org/236339@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@275761 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
alanbujtas committed Apr 9, 2021
1 parent 0a5a77b commit e584f554d87e9ed53a9d6f79a902217213e35ff5
Showing 2 changed files with 20 additions and 0 deletions.
@@ -1,3 +1,17 @@
2021-04-09 Zalan Bujtas <zalan@apple.com>

[RenderTreeBuilder] Cleanup the inline box wrappers when moving subtrees
https://bugs.webkit.org/show_bug.cgi?id=224342
<rdar://76349279>

Reviewed by Antti Koivisto.

When an inline box is moved over to a different BFC (<span>), any inline level descendant (<span><img></span>) should release its inline box wrapper. This inline box wrapper (e.g. InlineFlowBox)
will eventually be destroy during the subsequent line layout of the original BFC.

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::move):

2021-04-09 Carlos Garcia Campos <cgarcia@igalia.com>

[GTK][WPE] Bump libsoup3 version to 2.99.3
@@ -486,6 +486,12 @@ void RenderTreeBuilder::move(RenderBoxModelObject& from, RenderBoxModelObject& t
auto childToMove = detachFromRenderElement(from, child, WillBeDestroyed::No, RenderObject::IsInternalMove::Yes);
attachToRenderElementInternal(to, WTFMove(childToMove), beforeChild, RenderObject::IsInternalMove::Yes);
}
if (is<RenderInline>(child)) {
// When moving a subtree out of a BFC we need to make sure that the line boxes generated for the inline tree are not accessible anymore from the renderers.
// They eventually get destroyed during the inline layout of the original BFC.
for (auto& descendant : descendantsOfType<RenderBox>(downcast<RenderInline>(child)))
descendant.setInlineBoxWrapper(nullptr);
}
}

void RenderTreeBuilder::move(RenderBoxModelObject& from, RenderBoxModelObject& to, RenderObject& child, NormalizeAfterInsertion normalizeAfterInsertion)

0 comments on commit e584f55

Please sign in to comment.