Commit 9f7cc0e3 authored by mitz@apple.com's avatar mitz@apple.com

WebCore:

        Reviewed by Darin Adler.

        - fix https://bugs.webkit.org/show_bug.cgi?id=19519
          <rdar://problem/6007345> DOM modification causes stack exhaustion (BUTTON OBJECT COLGROUP)

        Test: fast/table/prepend-in-anonymous-table.html

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addChildToFlow): Added code to handle the case
        of inserting before a child that has been wrapped by an anonymous table,
        in which case if the new child is the type that needs to be in a table,
        it is inserted into the table, and otherwise it is inserted before the
        table.
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::addChild): Added table-column-group alongside
        table-caption as content that can exist inside an anonymous table
        without being wrapped in a table section.

LayoutTests:

        Reviewed by Darin Adler.

        - test for https://bugs.webkit.org/show_bug.cgi?id=19519
          <rdar://problem/6007345> DOM modification causes stack exhaustion (BUTTON OBJECT COLGROUP)

        * fast/table/prepend-in-anonymous-table.html: Added.
        * platform/mac/fast/table/prepend-in-anonymous-table-expected.checksum: Added.
        * platform/mac/fast/table/prepend-in-anonymous-table-expected.png: Added.
        * platform/mac/fast/table/prepend-in-anonymous-table-expected.txt: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@34692 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 4be20eed
2008-06-20 Dan Bernstein <mitz@apple.com>
Reviewed by Darin Adler.
- test for https://bugs.webkit.org/show_bug.cgi?id=19519
<rdar://problem/6007345> DOM modification causes stack exhaustion (BUTTON OBJECT COLGROUP)
* fast/table/prepend-in-anonymous-table.html: Added.
* platform/mac/fast/table/prepend-in-anonymous-table-expected.checksum: Added.
* platform/mac/fast/table/prepend-in-anonymous-table-expected.png: Added.
* platform/mac/fast/table/prepend-in-anonymous-table-expected.txt: Added.
2008-06-20 David Hyatt <hyatt@apple.com>
Allow CSS variables to support arbitrary expressions as values instead of just a single term.
<body>
<p>
Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=19519">https://bugs.webkit.org/show_bug.cgi?id=19519</a> DOM modification causes stack exhaustion (BUTTON OBJECT COLGROUP)</i>.
</p>
<script>
var tableParts = [
"table-cell",
"table-row",
"table-row-group",
"table-column-group",
"table-caption"
];
var childTypes = [
"block",
"inline",
"table-cell",
"table-row",
"table-row-group",
"table-column-group",
"table-caption"
];
for (var i = 0; i < tableParts.length; ++i) {
for (var j = 0; j < childTypes.length; ++j) {
document.body.appendChild(document.createElement("pre")).appendChild(document.createTextNode("Prepending " + childTypes[j] + " to " + tableParts[i] + ":"));
var container = document.createElement("div");
var tablePart = document.createElement("div");
tablePart.style.display = tableParts[i];
container.appendChild(tablePart);
document.body.appendChild(container);
document.body.offsetTop;
var newChild = document.createElement("div");
newChild.style.display = childTypes[j];
container.insertBefore(newChild, tablePart);
document.body.offsetTop;
// The above should have the same render tree as you get when
// you do it all at once, like this:
document.body.appendChild(container.cloneNode(true));
document.body.offsetTop;
}
}
</script>
</body>
bdd395e8b67d5493dfa174755790b2fa
\ No newline at end of file
2008-06-20 Dan Bernstein <mitz@apple.com>
Reviewed by Darin Adler.
- fix https://bugs.webkit.org/show_bug.cgi?id=19519
<rdar://problem/6007345> DOM modification causes stack exhaustion (BUTTON OBJECT COLGROUP)
Test: fast/table/prepend-in-anonymous-table.html
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::addChildToFlow): Added code to handle the case
of inserting before a child that has been wrapped by an anonymous table,
in which case if the new child is the type that needs to be in a table,
it is inserted into the table, and otherwise it is inserted before the
table.
* rendering/RenderTable.cpp:
(WebCore::RenderTable::addChild): Added table-column-group alongside
table-caption as content that can exist inside an anonymous table
without being wrapped in a table section.
2008-06-20 David Hyatt <hyatt@apple.com>
Allow CSS variables to support arbitrary expressions as values instead of just a single term.
......@@ -154,19 +154,39 @@ void RenderBlock::addChildToFlow(RenderObject* newChild, RenderObject* beforeChi
bool madeBoxesNonInline = false;
// If the requested beforeChild is not one of our children, then this is most likely because
// there is an anonymous block box within this object that contains the beforeChild. So
// just insert the child into the anonymous block box instead of here.
// If the requested beforeChild is not one of our children, then this is because
// there is an anonymous container within this object that contains the beforeChild.
if (beforeChild && beforeChild->parent() != this) {
ASSERT(beforeChild->parent());
ASSERT(beforeChild->parent()->isAnonymousBlock());
RenderObject* anonymousChild = beforeChild->parent();
ASSERT(anonymousChild);
if (newChild->isInline() || beforeChild->parent()->firstChild() != beforeChild)
beforeChild->parent()->addChild(newChild, beforeChild);
else
addChildToFlow(newChild, beforeChild->parent());
while (anonymousChild->parent() != this)
anonymousChild = anonymousChild->parent();
return;
ASSERT(anonymousChild->isAnonymous());
if (anonymousChild->isAnonymousBlock()) {
// Insert the child into the anonymous block box instead of here.
if (newChild->isInline() || beforeChild->parent()->firstChild() != beforeChild)
beforeChild->parent()->addChild(newChild, beforeChild);
else
addChildToFlow(newChild, beforeChild->parent());
return;
}
ASSERT(anonymousChild->isTable());
if (newChild->isTableCol() && newChild->style()->display() == TABLE_COLUMN_GROUP
|| newChild->isRenderBlock() && newChild->style()->display() == TABLE_CAPTION
|| newChild->isTableSection()
|| newChild->isTableRow()
|| newChild->isTableCell()) {
// Insert into the anonymous table.
anonymousChild->addChild(newChild, beforeChild);
return;
}
// Go on to insert before the anonymous table.
beforeChild = anonymousChild;
}
// A block has to either have all of its children inline, or all of its children as blocks.
......
......@@ -189,14 +189,14 @@ void RenderTable::addChild(RenderObject* child, RenderObject* beforeChild)
}
RenderObject* lastBox = beforeChild;
while (lastBox && lastBox->parent()->isAnonymous() && !lastBox->isTableSection() && lastBox->style()->display() != TABLE_CAPTION)
while (lastBox && lastBox->parent()->isAnonymous() && !lastBox->isTableSection() && lastBox->style()->display() != TABLE_CAPTION && lastBox->style()->display() != TABLE_COLUMN_GROUP)
lastBox = lastBox->parent();
if (lastBox && lastBox->isAnonymous() && !isAfterContent(lastBox)) {
lastBox->addChild(child, beforeChild);
return;
}
if (beforeChild && !beforeChild->isTableSection() && beforeChild->style()->display() != TABLE_CAPTION)
if (beforeChild && !beforeChild->isTableSection() && beforeChild->style()->display() != TABLE_CAPTION && beforeChild->style()->display() != TABLE_COLUMN_GROUP)
beforeChild = 0;
RenderTableSection* section = new (renderArena()) RenderTableSection(document() /* anonymous */);
RenderStyle* newStyle = new (renderArena()) RenderStyle();
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment