haikuwebkit/LayoutTests/fast/table/table-split-on-insert-with-...

35 lines
889 B
HTML
Raw Permalink Normal View History

CrashOnOverflow in WebCore::RenderTable::cellBefore(WebCore::RenderTableCell const*) https://bugs.webkit.org/show_bug.cgi?id=225949 Reviewed by Antti Koivisto. Source/WebCore: The table section maintains a grid of rows and columns. This grid is used to jump to cells directly during layout (as opposed to tree walking). It needs to be re-populated on tree mutations e.g when a new row is added to the table. RenderTableSection::willInsertTableRow assumes that rows and cells are inserted subsequently, after each other and it's ok to ignore the grid invalidation on appends as the subsequent ::addCell() call takes care of the grid. However in some continuation split cases, we re-parent complete rows under table sections which means no subsequent ::addCell() calls. This patch addresses this case by using the same pattern we have for block continuation invalidation in RenderTreeBuilder::splitAnonymousBoxesAroundChild(). Test: fast/table/table-split-on-insert-with-section-crash.html * rendering/updating/RenderTreeBuilder.cpp: (WebCore::RenderTreeBuilder::markBoxForRelayoutAfterSplit): (WebCore::markBoxForRelayoutAfterSplit): Deleted. * rendering/updating/RenderTreeBuilder.h: * rendering/updating/RenderTreeBuilderInline.cpp: (WebCore::RenderTreeBuilder::Inline::splitInlines): LayoutTests: * fast/table/table-split-on-insert-with-section-crash-expected.txt: Added. * fast/table/table-split-on-insert-with-section-crash.html: Added. Canonical link: https://commits.webkit.org/238258@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@278219 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-05-28 19:51:32 +00:00
<!DOCTYPE html>
<style>
body {
border-collapse: collapse;
}
:read-write::after {
content: '';
}
:first-child::first-letter {
background: grey;
}
</style>
<script>
if (window.testRunner)
testRunner.dumpAsText();
onload = () => {
document.documentElement.appendChild(document.createElement('input'));
document.execCommand('SelectAll');
document.execCommand('Copy');
let aElement = document.createElement('a');
document.body.appendChild(aElement);
let row = document.createElement('tr');
aElement.appendChild(row);
row.appendChild(document.createElement('input'));
row.appendChild(document.createElement('td'));
getSelection().modify('move', 'left', 'sentenceboundary');
document.designMode = 'on';
document.execCommand('PasteAsQuotation');
document.styleSheets[0].insertRule(`#nnn {}`);
};
</script>
<!-- Pass if no crash or assert. -->