LayoutTests/ChangeLog

2013-01-29  Mihai Maerean  <mmaerean@adobe.com>

        [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())

        https://bugs.webkit.org/show_bug.cgi?id=104517

        Reviewed by NOBODY (OOPS!).

        The RenderObject::inRenderFlowThread bit could have become disconnected from the fact that the RenderObject

        has (or not) an enclosing RenderFlowThread.

        The cause of this was that, when setting or removing the parent of a RenderObject, the inRenderFlowThread flags

        wasn't being set/reset for the children too.

        This is now fixed by calling the new setInRenderFlowThreadRecursive.

        The ASSERT was hit for anonymous blocks when detaching the document.

        The test starts from such an anonymous block and the detaches the body of document.

        * fast/regions/detaching-regions-with-anonymous-blocks-expected.txt: Added.

        * fast/regions/detaching-regions-with-anonymous-blocks.html: Added.

2013-01-29  Ádám Kallai  <kadam@inf.u-szeged.hu>

        [Qt] Unreviewed gardening. Skip failing tests after r140927.

LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks-expected.txt

Bug 104517: [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())

This test PASSES if it does not CRASH or ASSERT.

LayoutTests/fast/regions/detaching-regions-with-anonymous-blocks.html

<!doctype html>

<html>

    <head>

        <!--

        This "script" is actually a template and is needed because we must remove the body in order to reproduce the bug.

        If the content of this template would be placed in the body, it would be deleted when the body is removed.

        -->

        <script id="testResult" type="text/template">

            <p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=104517">104517</a>: [CSSRegions] Assertion failure

                in Node::detach (!renderer || renderer->inRenderFlowThread())</p>

            <p>This test PASSES if it does not CRASH or ASSERT.</p>

        </script>

        <script type="text/javascript">

            if(window.testRunner){

                window.testRunner.dumpAsText();

                window.testRunner.waitUntilDone();

            }

            window.addEventListener("load",function(){

                // This previously caused the ASSERT to be hit.

                var p = document.body.parentNode;

                p.removeChild(document.body);

                // Display the human readable test result.

                var b = document.createElement("body");

                p.appendChild(b);

                b.innerHTML = document.getElementById("testResult").innerHTML;

                if(window.testRunner)

                    window.testRunner.notifyDone();

            });

        </script>

    </head>

    <body>

        <div style="-webkit-flow-into: flow;">

            <span>

                a <p>b</p> a

            </span>

        </div>

        <div id="region" style="-webkit-flow-from:flow;"></div>

    </body>

</html>

Source/WebCore/ChangeLog

2013-01-29  Mihai Maerean  <mmaerean@adobe.com>

        [CSSRegions] Assertion failure in Node::detach (!renderer || renderer->inRenderFlowThread())

        https://bugs.webkit.org/show_bug.cgi?id=104517

        Reviewed by NOBODY (OOPS!).

        The RenderObject::inRenderFlowThread bit could have become disconnected from the fact that the RenderObject

        has (or not) an enclosing RenderFlowThread.

        The cause of this was that, when setting or removing the parent of a RenderObject, the inRenderFlowThread flags

        wasn't being set/reset for the children too.

        This is now fixed by calling the new setInRenderFlowThreadRecursive.

        The ASSERT was hit for anonymous blocks when detaching the document.

        Test: fast/regions/detaching-regions-with-anonymous-blocks.html

        * rendering/RenderObject.cpp:

        (WebCore::RenderObject::setInRenderFlowThreadRecursive):

        (WebCore):

        * rendering/RenderObject.h:

        (WebCore::RenderObject::setParent):

        (RenderObject):

2013-01-29  Andrey Lushnikov  <lushnikov@chromium.org>

        Web Inspector: fix bottom span in token highlight in DTE

Source/WebCore/rendering/RenderObject.cpp

@@bool RenderObject::isHTMLMarquee() const

    return node() && node()->renderer() == this && node()->hasTagName(marqueeTag);

}

void RenderObject::setInRenderFlowThreadRecursive(bool b)

{

    setInRenderFlowThread(b);

    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {

        ASSERT(b != child->inRenderFlowThread());

        child->setInRenderFlowThreadRecursive(b);

    }

}

void RenderObject::addChild(RenderObject* newChild, RenderObject* beforeChild)

{

    RenderObjectChildList* children = virtualChildren();

Source/WebCore/rendering/RenderObject.h

@@protected:

    void setParent(RenderObject* parent)

    {

        m_parent = parent;

273 if (parent && parent->inRenderFlowThread())

274 setInRenderFlowThread(true);

273 if (parent && parent->inRenderFlowThread() && !inRenderFlowThread())

274 setInRenderFlowThreadRecursive(true);

275275 else if (!parent && inRenderFlowThread())

276 setInRenderFlowThread(false);

276 setInRenderFlowThreadRecursive(false);

    }

    //////////////////////////////////////////

private:

@@public:

    bool inRenderFlowThread() const { return m_bitfields.inRenderFlowThread(); }

    void setInRenderFlowThread(bool b = true) { m_bitfields.setInRenderFlowThread(b); }

437 void setInRenderFlowThreadRecursive(bool = true);

438

    virtual bool requiresForcedStyleRecalcPropagation() const { return false; }

#if ENABLE(MATHML)