Summary: | REGRESSION: Crash when loading document with absolutely positioned generated content on inline element | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Elliott Sprehn <esprehn> | ||||||||
Component: | Layout and Rendering | Assignee: | Dave Hyatt <hyatt> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | mitz | ||||||||
Priority: | P1 | Keywords: | HasReduction, Regression | ||||||||
Version: | 523.x (Safari 3) | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.4 | ||||||||||
Attachments: |
|
Description
Elliott Sprehn
2007-05-01 00:01:13 PDT
Created attachment 14288 [details]
Webkit Crash Log
Created attachment 14289 [details]
Crash Test Case
This test case causes Webkit to crash immediately when loading the page.
Test case uses :after, but this happens with :before too.
The test case generates a positioned inline. The pseudo element's initial style is display: inline; position: absolute. adjustRenderStyle fixes it, changing display to block. But then updateBeforeAfterContentForContainer has the following: if (isInlineFlow() && !pseudoElementStyle->isDisplayInlineType()) // According to the CSS2 spec (the end of section 12.1), the only allowed // display values for the pseudo style are NONE and INLINE for inline flows. // FIXME: CSS2.1 lifted this restriction, but block display types will crash. // For now we at least relax the restriction to allow all inline types like inline-block // and inline-table. pseudoElementStyle->setDisplay(INLINE); which resets display to inline, leading to the crash. I don't know what crash the comment is talking about. Firefox 3 still seems to enforce the inline/none rule, but Opera allows block. To fix this bug, you can either allow block for positioned generated content (assuming it won't trigger the crash the comment talks about), disallow positioned generated content (which would mimic Firefox, it seems), or allow block for all generated content (and fix the mysterious crash from the comment, if it still exists; that would match Opera). Mitz, if you allow block display types (of non-positioned generated content) inside an inline, you will crash. The flow splitting code can't deal with having to split flows across a generated content block. The mutation of the style was a stopgap measure until those crashes could be dealt with. This can be fixed by checking the position and float properties as well, since we can safely allow both floating and positioned content inside an inline. Created attachment 14303 [details]
Patch to allow positioned/floating generated content inside an inline.
Will include the test case attached to the bug when I land.
Comment on attachment 14303 [details]
Patch to allow positioned/floating generated content inside an inline.
darin sez r=me
Fixed |