|Summary:||[ListItems] Render tree should be all clean by the end of FrameView::layout().|
|Component:||Layout and Rendering||Assignee:||zalan <zalan>|
|Severity:||Normal||CC:||commit-queue, esprehn+autocc, glenn, kondapallykalyan, simon.fraser|
|Version:||WebKit Nightly Build|
|Bug Depends on:|
Description zalan 2016-09-30 19:33:36 PDT
We fail to clean all the renderers while running the following test: LayoutTests/imported/blink/fast/lists/list-item-without-list-reparented-crash.html
Comment 1 zalan 2016-10-01 21:14:46 PDT
Created attachment 290461 [details] Test reduction This happens when we start mutating the renderer tree while laying it out. <body> <span> <li> 1. floating <li> is being laid out by the body (<span> is the direct parent but the containing block is the body) 2. we insert a new renderer (list marker) and dirty the ancestor chain 3. we never get to lay out the <span>
Comment 2 zalan 2016-10-03 14:42:33 PDT
(In reply to comment #1) > Created attachment 290461 [details] > Test reduction > > This happens when we start mutating the renderer tree while laying it out. > <body> > <span> > <li> > 1. floating <li> is being laid out by the body (<span> is the direct parent > but the containing block is the body) > 2. we insert a new renderer (list marker) and dirty the ancestor chain > 3. we never get to lay out the <span> Scratch the containing block part, it's just a floating renderer and not an out of flow positioned one.
Comment 4 zalan 2016-10-03 16:23:25 PDT
Alternatively we could make RenderObject::markContainingBlocksForLayout smarter and figure out the floating case, but I am sure we don't have all the information at this point to make that decision.
Comment 5 Simon Fraser (smfr) 2016-10-03 16:24:11 PDT
Comment on attachment 290534 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=290534&action=review > Source/WebCore/rendering/RenderListItem.cpp:290 > + // FIXME: We should stop mutating the renderer tree during layout. I think this comment would be better if it described why you added these lines. Something like "mark the parent dirty so that when the marker dirties ancestors, it stops at the parent."
Comment 8 WebKit Commit Bot 2016-10-03 20:36:24 PDT
Comment on attachment 290559 [details] Patch Clearing flags on attachment: 290559 Committed r206765: <http://trac.webkit.org/changeset/206765>
Comment 9 WebKit Commit Bot 2016-10-03 20:36:28 PDT
All reviewed patches have been landed. Closing bug.