Bug 178332 - Text nodes with display:contents parent should render as if they were wrapped in an unstyled <span>
Summary: Text nodes with display:contents parent should render as if they were wrapped...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
: 177060 (view as bug list)
Depends on:
Blocks: 157477
  Show dependency treegraph
 
Reported: 2017-10-16 00:27 PDT by Antti Koivisto
Modified: 2017-10-30 03:02 PDT (History)
12 users (show)

See Also:


Attachments
patch (20.06 KB, patch)
2017-10-16 00:41 PDT, Antti Koivisto
no flags Details | Formatted Diff | Diff
patch (20.37 KB, patch)
2017-10-16 01:23 PDT, Antti Koivisto
no flags Details | Formatted Diff | Diff
patch (20.37 KB, patch)
2017-10-16 11:53 PDT, Antti Koivisto
no flags Details | Formatted Diff | Diff
patch (20.87 KB, patch)
2017-10-17 01:20 PDT, Antti Koivisto
rniwa: review+
Details | Formatted Diff | Diff
patch (20.79 KB, patch)
2017-10-17 02:51 PDT, Antti Koivisto
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Antti Koivisto 2017-10-16 00:27:47 PDT
According to https://github.com/w3c/csswg-drafts/issues/1118

<div style="display:contents;color:green">text</div>

must result in green text even though div doesn't generate a box.
Comment 1 Antti Koivisto 2017-10-16 00:41:14 PDT
Created attachment 323877 [details]
patch
Comment 2 Antti Koivisto 2017-10-16 01:23:45 PDT
Created attachment 323879 [details]
patch
Comment 3 Antti Koivisto 2017-10-16 11:53:45 PDT
Created attachment 323920 [details]
patch
Comment 4 Alexey Proskuryakov 2017-10-16 13:46:29 PDT
This patch is currently killing every EWS bot that tries to process it, looking into it...
Comment 5 Chris Dumez 2017-10-16 13:48:04 PDT
(In reply to Alexey Proskuryakov from comment #4)
> This patch is currently killing every EWS bot that tries to process it,
> looking into it...

Antti has some serious power :D
Comment 6 Alexey Proskuryakov 2017-10-16 13:50:57 PDT
There are multiple failures when running tests for this patch manually on the bot, not sure how real they are

[8914/45246] fast/css-generated-content/details-summary-before-after.html failed unexpectedly (text diff)
[13699/45246] fast/html/details-add-child-1.html failed unexpectedly (text diff)
[13788/45246] fast/html/details-add-child-2.html failed unexpectedly (text diff)
[13875/45246] fast/html/details-add-details-child-1.html failed unexpectedly (text diff)
[13963/45246] fast/html/details-add-details-child-2.html failed unexpectedly (text diff)
[14052/45246] fast/html/details-add-summary-1-and-click.html failed unexpectedly (text diff)
[14142/45246] fast/html/details-add-summary-1.html failed unexpectedly (text diff)
[14228/45246] fast/html/details-add-summary-2-and-click.html failed unexpectedly (text diff)
[14378/45246] fast/html/details-add-summary-2.html failed unexpectedly (text diff)
[14456/45246] fast/html/details-add-summary-3-and-click.html failed unexpectedly (text diff)
[14523/45246] fast/html/details-add-summary-3.html failed unexpectedly (text diff)
[14591/45246] fast/html/details-add-summary-4-and-click.html failed unexpectedly (text diff)
[14665/45246] fast/html/details-add-summary-4.html failed unexpectedly (text diff)
[14677/45246] fast/multicol/span/clone-anonymous-block-non-inline-child-crash.html failed unexpectedly (text diff)
[14713/45246] fast/html/details-add-summary-5-and-click.html failed unexpectedly (text diff)
[14738/45246] fast/multicol/span/clone-summary.html failed unexpectedly (text diff)
[14768/45246] fast/html/details-add-summary-5.html failed unexpectedly (text diff)
[14800/45246] fast/html/details-add-summary-6-and-click.html failed unexpectedly (text diff)
[14856/45246] fast/html/details-add-summary-6.html failed unexpectedly (text diff)
[14945/45246] fast/html/details-add-summary-7-and-click.html failed unexpectedly (text diff)
[15014/45246] fast/html/details-add-summary-7.html failed unexpectedly (text diff)
[15081/45246] fast/html/details-add-summary-8-and-click.html failed unexpectedly (text diff)
[15147/45246] fast/html/details-add-summary-8.html failed unexpectedly (text diff)
[15228/45246] fast/html/details-add-summary-9-and-click.html failed unexpectedly (text diff)
[15316/45246] fast/html/details-add-summary-9.html failed unexpectedly (text diff)
[15370/45246] fast/html/details-add-summary-10-and-click.html failed unexpectedly (text diff)
[15466/45246] fast/html/details-add-summary-10.html failed unexpectedly (text diff)
[15664/45246] fast/html/details-add-summary-child-1.html failed unexpectedly (text diff)
[15786/45246] fast/html/details-add-summary-child-2.html failed unexpectedly (text diff)
[16099/45246] fast/html/details-marker-style.html failed unexpectedly (text diff)
...
and then progress stops.
Comment 7 Alexey Proskuryakov 2017-10-16 14:03:55 PDT
Looks like the problem is that a patch that causes more than 30 failures kills EWS bots now. There may be some other circumstances required to reproduce, Jonathan will take a look.

In the meanwhile, please don't post patches that break many tests ;-)
Comment 8 Alexey Proskuryakov 2017-10-16 14:04:25 PDT
Comment on attachment 323920 [details]
patch

Obsoleting the patch, so that it doesn't keep destroying EWS.
Comment 9 Antti Koivisto 2017-10-16 14:09:11 PDT
> [8914/45246] fast/css-generated-content/details-summary-before-after.html
> failed unexpectedly (text diff)
> [13699/45246] fast/html/details-add-child-1.html failed unexpectedly (text
> diff)
> [13788/45246] fast/html/details-add-child-2.html failed unexpectedly (text
> diff)
> [13875/45246] fast/html/details-add-details-child-1.html failed unexpectedly
> (text diff)

Wish there was a way to see this while the tests are still running.
Comment 10 Antti Koivisto 2017-10-17 01:20:27 PDT
Created attachment 324001 [details]
patch
Comment 11 Ryosuke Niwa 2017-10-17 02:12:50 PDT
Comment on attachment 324001 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=324001&action=review

> Source/WebCore/rendering/RenderElement.cpp:228
> +        auto* textRendererWithDisplayContentsParent = RenderText::findForDisplayContentsInlineWrapper(rendererForFirstLineStyle);

Maybe we call this findByDisplayContentsInlineWrapperCandidate instead?

> Source/WebCore/rendering/RenderText.cpp:137
> +    static NeverDestroyed<HashMap<const RenderText*, WeakPtr<RenderInline>>> map;

It would be nice if we can make it so that nobody can possibly de-reference RenderText* so that it's UAF-safe
but that'd require quite a bit of hash traits hackery... :(

> Source/WebCore/rendering/RenderText.cpp:1761
> +        inlineWrapperForDisplayContentsMap().remove(this);

Can we assert that the entry did exist in the map?

> Source/WebCore/rendering/RenderText.cpp:1765
> +    inlineWrapperForDisplayContentsMap().add(this, makeWeakPtr(wrapper));

Can we assert that this is isNewEntry?

> LayoutTests/ChangeLog:10
> +2017-10-16  Antti Koivisto  <antti@apple.com>

Double change log entries.
Comment 12 Antti Koivisto 2017-10-17 02:51:30 PDT
Created attachment 324006 [details]
patch
Comment 13 Antti Koivisto 2017-10-17 02:57:36 PDT
*** Bug 177060 has been marked as a duplicate of this bug. ***
Comment 14 WebKit Commit Bot 2017-10-17 03:18:22 PDT
Comment on attachment 324006 [details]
patch

Clearing flags on attachment: 324006

Committed r223514: <https://trac.webkit.org/changeset/223514>
Comment 15 WebKit Commit Bot 2017-10-17 03:18:24 PDT
All reviewed patches have been landed.  Closing bug.
Comment 16 Radar WebKit Bug Importer 2017-10-17 03:18:59 PDT
<rdar://problem/35026267>
Comment 17 Darin Adler 2017-10-29 17:49:18 PDT
Comment on attachment 324006 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=324006&action=review

> Source/WebCore/style/StyleUpdate.h:73
> +    std::optional<std::unique_ptr<RenderStyle>> inheritedDisplayContentsStyle;

Seems a little strange to use std::optional<std::unique_ptr<>>; gives us both nullopt and nullptr, but do we really need both?
Comment 18 Antti Koivisto 2017-10-30 03:02:05 PDT
> Seems a little strange to use std::optional<std::unique_ptr<>>; gives us
> both nullopt and nullptr, but do we really need both?

Yeah, nullopt signals that we don't have a value and nullptr signals we have a value and it is null.

I did debate with myself about this vs using a separate bit. This looked better in code.