Fix crash when establishing an inline continuation inside a block continuation.
When attempting to add a child into a block continuation C
(RenderBlock::addChildToContinuation()), and there's a beforeChild
specified, we used to jump directly to the parent of beforeChild, and
insert it there (by calling addChildIgnoringContinuation() on
beforeChild->parent()). Normal behavior (when block continuations
aren't involved) would be to analyze the renderers in the ancestry
chain between beforeChild and C. This way we perform necessary
adjustments to the tree, such as inserting additional anonymous table
part objects. However, this wasn't done when block continuations were
involved.
What really caused the crash in this case was that there's no override
for addChildIgnoringContinuation() in LayoutTable, so it'd just use
the one in RenderBlock, and that way we'd never get to
LayoutTable::addChild(), which is exactly where we make sure that
children aren't inserted at invalid places (like putting a
RenderInline as a direct child of LayoutTable).
The solution is to find the nearest RenderBlockFlow ancestor of
beforeChild and try to insert it there, and additionally add an
addChildIgnoringContinuation() override in LayoutTable for good
measure (since it's dangerous to use the one in
RenderBlock).
Note that block continuations are only used in the old / current
multicol code, and even then only if there's a spanner that's not a
direct child of a multicol container. Support for block continuations
can be removed when the old multicol code is removed.
BUG=451059
Review URL: https://codereview.chromium.org/880113002
git-svn-id: svn://svn.chromium.org/blink/trunk@189206 bbb929c8-8fbe-4397-9dbb-9b2b20218538
7 files changed
