Diff
Modified: trunk/LayoutTests/ChangeLog (202930 => 202931)
--- trunk/LayoutTests/ChangeLog 2016-07-07 21:09:14 UTC (rev 202930)
+++ trunk/LayoutTests/ChangeLog 2016-07-07 21:24:45 UTC (rev 202931)
@@ -1,3 +1,13 @@
+2016-07-07 Antti Koivisto <[email protected]>
+
+ REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
+ https://bugs.webkit.org/show_bug.cgi?id=159519
+
+ Reviewed by Zalan Bujtas.
+
+ * fast/inline/trailing-floats-inline-crash-expected.txt: Added.
+ * fast/inline/trailing-floats-inline-crash.html: Added.
+
2016-07-07 Commit Queue <[email protected]>
Unreviewed, rolling out r202905 and r202911.
Added: trunk/LayoutTests/fast/inline/trailing-floats-inline-crash-expected.txt (0 => 202931)
--- trunk/LayoutTests/fast/inline/trailing-floats-inline-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/inline/trailing-floats-inline-crash-expected.txt 2016-07-07 21:24:45 UTC (rev 202931)
@@ -0,0 +1,5 @@
+This test passes if it doesn't crash.
+
+
+
+BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAAAAAAAC
Added: trunk/LayoutTests/fast/inline/trailing-floats-inline-crash.html (0 => 202931)
--- trunk/LayoutTests/fast/inline/trailing-floats-inline-crash.html (rev 0)
+++ trunk/LayoutTests/fast/inline/trailing-floats-inline-crash.html 2016-07-07 21:24:45 UTC (rev 202931)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+ :last-child {float:left;}
+</style>
+</head>
+
+<body>
+This test passes if it doesn't crash.
+<nav></nav>
+<br>
+<article>
+<pre></pre>
+<br>
+<content>
+<br>
+<select></select>
+<script id="webtest14">
+document.body.contentEditable = "true";
+document.execCommand("SelectAll");
+document.execCommand("StrikeThrough");
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAAAAAAAC
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (202930 => 202931)
--- trunk/Source/WebCore/ChangeLog 2016-07-07 21:09:14 UTC (rev 202930)
+++ trunk/Source/WebCore/ChangeLog 2016-07-07 21:24:45 UTC (rev 202931)
@@ -1,3 +1,32 @@
+2016-07-07 Antti Koivisto <[email protected]>
+
+ REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
+ https://bugs.webkit.org/show_bug.cgi?id=159519
+
+ Reviewed by Zalan Bujtas.
+
+ Test: fast/inline/trailing-floats-inline-crash.html
+
+ * rendering/RenderBlockLineLayout.cpp:
+ (WebCore::RenderBlockFlow::checkFloatsInCleanLine):
+
+ Use the existing deletionHasBegun bit in RenderStyle to assert against this reliably.
+
+ * rendering/RenderLineBoxList.cpp:
+ (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+
+ In some cases a special TrailingFloatsRootInlineBox may be added as the last root linebox of a flow.
+ If it is combined with br the existing invalidation that invalidates the next and previous line may
+ not be sufficient. Test for this case and invalidate the TrailingFloatsRootInlineBox too if it exists.
+
+ * rendering/RootInlineBox.h:
+ (WebCore::RootInlineBox::isTrailingFloatsRootInlineBox):
+ * rendering/TrailingFloatsRootInlineBox.h:
+ * rendering/style/RenderStyle.h:
+ (WebCore::RenderStyle::deletionHasBegun):
+
+ Expose the bit in debug.
+
2016-07-07 Alex Christensen <[email protected]>
Use SocketProvider to create WebSocketChannels
Modified: trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp (202930 => 202931)
--- trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2016-07-07 21:09:14 UTC (rev 202930)
+++ trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp 2016-07-07 21:24:45 UTC (rev 202931)
@@ -1788,6 +1788,7 @@
for (auto it = cleanLineFloats->begin(), end = cleanLineFloats->end(); it != end; ++it) {
RenderBox* floatingBox = *it;
+ ASSERT_WITH_SECURITY_IMPLICATION(!floatingBox->style().deletionHasBegun());
floatingBox->layoutIfNeeded();
LayoutSize newSize(floatingBox->width() + floatingBox->horizontalMarginExtent(), floatingBox->height() + floatingBox->verticalMarginExtent());
ASSERT_WITH_SECURITY_IMPLICATION(floatIndex < floats.size());
Modified: trunk/Source/WebCore/rendering/RenderLineBoxList.cpp (202930 => 202931)
--- trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2016-07-07 21:09:14 UTC (rev 202930)
+++ trunk/Source/WebCore/rendering/RenderLineBoxList.cpp 2016-07-07 21:24:45 UTC (rev 202931)
@@ -382,8 +382,15 @@
// FIXME: We shouldn't need to always dirty the next line. This is only strictly
// necessary some of the time, in situations involving BRs.
- if (RootInlineBox* nextBox = box->nextRootBox())
+ if (RootInlineBox* nextBox = box->nextRootBox()) {
nextBox->markDirty();
+
+ // Special root box for floats may be added at the end of the list. If this occurs with BRs we need to invalidate it explicitly.
+ if (auto* nextNextBox = nextBox->nextRootBox()) {
+ if (nextNextBox->isTrailingFloatsRootInlineBox())
+ nextNextBox->markDirty();
+ }
+ }
}
}
Modified: trunk/Source/WebCore/rendering/RootInlineBox.h (202930 => 202931)
--- trunk/Source/WebCore/rendering/RootInlineBox.h 2016-07-07 21:09:14 UTC (rev 202930)
+++ trunk/Source/WebCore/rendering/RootInlineBox.h 2016-07-07 21:24:45 UTC (rev 202931)
@@ -190,6 +190,8 @@
Node* getLogicalStartBoxWithNode(InlineBox*&) const;
Node* getLogicalEndBoxWithNode(InlineBox*&) const;
+ virtual bool isTrailingFloatsRootInlineBox() const { return false; }
+
#if ENABLE(TREE_DEBUGGING)
const char* boxName() const final;
#endif
Modified: trunk/Source/WebCore/rendering/TrailingFloatsRootInlineBox.h (202930 => 202931)
--- trunk/Source/WebCore/rendering/TrailingFloatsRootInlineBox.h 2016-07-07 21:09:14 UTC (rev 202930)
+++ trunk/Source/WebCore/rendering/TrailingFloatsRootInlineBox.h 2016-07-07 21:24:45 UTC (rev 202931)
@@ -40,6 +40,7 @@
private:
float virtualLogicalHeight() const override { return 0; }
+ bool isTrailingFloatsRootInlineBox() const final { return true; }
};
} // namespace WebCore
Modified: trunk/Source/WebCore/rendering/style/RenderStyle.h (202930 => 202931)
--- trunk/Source/WebCore/rendering/style/RenderStyle.h 2016-07-07 21:09:14 UTC (rev 202930)
+++ trunk/Source/WebCore/rendering/style/RenderStyle.h 2016-07-07 21:24:45 UTC (rev 202931)
@@ -498,6 +498,10 @@
static RenderStyle createAnonymousStyleWithDisplay(const RenderStyle& parentStyle, EDisplay);
static RenderStyle createStyleInheritingFromPseudoStyle(const RenderStyle& pseudoStyle);
+#if !ASSERT_DISABLED
+ bool deletionHasBegun() const { return m_deletionHasBegun; }
+#endif
+
ContentPosition resolvedJustifyContentPosition(const StyleContentAlignmentData& normalValueBehavior) const;
ContentDistributionType resolvedJustifyContentDistribution(const StyleContentAlignmentData& normalValueBehavior) const;
ContentPosition resolvedAlignContentPosition(const StyleContentAlignmentData& normalValueBehavior) const;
