Title: [209259] trunk
- Revision
- 209259
- Author
- [email protected]
- Date
- 2016-12-02 13:25:15 -0800 (Fri, 02 Dec 2016)
Log Message
ASSERTION FAILED: flowThread->regionInRange(region, startRegion, endRegion) in WebCore::RenderBox::borderBoxRectInRegion
https://bugs.webkit.org/show_bug.cgi?id=152113
<rdar://problem/27720221>
Reviewed by David Hyatt.
Source/WebCore:
In a nested column context, do not process a spanner if it belongs to an inner column.
While populating a flow, we search for possible spanners and construct multicolumnsets accordingly.
However due to the top-down nature of populating flows, a descendant spanner could belong to an inner
flow which hasn't been populated yet.
This patch checks if a potential spanner has an ancestor (which is also a descendant
of the flow that we are populating -> nested) that will eventually create a flow context.
Test: fast/multicol/assert-with-nested-columns-and-spanner.html
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::computeColumnCountAndWidth):
(WebCore::RenderBlockFlow::willCreateColumns):
* rendering/RenderBlockFlow.h:
* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):
LayoutTests:
* fast/multicol/assert-with-nested-columns-and-spanner-expected.txt: Added.
* fast/multicol/assert-with-nested-columns-and-spanner.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (209258 => 209259)
--- trunk/LayoutTests/ChangeLog 2016-12-02 21:02:44 UTC (rev 209258)
+++ trunk/LayoutTests/ChangeLog 2016-12-02 21:25:15 UTC (rev 209259)
@@ -1,3 +1,14 @@
+2016-12-02 Zalan Bujtas <[email protected]>
+
+ ASSERTION FAILED: flowThread->regionInRange(region, startRegion, endRegion) in WebCore::RenderBox::borderBoxRectInRegion
+ https://bugs.webkit.org/show_bug.cgi?id=152113
+ <rdar://problem/27720221>
+
+ Reviewed by David Hyatt.
+
+ * fast/multicol/assert-with-nested-columns-and-spanner-expected.txt: Added.
+ * fast/multicol/assert-with-nested-columns-and-spanner.html: Added.
+
2016-12-02 Dave Hyatt <[email protected]>
[CSS Parser] Make sure the z-component of transform-origin can be implicit
Added: trunk/LayoutTests/fast/multicol/assert-with-nested-columns-and-spanner-expected.txt (0 => 209259)
--- trunk/LayoutTests/fast/multicol/assert-with-nested-columns-and-spanner-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/assert-with-nested-columns-and-spanner-expected.txt 2016-12-02 21:25:15 UTC (rev 209259)
@@ -0,0 +1,3 @@
+PASS if no assert in debug.
+
+
Added: trunk/LayoutTests/fast/multicol/assert-with-nested-columns-and-spanner.html (0 => 209259)
--- trunk/LayoutTests/fast/multicol/assert-with-nested-columns-and-spanner.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/assert-with-nested-columns-and-spanner.html 2016-12-02 21:25:15 UTC (rev 209259)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title></title>
+<style>
+h2 {
+ column-span: all
+}
+div {
+ column-width: 10px;
+}
+</style>
+</head>
+<body>
+PASS if no assert in debug.
+<body><div><div><h2></h2></div><video controls=""></video><h2></h2></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</body>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (209258 => 209259)
--- trunk/Source/WebCore/ChangeLog 2016-12-02 21:02:44 UTC (rev 209258)
+++ trunk/Source/WebCore/ChangeLog 2016-12-02 21:25:15 UTC (rev 209259)
@@ -1,3 +1,28 @@
+2016-12-02 Zalan Bujtas <[email protected]>
+
+ ASSERTION FAILED: flowThread->regionInRange(region, startRegion, endRegion) in WebCore::RenderBox::borderBoxRectInRegion
+ https://bugs.webkit.org/show_bug.cgi?id=152113
+ <rdar://problem/27720221>
+
+ Reviewed by David Hyatt.
+
+ In a nested column context, do not process a spanner if it belongs to an inner column.
+
+ While populating a flow, we search for possible spanners and construct multicolumnsets accordingly.
+ However due to the top-down nature of populating flows, a descendant spanner could belong to an inner
+ flow which hasn't been populated yet.
+ This patch checks if a potential spanner has an ancestor (which is also a descendant
+ of the flow that we are populating -> nested) that will eventually create a flow context.
+
+ Test: fast/multicol/assert-with-nested-columns-and-spanner.html
+
+ * rendering/RenderBlockFlow.cpp:
+ (WebCore::RenderBlockFlow::computeColumnCountAndWidth):
+ (WebCore::RenderBlockFlow::willCreateColumns):
+ * rendering/RenderBlockFlow.h:
+ * rendering/RenderMultiColumnFlowThread.cpp:
+ (WebCore::isValidColumnSpanner):
+
2016-12-02 Dave Hyatt <[email protected]>
[CSS Parser] Make sure the z-component of transform-origin can be implicit
Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.cpp (209258 => 209259)
--- trunk/Source/WebCore/rendering/RenderBlockFlow.cpp 2016-12-02 21:02:44 UTC (rev 209258)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.cpp 2016-12-02 21:25:15 UTC (rev 209259)
@@ -398,7 +398,7 @@
}
void RenderBlockFlow::computeColumnCountAndWidth()
-{
+{
// Calculate our column width and column count.
// FIXME: Can overflow on fast/block/float/float-not-removed-from-next-sibling4.html, see https://bugs.webkit.org/show_bug.cgi?id=68744
unsigned desiredColumnCount = 1;
@@ -428,6 +428,30 @@
setComputedColumnCountAndWidth(desiredColumnCount, desiredColumnWidth);
}
+bool RenderBlockFlow::willCreateColumns()
+{
+ if (!firstChild())
+ return false;
+
+ if (!style().specifiesColumns())
+ return false;
+
+ // column-axis initiates MultiColumnFlowThread.
+ if (!style().hasInlineColumnAxis())
+ return true;
+
+ // Non-auto column-width always initiates MultiColumnFlowThread.
+ if (!style().hasAutoColumnWidth())
+ return true;
+
+ // column-count > 1 always initiates MultiColumnFlowThread.
+ if (!style().hasAutoColumnCount())
+ return style().columnCount() > 1;
+
+ ASSERT_NOT_REACHED();
+ return false;
+}
+
void RenderBlockFlow::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight)
{
ASSERT(needsLayout());
Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.h (209258 => 209259)
--- trunk/Source/WebCore/rendering/RenderBlockFlow.h 2016-12-02 21:02:44 UTC (rev 209258)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.h 2016-12-02 21:25:15 UTC (rev 209259)
@@ -282,6 +282,7 @@
RenderMultiColumnFlowThread* multiColumnFlowThread() const { return hasRareBlockFlowData() ? rareBlockFlowData()->m_multiColumnFlowThread : nullptr; }
void setMultiColumnFlowThread(RenderMultiColumnFlowThread*);
+ bool willCreateColumns();
bool containsFloats() const override { return m_floatingObjects && !m_floatingObjects->set().isEmpty(); }
bool containsFloat(RenderBox&) const;
Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (209258 => 209259)
--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2016-12-02 21:02:44 UTC (rev 209258)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp 2016-12-02 21:25:15 UTC (rev 209259)
@@ -240,31 +240,41 @@
{
// We assume that we're inside the flow thread. This function is not to be called otherwise.
ASSERT(descendant.isDescendantOf(&flowThread));
-
// First make sure that the renderer itself has the right properties for becoming a spanner.
- auto& style = descendant.style();
- if (style.columnSpan() != ColumnSpanAll || !is<RenderBox>(descendant) || descendant.isFloatingOrOutOfFlowPositioned())
+ if (!is<RenderBox>(descendant))
return false;
- RenderElement* container = descendant.parent();
- if (!is<RenderBlockFlow>(*container) || container->childrenInline()) {
+ auto& descendantBox = downcast<RenderBox>(descendant);
+ if (descendantBox.isFloatingOrOutOfFlowPositioned())
+ return false;
+
+ if (descendantBox.style().columnSpan() != ColumnSpanAll)
+ return false;
+
+ auto* parent = descendantBox.parent();
+ if (!is<RenderBlockFlow>(*parent) || parent->childrenInline()) {
// Needs to be block-level.
return false;
}
// We need to have the flow thread as the containing block. A spanner cannot break out of the flow thread.
- RenderFlowThread* enclosingFlowThread = descendant.flowThreadContainingBlock();
+ auto* enclosingFlowThread = descendantBox.flowThreadContainingBlock();
if (enclosingFlowThread != &flowThread)
return false;
// This looks like a spanner, but if we're inside something unbreakable, it's not to be treated as one.
- for (auto* ancestor = downcast<RenderBox>(descendant).containingBlock(); ancestor && !is<RenderView>(*ancestor); ancestor = ancestor->containingBlock()) {
- if (ancestor->isRenderFlowThread()) {
+ for (auto* ancestor = descendantBox.containingBlock(); ancestor; ancestor = ancestor->containingBlock()) {
+ if (is<RenderView>(*ancestor))
+ return false;
+ if (is<RenderFlowThread>(*ancestor)) {
// Don't allow any intervening non-multicol fragmentation contexts. The spec doesn't say
// anything about disallowing this, but it's just going to be too complicated to
// implement (not to mention specify behavior).
return ancestor == &flowThread;
}
+ // This ancestor (descendent of the flowThread) will create columns later. The spanner belongs to it.
+ if (is<RenderBlockFlow>(*ancestor) && downcast<RenderBlockFlow>(*ancestor).willCreateColumns())
+ return false;
ASSERT(ancestor->style().columnSpan() != ColumnSpanAll || !isValidColumnSpanner(flowThread, *ancestor));
if (ancestor->isUnsplittableForPagination())
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
