- Revision
- 245922
- Author
- [email protected]
- Date
- 2019-05-30 17:30:04 -0700 (Thu, 30 May 2019)
Log Message
Cherry-pick r245361. rdar://problem/51264842
Do not create a shape object outside of the layout context
https://bugs.webkit.org/show_bug.cgi?id=197926
<rdar://problem/50627858>
Reviewed by Simon Fraser.
Source/WebCore:
ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.
Test: fast/block/float/float-with-shape-outside-crash.html
* rendering/FloatingObjects.cpp:
(WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
(WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
* rendering/shapes/ShapeOutsideInfo.cpp:
(WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):
LayoutTests:
* fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
* fast/block/float/float-with-shape-outside-crash.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245361 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (245921 => 245922)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:01 UTC (rev 245921)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:04 UTC (rev 245922)
@@ -1,5 +1,46 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245361. rdar://problem/51264842
+
+ Do not create a shape object outside of the layout context
+ https://bugs.webkit.org/show_bug.cgi?id=197926
+ <rdar://problem/50627858>
+
+ Reviewed by Simon Fraser.
+
+ Source/WebCore:
+
+ ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
+ If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.
+
+ Test: fast/block/float/float-with-shape-outside-crash.html
+
+ * rendering/FloatingObjects.cpp:
+ (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
+ (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
+ * rendering/shapes/ShapeOutsideInfo.cpp:
+ (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):
+
+ LayoutTests:
+
+ * fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
+ * fast/block/float/float-with-shape-outside-crash.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245361 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-15 Zalan Bujtas <[email protected]>
+
+ Do not create a shape object outside of the layout context
+ https://bugs.webkit.org/show_bug.cgi?id=197926
+ <rdar://problem/50627858>
+
+ Reviewed by Simon Fraser.
+
+ * fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
+ * fast/block/float/float-with-shape-outside-crash.html: Added.
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245300. rdar://problem/51264763
Do not try to issue repaint while the render tree is being destroyed.
Added: branches/safari-607-branch/LayoutTests/fast/block/float/float-with-shape-outside-crash-expected.txt (0 => 245922)
--- branches/safari-607-branch/LayoutTests/fast/block/float/float-with-shape-outside-crash-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/block/float/float-with-shape-outside-crash-expected.txt 2019-05-31 00:30:04 UTC (rev 245922)
@@ -0,0 +1 @@
+PASS if no crash or ASSERT
Added: branches/safari-607-branch/LayoutTests/fast/block/float/float-with-shape-outside-crash.html (0 => 245922)
--- branches/safari-607-branch/LayoutTests/fast/block/float/float-with-shape-outside-crash.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/block/float/float-with-shape-outside-crash.html 2019-05-31 00:30:04 UTC (rev 245922)
@@ -0,0 +1,17 @@
+<style>
+q {
+ float: left;
+}
+
+div {
+ float: left;
+ width: 1400px;
+ height: 100px;
+ -webkit-shape-outside: filter(url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA4MCAxMjUiIHN0cm9rZT0iI2QzNiI+CiAgPHBhdGggZD0iTTQwLDczdjUwIiBzdHJva2Utd2lkdGg9IjExIi8+CiAgPHBhdGggZD0iTTE3LDk4bDQ3LDAiIHN0cm9rZS13aWR0aD0iOCIvPgogIDxjaXJjbGUgcj0iMzMiIGN4PSI0MCIgY3k9IjQwIiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEyIi8+Cjwvc3ZnPgo=), hue-rotate());
+}
+</style><span>PASS if no crash or ASSERT</span><q>
+<div></div></q><script>
+document.getSelection().selectAllChildren(document.body);
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (245921 => 245922)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:01 UTC (rev 245921)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:04 UTC (rev 245922)
@@ -1,5 +1,54 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245361. rdar://problem/51264842
+
+ Do not create a shape object outside of the layout context
+ https://bugs.webkit.org/show_bug.cgi?id=197926
+ <rdar://problem/50627858>
+
+ Reviewed by Simon Fraser.
+
+ Source/WebCore:
+
+ ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
+ If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.
+
+ Test: fast/block/float/float-with-shape-outside-crash.html
+
+ * rendering/FloatingObjects.cpp:
+ (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
+ (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
+ * rendering/shapes/ShapeOutsideInfo.cpp:
+ (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):
+
+ LayoutTests:
+
+ * fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
+ * fast/block/float/float-with-shape-outside-crash.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245361 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-15 Zalan Bujtas <[email protected]>
+
+ Do not create a shape object outside of the layout context
+ https://bugs.webkit.org/show_bug.cgi?id=197926
+ <rdar://problem/50627858>
+
+ Reviewed by Simon Fraser.
+
+ ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
+ If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.
+
+ Test: fast/block/float/float-with-shape-outside-crash.html
+
+ * rendering/FloatingObjects.cpp:
+ (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
+ (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
+ * rendering/shapes/ShapeOutsideInfo.cpp:
+ (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245300. rdar://problem/51264763
Do not try to issue repaint while the render tree is being destroyed.
Modified: branches/safari-607-branch/Source/WebCore/rendering/FloatingObjects.cpp (245921 => 245922)
--- branches/safari-607-branch/Source/WebCore/rendering/FloatingObjects.cpp 2019-05-31 00:30:01 UTC (rev 245921)
+++ branches/safari-607-branch/Source/WebCore/rendering/FloatingObjects.cpp 2019-05-31 00:30:04 UTC (rev 245922)
@@ -470,7 +470,7 @@
LayoutUnit logicalRight = m_renderer->logicalRightForFloat(floatingObject);
if (ShapeOutsideInfo* shapeOutside = floatingObject.renderer().shapeOutsideInfo()) {
ShapeOutsideDeltas shapeDeltas = shapeOutside->computeDeltasForContainingBlockLine(*m_renderer, floatingObject, m_lineTop, m_lineBottom - m_lineTop);
- if (!shapeDeltas.lineOverlapsShape())
+ if (!shapeDeltas.isValid() || !shapeDeltas.lineOverlapsShape())
return false;
logicalRight += shapeDeltas.rightMarginBoxDelta();
@@ -489,7 +489,7 @@
LayoutUnit logicalLeft = m_renderer->logicalLeftForFloat(floatingObject);
if (ShapeOutsideInfo* shapeOutside = floatingObject.renderer().shapeOutsideInfo()) {
ShapeOutsideDeltas shapeDeltas = shapeOutside->computeDeltasForContainingBlockLine(*m_renderer, floatingObject, m_lineTop, m_lineBottom - m_lineTop);
- if (!shapeDeltas.lineOverlapsShape())
+ if (!shapeDeltas.isValid() || !shapeDeltas.lineOverlapsShape())
return false;
logicalLeft += shapeDeltas.leftMarginBoxDelta();
Modified: branches/safari-607-branch/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp (245921 => 245922)
--- branches/safari-607-branch/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp 2019-05-31 00:30:01 UTC (rev 245921)
+++ branches/safari-607-branch/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp 2019-05-31 00:30:04 UTC (rev 245922)
@@ -38,6 +38,7 @@
#include "RenderBox.h"
#include "RenderFragmentContainer.h"
#include "RenderImage.h"
+#include "RenderView.h"
namespace WebCore {
@@ -320,6 +321,10 @@
ShapeOutsideDeltas ShapeOutsideInfo::computeDeltasForContainingBlockLine(const RenderBlockFlow& containingBlock, const FloatingObject& floatingObject, LayoutUnit lineTop, LayoutUnit lineHeight)
{
+ // If we never constructed this shape during layout, we propably don't need to know about it outside of layout in the context of "containing block line".
+ if (!m_shape && !containingBlock.view().frameView().layoutContext().isInLayout())
+ return { };
+
ASSERT(lineHeight >= 0);
LayoutUnit borderBoxTop = containingBlock.logicalTopForFloat(floatingObject) + containingBlock.marginBeforeForChild(m_renderer);
LayoutUnit borderBoxLineTop = lineTop - borderBoxTop;
