Title: [255437] trunk
- Revision
- 255437
- Author
- [email protected]
- Date
- 2020-01-30 10:07:10 -0800 (Thu, 30 Jan 2020)
Log Message
Crash in RenderBlockFlow::adjustLinePositionForPagination() with complex line without root box
https://bugs.webkit.org/show_bug.cgi?id=206610
Patch by Doug Kelly <[email protected]> on 2020-01-30
Reviewed by Zalan Bujtas.
Source/WebCore:
Add a check for a null pointer when getting firstRootBox() -- if it is null, return early after calling setPaginationStrut().
Test: fast/text/complex-without-root-box.html
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::adjustLinePositionForPagination):
LayoutTests:
* fast/text/complex-without-root-box-expected.txt: Added.
* fast/text/complex-without-root-box.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (255436 => 255437)
--- trunk/LayoutTests/ChangeLog 2020-01-30 17:56:14 UTC (rev 255436)
+++ trunk/LayoutTests/ChangeLog 2020-01-30 18:07:10 UTC (rev 255437)
@@ -1,3 +1,13 @@
+2020-01-30 Doug Kelly <[email protected]>
+
+ Crash in RenderBlockFlow::adjustLinePositionForPagination() with complex line without root box
+ https://bugs.webkit.org/show_bug.cgi?id=206610
+
+ Reviewed by Zalan Bujtas.
+
+ * fast/text/complex-without-root-box-expected.txt: Added.
+ * fast/text/complex-without-root-box.html: Added.
+
2020-01-30 Jacob Uphoff <[email protected]>
[ macOS wk2 ] tiled-drawing/scrolling/scroll-snap/scroll-snap-mandatory-overflow.html is flaky failing
Added: trunk/LayoutTests/fast/text/complex-without-root-box-expected.txt (0 => 255437)
--- trunk/LayoutTests/fast/text/complex-without-root-box-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/text/complex-without-root-box-expected.txt 2020-01-30 18:07:10 UTC (rev 255437)
@@ -0,0 +1,4 @@
+This test confirms that a complex line layout with no root box does not fail. Test passes if WebKit does not crash. PASS
+
+
+
Added: trunk/LayoutTests/fast/text/complex-without-root-box.html (0 => 255437)
--- trunk/LayoutTests/fast/text/complex-without-root-box.html (rev 0)
+++ trunk/LayoutTests/fast/text/complex-without-root-box.html 2020-01-30 18:07:10 UTC (rev 255437)
@@ -0,0 +1,14 @@
+<style>
+foreignObject { padding-right: 100px; }
+div { width: 16mm; overflow: -webkit-paged-x; }
+</style>
+This test confirms that a complex line layout with no root box does not fail. Test passes if WebKit does not crash. PASS
+<svg writing-mode="tb"><foreignObject><div></foreignObject></svg>
+<svg style="orphans: 1;"><foreignObject x="10"><br id=br><br></foreignObject></svg>
+<span id=container></span>
+<script>
+document.body.offsetWidth;
+container.appendChild(br);
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
Modified: trunk/Source/WebCore/ChangeLog (255436 => 255437)
--- trunk/Source/WebCore/ChangeLog 2020-01-30 17:56:14 UTC (rev 255436)
+++ trunk/Source/WebCore/ChangeLog 2020-01-30 18:07:10 UTC (rev 255437)
@@ -1,3 +1,17 @@
+2020-01-30 Doug Kelly <[email protected]>
+
+ Crash in RenderBlockFlow::adjustLinePositionForPagination() with complex line without root box
+ https://bugs.webkit.org/show_bug.cgi?id=206610
+
+ Reviewed by Zalan Bujtas.
+
+ Add a check for a null pointer when getting firstRootBox() -- if it is null, return early after calling setPaginationStrut().
+
+ Test: fast/text/complex-without-root-box.html
+
+ * rendering/RenderBlockFlow.cpp:
+ (WebCore::RenderBlockFlow::adjustLinePositionForPagination):
+
2020-01-30 Chris Dumez <[email protected]>
REGRESSION (r252064): [ Mac iOS ] storage/websql/statement-error-callback.html is timing out flakily
Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.cpp (255436 => 255437)
--- trunk/Source/WebCore/rendering/RenderBlockFlow.cpp 2020-01-30 17:56:14 UTC (rev 255436)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.cpp 2020-01-30 18:07:10 UTC (rev 255437)
@@ -1811,6 +1811,10 @@
if (((lineBox == firstRootBox() && totalLogicalHeight < pageLogicalHeightAtNewOffset) || (!style().hasAutoOrphans() && style().orphans() >= lineIndex))
&& !isOutOfFlowPositioned() && !isTableCell()) {
auto firstRootBox = this->firstRootBox();
+ if (!firstRootBox) {
+ setPaginationStrut(remainingLogicalHeight + logicalOffset);
+ return;
+ }
auto firstRootBoxOverflowRect = firstRootBox->logicalVisualOverflowRect(firstRootBox->lineTop(), firstRootBox->lineBottom());
auto firstLineUpperOverhang = std::max(-firstRootBoxOverflowRect.y(), 0_lu);
if (needsAppleMailPaginationQuirk(*lineBox))
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
