Title: [276816] trunk
- Revision
- 276816
- Author
- [email protected]
- Date
- 2021-04-29 15:43:08 -0700 (Thu, 29 Apr 2021)
Log Message
Floating object are not removed from the initial containing block
https://bugs.webkit.org/show_bug.cgi?id=225198
<rdar://77236776>
Reviewed by Antti Koivisto.
Source/WebCore:
outermostBlockContainingFloatingObject is supposed to find the top most ancestor for an intruding float. Now when the <html> is float positioned,
the initial containing block (RenderView) is the outermost containing block that has reference to this float (see FloatingObject).
removeFloatingOrPositionedChildFromBlockLists() calls outermostBlockContainingFloatingObject() to get the top most renderer where the float cleanup
is supposed to be initiated at. We call this function during style and tree mutation.
These float lists are getting invalidated during layout as well, with a simple call to m_floatingObjects->clear(). It unconditionally takes care of all the floats including
the ones on the initial containing block.
The bug only shows when we try to access the floating list between the style/tree mutation and the subsequent layout.
Test: fast/block/fail-to-remove-float-from-initial-containing-block.html
* rendering/RenderBox.cpp:
(WebCore::outermostBlockContainingFloatingObject):
LayoutTests:
* fast/block/fail-to-remove-float-from-initial-containing-block-expected.txt: Added.
* fast/block/fail-to-remove-float-from-initial-containing-block.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (276815 => 276816)
--- trunk/LayoutTests/ChangeLog 2021-04-29 22:42:29 UTC (rev 276815)
+++ trunk/LayoutTests/ChangeLog 2021-04-29 22:43:08 UTC (rev 276816)
@@ -1,3 +1,14 @@
+2021-04-29 Zalan Bujtas <[email protected]>
+
+ Floating object are not removed from the initial containing block
+ https://bugs.webkit.org/show_bug.cgi?id=225198
+ <rdar://77236776>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/block/fail-to-remove-float-from-initial-containing-block-expected.txt: Added.
+ * fast/block/fail-to-remove-float-from-initial-containing-block.html: Added.
+
2021-04-29 Aditya Keerthi <[email protected]>
REGRESSION: media/modern-media-controls/media-controller/ios/media-controller-ios-do-not-hide-controls-when-tapping-button.html is timing out
Added: trunk/LayoutTests/fast/block/fail-to-remove-float-from-initial-containing-block-expected.txt (0 => 276816)
--- trunk/LayoutTests/fast/block/fail-to-remove-float-from-initial-containing-block-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/fail-to-remove-float-from-initial-containing-block-expected.txt 2021-04-29 22:43:08 UTC (rev 276816)
@@ -0,0 +1 @@
+
Added: trunk/LayoutTests/fast/block/fail-to-remove-float-from-initial-containing-block.html (0 => 276816)
--- trunk/LayoutTests/fast/block/fail-to-remove-float-from-initial-containing-block.html (rev 0)
+++ trunk/LayoutTests/fast/block/fail-to-remove-float-from-initial-containing-block.html 2021-04-29 22:43:08 UTC (rev 276816)
@@ -0,0 +1,15 @@
+<style>
+ html {
+ float: right;
+ content: url();
+ }
+</style>
+<!-- Pass if no crash or assert. -->
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ _onload_ = () => {
+ document.body.offsetTop;
+ document.styleSheets[0].insertRule(`html { overflow-y: -webkit-paged-x; }`);
+ };
+</script>
Modified: trunk/Source/WebCore/ChangeLog (276815 => 276816)
--- trunk/Source/WebCore/ChangeLog 2021-04-29 22:42:29 UTC (rev 276815)
+++ trunk/Source/WebCore/ChangeLog 2021-04-29 22:43:08 UTC (rev 276816)
@@ -1,3 +1,24 @@
+2021-04-29 Zalan Bujtas <[email protected]>
+
+ Floating object are not removed from the initial containing block
+ https://bugs.webkit.org/show_bug.cgi?id=225198
+ <rdar://77236776>
+
+ Reviewed by Antti Koivisto.
+
+ outermostBlockContainingFloatingObject is supposed to find the top most ancestor for an intruding float. Now when the <html> is float positioned,
+ the initial containing block (RenderView) is the outermost containing block that has reference to this float (see FloatingObject).
+ removeFloatingOrPositionedChildFromBlockLists() calls outermostBlockContainingFloatingObject() to get the top most renderer where the float cleanup
+ is supposed to be initiated at. We call this function during style and tree mutation.
+ These float lists are getting invalidated during layout as well, with a simple call to m_floatingObjects->clear(). It unconditionally takes care of all the floats including
+ the ones on the initial containing block.
+ The bug only shows when we try to access the floating list between the style/tree mutation and the subsequent layout.
+
+ Test: fast/block/fail-to-remove-float-from-initial-containing-block.html
+
+ * rendering/RenderBox.cpp:
+ (WebCore::outermostBlockContainingFloatingObject):
+
2021-04-29 Michael Catanzaro <[email protected]>
-Wpessimizing-move warnings in LocaleICU.cpp
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (276815 => 276816)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2021-04-29 22:42:29 UTC (rev 276815)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2021-04-29 22:43:08 UTC (rev 276816)
@@ -227,8 +227,6 @@
ASSERT(box.isFloating());
RenderBlockFlow* parentBlock = nullptr;
for (auto& ancestor : ancestorsOfType<RenderBlockFlow>(box)) {
- if (ancestor.isRenderView())
- break;
if (!parentBlock || ancestor.containsFloat(box))
parentBlock = &ancestor;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
