Diff
Modified: branches/safari-612.1.14-branch/LayoutTests/ChangeLog (277309 => 277310)
--- branches/safari-612.1.14-branch/LayoutTests/ChangeLog 2021-05-11 00:25:26 UTC (rev 277309)
+++ branches/safari-612.1.14-branch/LayoutTests/ChangeLog 2021-05-11 00:35:40 UTC (rev 277310)
@@ -1,3 +1,37 @@
+2021-05-10 Russell Epstein <[email protected]>
+
+ Cherry-pick r277297. rdar://problem/77797456
+
+ Unreviewed, reverting r277222.
+ https://bugs.webkit.org/show_bug.cgi?id=225618
+
+ WebContent process crashes while visiting
+ <http://ign.com|ign.com> (RenderFlexibleBox::layoutFlexItems)
+
+ Reverted changeset:
+
+ "[css-flexbox] Flex item construction may affect sibling flex
+ item height computation"
+ https://bugs.webkit.org/show_bug.cgi?id=225489
+ https://trac.webkit.org/changeset/277222
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277297 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-05-10 Commit Queue <[email protected]>
+
+ Unreviewed, reverting r277222.
+ https://bugs.webkit.org/show_bug.cgi?id=225618
+
+ WebContent process crashes while visiting
+ <http://ign.com|ign.com> (RenderFlexibleBox::layoutFlexItems)
+
+ Reverted changeset:
+
+ "[css-flexbox] Flex item construction may affect sibling flex
+ item height computation"
+ https://bugs.webkit.org/show_bug.cgi?id=225489
+ https://trac.webkit.org/changeset/277222
+
2021-05-08 Ricky Mondello <[email protected]>
Fix a typo
Deleted: branches/safari-612.1.14-branch/LayoutTests/fast/flexbox/flex-column-with-percent-height-descendants-expected.html (277309 => 277310)
--- branches/safari-612.1.14-branch/LayoutTests/fast/flexbox/flex-column-with-percent-height-descendants-expected.html 2021-05-11 00:25:26 UTC (rev 277309)
+++ branches/safari-612.1.14-branch/LayoutTests/fast/flexbox/flex-column-with-percent-height-descendants-expected.html 2021-05-11 00:35:40 UTC (rev 277310)
@@ -1,8 +0,0 @@
-<!DOCTYPE html>
-<style>
-div {
- height: 100px;
- background-color: green;
-}
-</style>
-<div></div>
Deleted: branches/safari-612.1.14-branch/LayoutTests/fast/flexbox/flex-column-with-percent-height-descendants.html (277309 => 277310)
--- branches/safari-612.1.14-branch/LayoutTests/fast/flexbox/flex-column-with-percent-height-descendants.html 2021-05-11 00:25:26 UTC (rev 277309)
+++ branches/safari-612.1.14-branch/LayoutTests/fast/flexbox/flex-column-with-percent-height-descendants.html 2021-05-11 00:35:40 UTC (rev 277310)
@@ -1,25 +0,0 @@
-<!DOCTYPE html>
-<style>
-.flexContainer {
- display: flex;
- flex-direction: column;
- position: relative;
- height: 100px;
-}
-.firstChild {
- background-color: yellow;
- height: 50px;
-}
-.secondChild {
- height: 50%;
- background-color: green;
-}
-.percentHeightDescendant {
- height: 100%;
- background-color: green
-}
-</style>
-<div class=flexContainer>
- <div class=firstChild><div class=percentHeightDescendant></div></div>
- <div class=secondChild></div>
-</div>
Modified: branches/safari-612.1.14-branch/Source/WebCore/ChangeLog (277309 => 277310)
--- branches/safari-612.1.14-branch/Source/WebCore/ChangeLog 2021-05-11 00:25:26 UTC (rev 277309)
+++ branches/safari-612.1.14-branch/Source/WebCore/ChangeLog 2021-05-11 00:35:40 UTC (rev 277310)
@@ -1,3 +1,37 @@
+2021-05-10 Russell Epstein <[email protected]>
+
+ Cherry-pick r277297. rdar://problem/77797456
+
+ Unreviewed, reverting r277222.
+ https://bugs.webkit.org/show_bug.cgi?id=225618
+
+ WebContent process crashes while visiting
+ <http://ign.com|ign.com> (RenderFlexibleBox::layoutFlexItems)
+
+ Reverted changeset:
+
+ "[css-flexbox] Flex item construction may affect sibling flex
+ item height computation"
+ https://bugs.webkit.org/show_bug.cgi?id=225489
+ https://trac.webkit.org/changeset/277222
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277297 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-05-10 Commit Queue <[email protected]>
+
+ Unreviewed, reverting r277222.
+ https://bugs.webkit.org/show_bug.cgi?id=225618
+
+ WebContent process crashes while visiting
+ <http://ign.com|ign.com> (RenderFlexibleBox::layoutFlexItems)
+
+ Reverted changeset:
+
+ "[css-flexbox] Flex item construction may affect sibling flex
+ item height computation"
+ https://bugs.webkit.org/show_bug.cgi?id=225489
+ https://trac.webkit.org/changeset/277222
+
2021-05-09 Lauro Moura <[email protected]>
[WebXR] Remove reference cycle in WebXRSession
Modified: branches/safari-612.1.14-branch/Source/WebCore/rendering/RenderFlexibleBox.cpp (277309 => 277310)
--- branches/safari-612.1.14-branch/Source/WebCore/rendering/RenderFlexibleBox.cpp 2021-05-11 00:25:26 UTC (rev 277309)
+++ branches/safari-612.1.14-branch/Source/WebCore/rendering/RenderFlexibleBox.cpp 2021-05-11 00:35:40 UTC (rev 277310)
@@ -268,6 +268,9 @@
resetLogicalHeightBeforeLayoutIfNeeded();
m_relaidOutChildren.clear();
+ bool oldInLayout = m_inLayout;
+ m_inLayout = true;
+
if (recomputeLogicalWidth())
relayoutChildren = true;
@@ -318,6 +321,8 @@
repainter.repaintAfterLayout();
clearNeedsLayout();
+
+ m_inLayout = oldInLayout;
}
void RenderFlexibleBox::appendChildFrameRects(ChildFrameRects& childFrameRects)
@@ -840,7 +845,7 @@
if (m_hasDefiniteHeight == SizeDefiniteness::Indefinite)
return false;
bool definite = child.computePercentageLogicalHeight(flexBasis, updateDescendants).hasValue();
- if (!m_inFlexItemConstruction && (isHorizontalWritingMode() == child.isHorizontalWritingMode())) {
+ if (m_inLayout && (isHorizontalWritingMode() == child.isHorizontalWritingMode())) {
// We can reach this code even while we're not laying ourselves out, such
// as from mainSizeForPercentageResolution.
m_hasDefiniteHeight = definite ? SizeDefiniteness::Definite : SizeDefiniteness::Indefinite;
@@ -960,7 +965,21 @@
// Set up our master list of flex items. All of the rest of the algorithm
// should work off this list of a subset.
// TODO(cbiesinger): That second part is not yet true.
- auto allItems = constructFlexItems(relayoutChildren);
+ Vector<FlexItem> allItems;
+ m_orderIterator.first();
+ for (RenderBox* child = m_orderIterator.currentChild(); child; child = m_orderIterator.next()) {
+ if (m_orderIterator.shouldSkipChild(*child)) {
+ // Out-of-flow children are not flex items, so we skip them here.
+ if (child->isOutOfFlowPositioned())
+ prepareChildForPositionedLayout(*child);
+ continue;
+ }
+ allItems.append(constructFlexItem(*child, relayoutChildren));
+ }
+
+ // constructFlexItem() might set the override containing block height so any value cached for definiteness might be incorrect.
+ m_hasDefiniteHeight = SizeDefiniteness::Unknown;
+
const LayoutUnit lineBreakLength = mainAxisContentExtent(LayoutUnit::max());
LayoutUnit gapBetweenItems = computeGap(GapType::BetweenItems);
LayoutUnit gapBetweenLines = computeGap(GapType::BetweenLines);
@@ -1275,52 +1294,36 @@
return childSize;
}
-Vector<FlexItem> RenderFlexibleBox::constructFlexItems(bool relayoutChildren)
+FlexItem RenderFlexibleBox::constructFlexItem(RenderBox& child, bool relayoutChildren)
{
- SetForScope<bool> inFlexItemConstruction(m_inFlexItemConstruction, true);
-
- Vector<FlexItem> flexItems;
- for (auto* child = m_orderIterator.first(); child; child = m_orderIterator.next()) {
- if (m_orderIterator.shouldSkipChild(*child)) {
- // Out-of-flow children are not flex items, so we skip them here.
- if (child->isOutOfFlowPositioned())
- prepareChildForPositionedLayout(*child);
- continue;
+ child.clearOverridingContentSize();
+ if (childHasIntrinsicMainAxisSize(child)) {
+ // If this condition is true, then computeMainAxisExtentForChild will call
+ // child.intrinsicContentLogicalHeight() and child.scrollbarLogicalHeight(),
+ // so if the child has intrinsic min/max/preferred size, run layout on it now to make sure
+ // its logical height and scroll bars are up to date.
+ updateBlockChildDirtyBitsBeforeLayout(relayoutChildren, child);
+ // Don't resolve percentages in children. This is especially important for the min-height calculation,
+ // where we want percentages to be treated as auto. For flex-basis itself, this is not a problem because
+ // by definition we have an indefinite flex basis here and thus percentages should not resolve.
+ if (child.needsLayout() || !m_intrinsicSizeAlongMainAxis.contains(&child)) {
+ if (isHorizontalWritingMode() == child.isHorizontalWritingMode())
+ child.setOverridingContainingBlockContentLogicalHeight(WTF::nullopt);
+ else
+ child.setOverridingContainingBlockContentLogicalWidth(WTF::nullopt);
+ child.clearOverridingContentSize();
+ child.setChildNeedsLayout(MarkOnlyThis);
+ child.layoutIfNeeded();
+ cacheChildMainSize(child);
+ child.clearOverridingContainingBlockContentSize();
}
-
- auto constructFlexItemForChildBox = [&](auto& childBox) {
- childBox.clearOverridingContentSize();
- if (childHasIntrinsicMainAxisSize(childBox)) {
- // If this condition is true, then computeMainAxisExtentForChild will call
- // child.intrinsicContentLogicalHeight() and child.scrollbarLogicalHeight(),
- // so if the child has intrinsic min/max/preferred size, run layout on it now to make sure
- // its logical height and scroll bars are up to date.
- updateBlockChildDirtyBitsBeforeLayout(relayoutChildren, childBox);
- // Don't resolve percentages in children. This is especially important for the min-height calculation,
- // where we want percentages to be treated as auto. For flex-basis itself, this is not a problem because
- // by definition we have an indefinite flex basis here and thus percentages should not resolve.
- if (childBox.needsLayout() || !m_intrinsicSizeAlongMainAxis.contains(&childBox)) {
- if (isHorizontalWritingMode() == childBox.isHorizontalWritingMode())
- childBox.setOverridingContainingBlockContentLogicalHeight(WTF::nullopt);
- else
- childBox.setOverridingContainingBlockContentLogicalWidth(WTF::nullopt);
- childBox.clearOverridingContentSize();
- childBox.setChildNeedsLayout(MarkOnlyThis);
- childBox.layoutIfNeeded();
- cacheChildMainSize(childBox);
- childBox.clearOverridingContainingBlockContentSize();
- }
- }
-
- auto borderAndPadding = isHorizontalFlow() ? childBox.horizontalBorderAndPaddingExtent() : childBox.verticalBorderAndPaddingExtent();
- auto childInnerFlexBaseSize = computeInnerFlexBaseSizeForChild(childBox, borderAndPadding);
- auto childMinMaxAppliedMainAxisExtent = adjustChildSizeForMinAndMax(childBox, childInnerFlexBaseSize);
- auto margin = isHorizontalFlow() ? childBox.horizontalMarginExtent() : childBox.verticalMarginExtent();
- return FlexItem(childBox, childInnerFlexBaseSize, childMinMaxAppliedMainAxisExtent, borderAndPadding, margin);
- };
- flexItems.append(constructFlexItemForChildBox(*child));
}
- return flexItems;
+
+ LayoutUnit borderAndPadding = isHorizontalFlow() ? child.horizontalBorderAndPaddingExtent() : child.verticalBorderAndPaddingExtent();
+ LayoutUnit childInnerFlexBaseSize = computeInnerFlexBaseSizeForChild(child, borderAndPadding);
+ LayoutUnit childMinMaxAppliedMainAxisExtent = adjustChildSizeForMinAndMax(child, childInnerFlexBaseSize);
+ LayoutUnit margin = isHorizontalFlow() ? child.horizontalMarginExtent() : child.verticalMarginExtent();
+ return FlexItem(child, childInnerFlexBaseSize, childMinMaxAppliedMainAxisExtent, borderAndPadding, margin);
}
void RenderFlexibleBox::freezeViolations(Vector<FlexItem*>& violations, LayoutUnit& availableFreeSpace, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink)
Modified: branches/safari-612.1.14-branch/Source/WebCore/rendering/RenderFlexibleBox.h (277309 => 277310)
--- branches/safari-612.1.14-branch/Source/WebCore/rendering/RenderFlexibleBox.h 2021-05-11 00:25:26 UTC (rev 277309)
+++ branches/safari-612.1.14-branch/Source/WebCore/rendering/RenderFlexibleBox.h 2021-05-11 00:35:40 UTC (rev 277310)
@@ -175,7 +175,7 @@
void prepareOrderIteratorAndMargins();
LayoutUnit adjustChildSizeForMinAndMax(RenderBox& child, LayoutUnit childSize);
LayoutUnit adjustChildSizeForAspectRatioCrossAxisMinAndMax(const RenderBox& child, LayoutUnit childSize);
- Vector<FlexItem> constructFlexItems(bool relayoutChildren);
+ FlexItem constructFlexItem(RenderBox&, bool relayoutChildren);
void freezeInflexibleItems(FlexSign, Vector<FlexItem>& children, LayoutUnit& remainingFreeSpace, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink);
bool resolveFlexibleLengths(FlexSign, Vector<FlexItem>&, LayoutUnit initialFreeSpace, LayoutUnit& remainingFreeSpace, double& totalFlexGrow, double& totalFlexShrink, double& totalWeightedFlexShrink);
@@ -220,7 +220,7 @@
// This is SizeIsUnknown outside of layoutBlock()
SizeDefiniteness m_hasDefiniteHeight { SizeDefiniteness::Unknown };
- bool m_inFlexItemConstruction { false };
+ bool m_inLayout { false };
bool m_shouldResetChildLogicalHeightBeforeLayout { false };
};
