Title: [150029] trunk
- Revision
- 150029
- Author
- [email protected]
- Date
- 2013-05-13 12:30:37 -0700 (Mon, 13 May 2013)
Log Message
Source/WebCore: Floats should not overhang from flex items
https://bugs.webkit.org/show_bug.cgi?id=115925
Patch by Bem Jones-Bey <[email protected]> on 2013-05-13
Reviewed by David Hyatt.
Allowing floats to overhand from flex items is not only against the
spec, it causes bad bugs. Fix this by having flex items properly avoid
floats.
Test: fast/block/float/float-not-removed-crash2.html
* rendering/RenderBox.cpp:
(WebCore::RenderBox::avoidsFloats): Add flex items to avoid floats.
* rendering/RenderBox.h:
(WebCore::RenderBox::isFlexItemIncludingDeprecated): Determine if the current box is a
flex item or deprecated flex item.
LayoutTests: Fix the float logic to not return an anonymous block ancestor
https://bugs.webkit.org/show_bug.cgi?id=115925
Patch by Bem Jones-Bey <[email protected]> on 2013-05-13
Reviewed by David Hyatt.
Cleaned up fuzzer test. Note that this will only crash when run under
a memory checker like ASAN.
* fast/block/float/float-not-removed-crash2-expected.txt: Added.
* fast/block/float/float-not-removed-crash2.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (150028 => 150029)
--- trunk/LayoutTests/ChangeLog 2013-05-13 19:23:16 UTC (rev 150028)
+++ trunk/LayoutTests/ChangeLog 2013-05-13 19:30:37 UTC (rev 150029)
@@ -1,3 +1,16 @@
+2013-05-13 Bem Jones-Bey <[email protected]>
+
+ Fix the float logic to not return an anonymous block ancestor
+ https://bugs.webkit.org/show_bug.cgi?id=115925
+
+ Reviewed by David Hyatt.
+
+ Cleaned up fuzzer test. Note that this will only crash when run under
+ a memory checker like ASAN.
+
+ * fast/block/float/float-not-removed-crash2-expected.txt: Added.
+ * fast/block/float/float-not-removed-crash2.html: Added.
+
2013-05-13 Zoltan Horvath <[email protected]>
[CSS Regions][CSS Exclusions] Shape-inside on regions should respect region borders and paddings
Added: trunk/LayoutTests/fast/block/float/float-not-removed-crash2-expected.txt (0 => 150029)
--- trunk/LayoutTests/fast/block/float/float-not-removed-crash2-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/float/float-not-removed-crash2-expected.txt 2013-05-13 19:30:37 UTC (rev 150029)
@@ -0,0 +1 @@
+PASS. WebKit didn't crash.
Added: trunk/LayoutTests/fast/block/float/float-not-removed-crash2.html (0 => 150029)
--- trunk/LayoutTests/fast/block/float/float-not-removed-crash2.html (rev 0)
+++ trunk/LayoutTests/fast/block/float/float-not-removed-crash2.html 2013-05-13 19:30:37 UTC (rev 150029)
@@ -0,0 +1,25 @@
+<html>
+<body style="display: -webkit-flex;">
+<i>
+<div> </div><row>
+<source id=test style="float: right; padding-top: 238px;">A</source>
+</i>
+<div style="height: 188;"></div>
+<style>
+.class1 {
+ width: 51667px;
+}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+document.body.offsetTop;
+test.setAttribute("class", "class1");
+document.body.offsetTop;
+test.parentNode.removeChild(test);
+document.body.offsetTop;
+document.body.innerHTML = "PASS. WebKit didn't crash.";
+</script>
+</body>
+</html>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (150028 => 150029)
--- trunk/Source/WebCore/ChangeLog 2013-05-13 19:23:16 UTC (rev 150028)
+++ trunk/Source/WebCore/ChangeLog 2013-05-13 19:30:37 UTC (rev 150029)
@@ -1,3 +1,22 @@
+2013-05-13 Bem Jones-Bey <[email protected]>
+
+ Floats should not overhang from flex items
+ https://bugs.webkit.org/show_bug.cgi?id=115925
+
+ Reviewed by David Hyatt.
+
+ Allowing floats to overhand from flex items is not only against the
+ spec, it causes bad bugs. Fix this by having flex items properly avoid
+ floats.
+
+ Test: fast/block/float/float-not-removed-crash2.html
+
+ * rendering/RenderBox.cpp:
+ (WebCore::RenderBox::avoidsFloats): Add flex items to avoid floats.
+ * rendering/RenderBox.h:
+ (WebCore::RenderBox::isFlexItemIncludingDeprecated): Determine if the current box is a
+ flex item or deprecated flex item.
+
2013-05-13 Zoltan Horvath <[email protected]>
[CSS Regions][CSS Exclusions] Shape-inside on regions should respect region borders and paddings
Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (150028 => 150029)
--- trunk/Source/WebCore/rendering/RenderBox.cpp 2013-05-13 19:23:16 UTC (rev 150028)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp 2013-05-13 19:30:37 UTC (rev 150029)
@@ -4084,7 +4084,7 @@
bool RenderBox::avoidsFloats() const
{
- return isReplaced() || hasOverflowClip() || isHR() || isLegend() || isWritingModeRoot() || isDeprecatedFlexItem();
+ return isReplaced() || hasOverflowClip() || isHR() || isLegend() || isWritingModeRoot() || isFlexItemIncludingDeprecated();
}
void RenderBox::addVisualEffectOverflow()
Modified: trunk/Source/WebCore/rendering/RenderBox.h (150028 => 150029)
--- trunk/Source/WebCore/rendering/RenderBox.h 2013-05-13 19:23:16 UTC (rev 150028)
+++ trunk/Source/WebCore/rendering/RenderBox.h 2013-05-13 19:30:37 UTC (rev 150029)
@@ -505,6 +505,7 @@
bool isWritingModeRoot() const { return !parent() || parent()->style()->writingMode() != style()->writingMode(); }
bool isDeprecatedFlexItem() const { return !isInline() && !isFloatingOrOutOfFlowPositioned() && parent() && parent()->isDeprecatedFlexibleBox(); }
+ bool isFlexItemIncludingDeprecated() const { return !isInline() && !isFloatingOrOutOfFlowPositioned() && parent() && parent()->isFlexibleBoxIncludingDeprecated(); }
virtual LayoutUnit lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
virtual int baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const OVERRIDE;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
