Title: [184453] releases/WebKitGTK/webkit-2.4
- Revision
- 184453
- Author
- [email protected]
- Date
- 2015-05-18 03:19:43 -0700 (Mon, 18 May 2015)
Log Message
Merge r175345 - Remove invalid float from RootInlineBox.
https://bugs.webkit.org/show_bug.cgi?id=137707
Reviewed by Antti Koivisto.
In certain cases, floating boxes get attached to the last (root) inline box.
When this particular floating box gets destroyed, it also needs to be detached
from the last inline box.
Source/WebCore:
1. Introduce RootInlineBox::removeFloat() (vs. RootInlineBox::appendFloat())
2. Ensure that it is called when the floating box is being destroyed.
Test: fast/inline/crash-when-inline-box-has-invalid-float.html
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::removeFloatingObject):
(WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout): During style recalc, while
tearing down the render tree, we can get to a state where a block element has both inline and block children.
It happens when the style change on an element makes sibling anonymous block wrappers detached.
In that case the markAllDescendantsWithFloatsForLayout() call does not get propagated down on the
block child elements as we return early at the childrenInline() check.
* rendering/RootInlineBox.h:
(WebCore::RootInlineBox::removeFloat):
LayoutTests:
* fast/inline/crash-when-inline-box-has-invalid-float-expected.txt: Added.
* fast/inline/crash-when-inline-box-has-invalid-float.html: Added.
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.4/LayoutTests/ChangeLog (184452 => 184453)
--- releases/WebKitGTK/webkit-2.4/LayoutTests/ChangeLog 2015-05-18 10:14:40 UTC (rev 184452)
+++ releases/WebKitGTK/webkit-2.4/LayoutTests/ChangeLog 2015-05-18 10:19:43 UTC (rev 184453)
@@ -1,3 +1,17 @@
+2014-10-29 Zalan Bujtas <[email protected]>
+
+ Remove invalid float from RootInlineBox.
+ https://bugs.webkit.org/show_bug.cgi?id=137707
+
+ Reviewed by Antti Koivisto.
+
+ In certain cases, floating boxes get attached to the last (root) inline box.
+ When this particular floating box gets destroyed, it also needs to be detached
+ from the last inline box.
+
+ * fast/inline/crash-when-inline-box-has-invalid-float-expected.txt: Added.
+ * fast/inline/crash-when-inline-box-has-invalid-float.html: Added.
+
2014-10-27 Mark Lam <[email protected]>
Crash when attempting to perform array iteration on a non-array with numeric keys not initialized.
Added: releases/WebKitGTK/webkit-2.4/LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float-expected.txt (0 => 184453)
--- releases/WebKitGTK/webkit-2.4/LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float-expected.txt (rev 0)
+++ releases/WebKitGTK/webkit-2.4/LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float-expected.txt 2015-05-18 10:19:43 UTC (rev 184453)
@@ -0,0 +1,6 @@
+PASS, if no crash or ASSERT in debug.
+
+
+
+
+BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAAAAAAAA
Added: releases/WebKitGTK/webkit-2.4/LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float.html (0 => 184453)
--- releases/WebKitGTK/webkit-2.4/LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float.html (rev 0)
+++ releases/WebKitGTK/webkit-2.4/LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float.html 2015-05-18 10:19:43 UTC (rev 184453)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that floating elments are cleaned up properly.</title>
+<style>
+ :last-child {float:left;}
+</style>
+</head>
+
+<body>
+PASS, if no crash or ASSERT in debug.
+<br>
+<br>
+<br>
+<article>
+<pre></pre>
+<br>
+<content>
+<br>
+<select></select>
+<script>
+document.body.contentEditable = "true";
+document.execCommand("SelectAll");
+document.execCommand("StrikeThrough");
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBAAAAAAAAAAAAAAAAAAAAAA
+</body>
+</html>
\ No newline at end of file
Modified: releases/WebKitGTK/webkit-2.4/Source/WebCore/ChangeLog (184452 => 184453)
--- releases/WebKitGTK/webkit-2.4/Source/WebCore/ChangeLog 2015-05-18 10:14:40 UTC (rev 184452)
+++ releases/WebKitGTK/webkit-2.4/Source/WebCore/ChangeLog 2015-05-18 10:19:43 UTC (rev 184453)
@@ -1,3 +1,28 @@
+2014-10-29 Zalan Bujtas <[email protected]>
+
+ Remove invalid float from RootInlineBox.
+ https://bugs.webkit.org/show_bug.cgi?id=137707
+
+ Reviewed by Antti Koivisto.
+
+ In certain cases, floating boxes get attached to the last (root) inline box.
+ When this particular floating box gets destroyed, it also needs to be detached
+ from the last inline box.
+ 1. Introduce RootInlineBox::removeFloat() (vs. RootInlineBox::appendFloat())
+ 2. Ensure that it is called when the floating box is being destroyed.
+
+ Test: fast/inline/crash-when-inline-box-has-invalid-float.html
+
+ * rendering/RenderBlockFlow.cpp:
+ (WebCore::RenderBlockFlow::removeFloatingObject):
+ (WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout): During style recalc, while
+ tearing down the render tree, we can get to a state where a block element has both inline and block children.
+ It happens when the style change on an element makes sibling anonymous block wrappers detached.
+ In that case the markAllDescendantsWithFloatsForLayout() call does not get propagated down on the
+ block child elements as we return early at the childrenInline() check.
+ * rendering/RootInlineBox.h:
+ (WebCore::RootInlineBox::removeFloat):
+
2014-10-22 Said Abou-Hallawa <[email protected]>
SVG loaded through html <img> can't request to load any external resources.
Modified: releases/WebKitGTK/webkit-2.4/Source/WebCore/rendering/RenderBlockFlow.cpp (184452 => 184453)
--- releases/WebKitGTK/webkit-2.4/Source/WebCore/rendering/RenderBlockFlow.cpp 2015-05-18 10:14:40 UTC (rev 184452)
+++ releases/WebKitGTK/webkit-2.4/Source/WebCore/rendering/RenderBlockFlow.cpp 2015-05-18 10:19:43 UTC (rev 184453)
@@ -2114,6 +2114,7 @@
logicalBottom = std::max(logicalBottom, logicalTop + 1);
}
if (floatingObject->originatingLine()) {
+ floatingObject->originatingLine()->removeFloat(floatBox);
if (!selfNeedsLayout()) {
ASSERT(&floatingObject->originatingLine()->renderer() == this);
floatingObject->originatingLine()->markDirty();
@@ -2543,10 +2544,7 @@
if (floatToRemove)
removeFloatingObject(*floatToRemove);
- if (childrenInline())
- return;
-
- // Iterate over our children and mark them as needed.
+ // Iterate over our block children and mark them as needed.
for (auto& block : childrenOfType<RenderBlock>(*this)) {
if (!floatToRemove && block.isFloatingOrOutOfFlowPositioned())
continue;
Modified: releases/WebKitGTK/webkit-2.4/Source/WebCore/rendering/RootInlineBox.h (184452 => 184453)
--- releases/WebKitGTK/webkit-2.4/Source/WebCore/rendering/RootInlineBox.h 2015-05-18 10:14:40 UTC (rev 184452)
+++ releases/WebKitGTK/webkit-2.4/Source/WebCore/rendering/RootInlineBox.h 2015-05-18 10:19:43 UTC (rev 184453)
@@ -150,6 +150,13 @@
m_floats = adoptPtr(new Vector<RenderBox*>(1, &floatingBox));
}
+ void removeFloat(RenderBox& floatingBox)
+ {
+ ASSERT(m_floats);
+ ASSERT(m_floats->contains(&floatingBox));
+ m_floats->remove(m_floats->find(&floatingBox));
+ }
+
Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_floats.get(); }
virtual void extractLineBoxFromRenderObject() override final;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
