Changeset 175345 in webkit

Timestamp:

Oct 29, 2014, 2:13:12 PM (12 years ago)

Author:

Alan Bujtas

Message:

Remove invalid float from RootInlineBox.
​https://bugs.webkit.org/show_bug.cgi?id=137707

Reviewed by Antti Koivisto.

In certain cases, floating boxes get attached to the last (root) inline box.
When this particular floating box gets destroyed, it also needs to be detached
from the last inline box.
Source/WebCore:

1. Introduce RootInlineBox::removeFloat() (vs. RootInlineBox::appendFloat())
2. Ensure that it is called when the floating box is being destroyed.

Test: fast/inline/crash-when-inline-box-has-invalid-float.html

• rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::removeFloatingObject):
(WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout): During style recalc, while
tearing down the render tree, we can get to a state where a block element has both inline and block children.
It happens when the style change on an element makes sibling anonymous block wrappers detached.
In that case the markAllDescendantsWithFloatsForLayout() call does not get propagated down on the
block child elements as we return early at the childrenInline() check.

• rendering/RootInlineBox.h:

(WebCore::RootInlineBox::removeFloat):

LayoutTests:

• fast/inline/crash-when-inline-box-has-invalid-float-expected.txt: Added.
• fast/inline/crash-when-inline-box-has-invalid-float.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float-expected.txt (added)
• LayoutTests/fast/inline/crash-when-inline-box-has-invalid-float.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockFlow.cpp (modified) (2 diffs)
• Source/WebCore/rendering/RootInlineBox.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2014-10-29  Zalan Bujtas  <zalan@apple.com>
+
+        Remove invalid float from RootInlineBox.
+        https://bugs.webkit.org/show_bug.cgi?id=137707
+
+        Reviewed by Antti Koivisto.
+
+        In certain cases, floating boxes get attached to the last (root) inline box.
+        When this particular floating box gets destroyed, it also needs to be detached
+        from the last inline box.
+
+        * fast/inline/crash-when-inline-box-has-invalid-float-expected.txt: Added.
+        * fast/inline/crash-when-inline-box-has-invalid-float.html: Added.
+
 2014-10-29  Alexey Proskuryakov  <ap@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-10-29  Zalan Bujtas  <zalan@apple.com>
+
+        Remove invalid float from RootInlineBox.
+        https://bugs.webkit.org/show_bug.cgi?id=137707
+
+        Reviewed by Antti Koivisto.
+
+        In certain cases, floating boxes get attached to the last (root) inline box.
+        When this particular floating box gets destroyed, it also needs to be detached
+        from the last inline box.
+        1. Introduce RootInlineBox::removeFloat() (vs. RootInlineBox::appendFloat())
+        2. Ensure that it is called when the floating box is being destroyed.
+
+        Test: fast/inline/crash-when-inline-box-has-invalid-float.html
+
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::removeFloatingObject):
+        (WebCore::RenderBlockFlow::markAllDescendantsWithFloatsForLayout): During style recalc, while
+        tearing down the render tree, we can get to a state where a block element has both inline and block children.
+        It happens when the style change on an element makes sibling anonymous block wrappers detached.
+        In that case the markAllDescendantsWithFloatsForLayout() call does not get propagated down on the
+        block child elements as we return early at the childrenInline() check.
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::removeFloat):
+
 2014-10-29  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/rendering/RenderBlockFlow.cpp

@@ -2226 +2226 @@
                 }
                 if (floatingObject->originatingLine()) {
+                    floatingObject->originatingLine()->removeFloat(floatBox);
                     if (!selfNeedsLayout()) {
                         ASSERT(&floatingObject->originatingLine()->renderer() == this);
@@ -2683 +2684 @@
         removeFloatingObject(*floatToRemove);
 
-    if (childrenInline())
-        return;
-
-    // Iterate over our children and mark them as needed.
+    // Iterate over our block children and mark them as needed.
     for (auto& block : childrenOfType<RenderBlock>(*this)) {
         if (!floatToRemove && block.isFloatingOrOutOfFlowPositioned())

trunk/Source/WebCore/rendering/RootInlineBox.h

@@ -146 +146 @@
     }
 
+    void removeFloat(RenderBox& floatingBox)
+    {
+        ASSERT(m_floats);
+        ASSERT(m_floats->contains(&floatingBox));
+        m_floats->remove(m_floats->find(&floatingBox));
+    }
+
     Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_floats.get(); }