Changeset 202931 in webkit

Timestamp:

Jul 7, 2016, 2:24:45 PM (10 years ago)

Author:

Antti Koivisto

Message:

REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
​https://bugs.webkit.org/show_bug.cgi?id=159519

Reviewed by Zalan Bujtas.

Source/WebCore:

Test: fast/inline/trailing-floats-inline-crash.html

• rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::checkFloatsInCleanLine):

Use the existing deletionHasBegun bit in RenderStyle to assert against this reliably.

• rendering/RenderLineBoxList.cpp:

(WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

In some cases a special TrailingFloatsRootInlineBox may be added as the last root linebox of a flow.
If it is combined with br the existing invalidation that invalidates the next and previous line may
not be sufficient. Test for this case and invalidate the TrailingFloatsRootInlineBox too if it exists.

• rendering/RootInlineBox.h:

(WebCore::RootInlineBox::isTrailingFloatsRootInlineBox):

• rendering/TrailingFloatsRootInlineBox.h:
• rendering/style/RenderStyle.h:

(WebCore::RenderStyle::deletionHasBegun):

Expose the bit in debug.

LayoutTests:

• fast/inline/trailing-floats-inline-crash-expected.txt: Added.
• fast/inline/trailing-floats-inline-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/inline/trailing-floats-inline-crash-expected.txt (added)
• LayoutTests/fast/inline/trailing-floats-inline-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockLineLayout.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderLineBoxList.cpp (modified) (1 diff)
• Source/WebCore/rendering/RootInlineBox.h (modified) (1 diff)
• Source/WebCore/rendering/TrailingFloatsRootInlineBox.h (modified) (1 diff)
• Source/WebCore/rendering/style/RenderStyle.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-07-07  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
+        https://bugs.webkit.org/show_bug.cgi?id=159519
+
+        Reviewed by Zalan Bujtas.
+
+        * fast/inline/trailing-floats-inline-crash-expected.txt: Added.
+        * fast/inline/trailing-floats-inline-crash.html: Added.
+
 2016-07-07  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-07-07  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
+        https://bugs.webkit.org/show_bug.cgi?id=159519
+
+        Reviewed by Zalan Bujtas.
+
+        Test: fast/inline/trailing-floats-inline-crash.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlockFlow::checkFloatsInCleanLine):
+
+            Use the existing deletionHasBegun bit in RenderStyle to assert against this reliably.
+
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+
+            In some cases a special TrailingFloatsRootInlineBox may be added as the last root linebox of a flow.
+            If it is combined with br the existing invalidation that invalidates the next and previous line may
+            not be sufficient. Test for this case and invalidate the TrailingFloatsRootInlineBox too if it exists.
+
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::isTrailingFloatsRootInlineBox):
+        * rendering/TrailingFloatsRootInlineBox.h:
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::deletionHasBegun):
+
+            Expose the bit in debug.
+
 2016-07-07  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

@@ -1789 +1789 @@
     for (auto it = cleanLineFloats->begin(), end = cleanLineFloats->end(); it != end; ++it) {
         RenderBox* floatingBox = *it;
+        ASSERT_WITH_SECURITY_IMPLICATION(!floatingBox->style().deletionHasBegun());
         floatingBox->layoutIfNeeded();
         LayoutSize newSize(floatingBox->width() + floatingBox->horizontalMarginExtent(), floatingBox->height() + floatingBox->verticalMarginExtent());

trunk/Source/WebCore/rendering/RenderLineBoxList.cpp

@@ -383 +383 @@
         // FIXME: We shouldn't need to always dirty the next line. This is only strictly 
         // necessary some of the time, in situations involving BRs.
-        if (RootInlineBox* nextBox = box->nextRootBox())
+        if (RootInlineBox* nextBox = box->nextRootBox()) {
             nextBox->markDirty();
+
+            // Special root box for floats may be added at the end of the list. If this occurs with BRs we need to invalidate it explicitly.
+            if (auto* nextNextBox = nextBox->nextRootBox()) {
+                if (nextNextBox->isTrailingFloatsRootInlineBox())
+                    nextNextBox->markDirty();
+            }
+        }
     }
 }

trunk/Source/WebCore/rendering/RootInlineBox.h

@@ -191 +191 @@
     Node* getLogicalEndBoxWithNode(InlineBox*&) const;
 
+    virtual bool isTrailingFloatsRootInlineBox() const { return false; }
+
 #if ENABLE(TREE_DEBUGGING)
     const char* boxName() const final;

trunk/Source/WebCore/rendering/TrailingFloatsRootInlineBox.h

@@ -41 +41 @@
 private:
     float virtualLogicalHeight() const override { return 0; }
+    bool isTrailingFloatsRootInlineBox() const final { return true; }
 };
 

trunk/Source/WebCore/rendering/style/RenderStyle.h

@@ -498 +498 @@
     static RenderStyle createAnonymousStyleWithDisplay(const RenderStyle& parentStyle, EDisplay);
     static RenderStyle createStyleInheritingFromPseudoStyle(const RenderStyle& pseudoStyle);
+
+#if !ASSERT_DISABLED
+    bool deletionHasBegun() const { return m_deletionHasBegun; }
+#endif
 
     ContentPosition resolvedJustifyContentPosition(const StyleContentAlignmentData& normalValueBehavior) const;