Changeset 245454 in webkit

Timestamp:

May 17, 2019, 4:25:20 AM (7 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r245361 - Do not create a shape object outside of the layout context
​https://bugs.webkit.org/show_bug.cgi?id=197926
<rdar://problem/50627858>

Reviewed by Simon Fraser.

Source/WebCore:

ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.

Test: fast/block/float/float-with-shape-outside-crash.html

• rendering/FloatingObjects.cpp:

(WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
(WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):

• rendering/shapes/ShapeOutsideInfo.cpp:

(WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):

LayoutTests:

• fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
• fast/block/float/float-with-shape-outside-crash.html: Added.

Location:

releases/WebKitGTK/webkit-2.24

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/block/float/float-with-shape-outside-crash-expected.txt (added)
• LayoutTests/fast/block/float/float-with-shape-outside-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/FloatingObjects.cpp (modified) (2 diffs)
• Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp (modified) (2 diffs)

releases/WebKitGTK/webkit-2.24/LayoutTests/ChangeLog

@@ +1 @@
+2019-05-15  Zalan Bujtas  <zalan@apple.com>
+
+        Do not create a shape object outside of the layout context
+        https://bugs.webkit.org/show_bug.cgi?id=197926
+        <rdar://problem/50627858>
+
+        Reviewed by Simon Fraser.
+
+        * fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
+        * fast/block/float/float-with-shape-outside-crash.html: Added.
+
 2019-05-14  Zalan Bujtas  <zalan@apple.com>
 

releases/WebKitGTK/webkit-2.24/Source/WebCore/ChangeLog

@@ +1 @@
+2019-05-15  Zalan Bujtas  <zalan@apple.com>
+
+        Do not create a shape object outside of the layout context
+        https://bugs.webkit.org/show_bug.cgi?id=197926
+        <rdar://problem/50627858>
+
+        Reviewed by Simon Fraser.
+
+        ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
+        If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.
+
+        Test: fast/block/float/float-with-shape-outside-crash.html
+
+        * rendering/FloatingObjects.cpp:
+        (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
+        (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
+        * rendering/shapes/ShapeOutsideInfo.cpp:
+        (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):
+
 2019-05-14  Zalan Bujtas  <zalan@apple.com>
 

releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/FloatingObjects.cpp

@@ -480 +480 @@
     if (ShapeOutsideInfo* shapeOutside = floatingObject.renderer().shapeOutsideInfo()) {
         ShapeOutsideDeltas shapeDeltas = shapeOutside->computeDeltasForContainingBlockLine(*m_renderer, floatingObject, m_lineTop, m_lineBottom - m_lineTop);
-        if (!shapeDeltas.lineOverlapsShape())
+        if (!shapeDeltas.isValid() || !shapeDeltas.lineOverlapsShape())
             return false;
 
@@ -499 +499 @@
     if (ShapeOutsideInfo* shapeOutside = floatingObject.renderer().shapeOutsideInfo()) {
         ShapeOutsideDeltas shapeDeltas = shapeOutside->computeDeltasForContainingBlockLine(*m_renderer, floatingObject, m_lineTop, m_lineBottom - m_lineTop);
-        if (!shapeDeltas.lineOverlapsShape())
+        if (!shapeDeltas.isValid() || !shapeDeltas.lineOverlapsShape())
             return false;
 

releases/WebKitGTK/webkit-2.24/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp

@@ -39 +39 @@
 #include "RenderFragmentContainer.h"
 #include "RenderImage.h"
+#include "RenderView.h"
 
 namespace WebCore {
@@ -321 +322 @@
 ShapeOutsideDeltas ShapeOutsideInfo::computeDeltasForContainingBlockLine(const RenderBlockFlow& containingBlock, const FloatingObject& floatingObject, LayoutUnit lineTop, LayoutUnit lineHeight)
 {
+    // If we never constructed this shape during layout, we propably don't need to know about it outside of layout in the context of "containing block line".
+    if (!m_shape && !containingBlock.view().frameView().layoutContext().isInLayout())
+        return { };
+
     ASSERT(lineHeight >= 0);
     LayoutUnit borderBoxTop = containingBlock.logicalTopForFloat(floatingObject) + containingBlock.marginBeforeForChild(m_renderer);