⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 245922 in webkit


Ignore:
Timestamp:
May 30, 2019, 5:30:04 PM (7 years ago)
Author:
Alan Coon
Message:

Cherry-pick r245361. rdar://problem/51264842

Do not create a shape object outside of the layout context
​https://bugs.webkit.org/show_bug.cgi?id=197926
<rdar://problem/50627858>

Reviewed by Simon Fraser.

Source/WebCore:

ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.

Test: fast/block/float/float-with-shape-outside-crash.html

  • rendering/FloatingObjects.cpp: (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded): (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
  • rendering/shapes/ShapeOutsideInfo.cpp: (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):

LayoutTests:

  • fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
  • fast/block/float/float-with-shape-outside-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245361 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-607-branch
Files:
2 added
4 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-607-branch/LayoutTests/ChangeLog

    r245921 r245922  
     12019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r245361. rdar://problem/51264842
     4
     5    Do not create a shape object outside of the layout context
     6    https://bugs.webkit.org/show_bug.cgi?id=197926
     7    <rdar://problem/50627858>
     8   
     9    Reviewed by Simon Fraser.
     10   
     11    Source/WebCore:
     12   
     13    ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
     14    If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.
     15   
     16    Test: fast/block/float/float-with-shape-outside-crash.html
     17   
     18    * rendering/FloatingObjects.cpp:
     19    (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
     20    (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
     21    * rendering/shapes/ShapeOutsideInfo.cpp:
     22    (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):
     23   
     24    LayoutTests:
     25   
     26    * fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
     27    * fast/block/float/float-with-shape-outside-crash.html: Added.
     28   
     29    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245361 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     30
     31    2019-05-15  Zalan Bujtas  <zalan@apple.com>
     32
     33            Do not create a shape object outside of the layout context
     34            https://bugs.webkit.org/show_bug.cgi?id=197926
     35            <rdar://problem/50627858>
     36
     37            Reviewed by Simon Fraser.
     38
     39            * fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
     40            * fast/block/float/float-with-shape-outside-crash.html: Added.
     41
    1422019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
    243

  • branches/safari-607-branch/Source/WebCore/ChangeLog

    r245921 r245922  
     12019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
     2
     3        Cherry-pick r245361. rdar://problem/51264842
     4
     5    Do not create a shape object outside of the layout context
     6    https://bugs.webkit.org/show_bug.cgi?id=197926
     7    <rdar://problem/50627858>
     8   
     9    Reviewed by Simon Fraser.
     10   
     11    Source/WebCore:
     12   
     13    ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
     14    If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.
     15   
     16    Test: fast/block/float/float-with-shape-outside-crash.html
     17   
     18    * rendering/FloatingObjects.cpp:
     19    (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
     20    (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
     21    * rendering/shapes/ShapeOutsideInfo.cpp:
     22    (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):
     23   
     24    LayoutTests:
     25   
     26    * fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
     27    * fast/block/float/float-with-shape-outside-crash.html: Added.
     28   
     29    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245361 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     30
     31    2019-05-15  Zalan Bujtas  <zalan@apple.com>
     32
     33            Do not create a shape object outside of the layout context
     34            https://bugs.webkit.org/show_bug.cgi?id=197926
     35            <rdar://problem/50627858>
     36
     37            Reviewed by Simon Fraser.
     38
     39            ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
     40            If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.
     41
     42            Test: fast/block/float/float-with-shape-outside-crash.html
     43
     44            * rendering/FloatingObjects.cpp:
     45            (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
     46            (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
     47            * rendering/shapes/ShapeOutsideInfo.cpp:
     48            (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):
     49
    1502019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
    251

  • branches/safari-607-branch/Source/WebCore/rendering/FloatingObjects.cpp

    r239461 r245922  
    471471    if (ShapeOutsideInfo* shapeOutside = floatingObject.renderer().shapeOutsideInfo()) {
    472472        ShapeOutsideDeltas shapeDeltas = shapeOutside->computeDeltasForContainingBlockLine(*m_renderer, floatingObject, m_lineTop, m_lineBottom - m_lineTop);
    473         if (!shapeDeltas.lineOverlapsShape())
     473        if (!shapeDeltas.isValid() || !shapeDeltas.lineOverlapsShape())
    474474            return false;
    475475
    … …  
    490490    if (ShapeOutsideInfo* shapeOutside = floatingObject.renderer().shapeOutsideInfo()) {
    491491        ShapeOutsideDeltas shapeDeltas = shapeOutside->computeDeltasForContainingBlockLine(*m_renderer, floatingObject, m_lineTop, m_lineBottom - m_lineTop);
    492         if (!shapeDeltas.lineOverlapsShape())
     492        if (!shapeDeltas.isValid() || !shapeDeltas.lineOverlapsShape())
    493493            return false;
    494494

  • branches/safari-607-branch/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp

    r238463 r245922  
    3939#include "RenderFragmentContainer.h"
    4040#include "RenderImage.h"
     41#include "RenderView.h"
    4142
    4243namespace WebCore {
    … …  
    321322ShapeOutsideDeltas ShapeOutsideInfo::computeDeltasForContainingBlockLine(const RenderBlockFlow& containingBlock, const FloatingObject& floatingObject, LayoutUnit lineTop, LayoutUnit lineHeight)
    322323{
     324    // If we never constructed this shape during layout, we propably don't need to know about it outside of layout in the context of "containing block line".
     325    if (!m_shape && !containingBlock.view().frameView().layoutContext().isInLayout())
     326        return { };
     327
    323328    ASSERT(lineHeight >= 0);
    324329    LayoutUnit borderBoxTop = containingBlock.logicalTopForFloat(floatingObject) + containingBlock.marginBeforeForChild(m_renderer);
Note: See TracChangeset for help on using the changeset viewer.