Changeset 254559 in webkit

Timestamp:

Jan 14, 2020, 10:32:01 PM (7 years ago)

Author:

Alan Bujtas

Message:

Long continuation chain could lead to stack exhaustion
​https://bugs.webkit.org/show_bug.cgi?id=206271
<rdar://problem/41189798>

Reviewed by Simon Fraser.

Source/WebCore:

This patch replaces the recursive approach with an iterative one
to collect absolute quads across continuation.

Test: fast/inline/long-continuation-crash.html

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::absoluteQuads const):
(WebCore::RenderBlock::absoluteQuadsIgnoringContinuation const):

• rendering/RenderBlock.h:
• rendering/RenderBoxModelObject.cpp:

(WebCore::RenderBoxModelObject::collectAbsoluteQuadsForContinuation const):

• rendering/RenderBoxModelObject.h:

(WebCore::RenderBoxModelObject::absoluteQuadsIgnoringContinuation const):

• rendering/RenderInline.cpp:

(WebCore::RenderInline::absoluteQuads const):
(WebCore::RenderInline::absoluteQuadsIgnoringContinuation const):

• rendering/RenderInline.h:

LayoutTests:

• fast/inline/long-continuation-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/inline/long-continuation-crash-expected.txt (added)
• LayoutTests/fast/inline/long-continuation-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.h (modified) (1 diff)
• Source/WebCore/rendering/RenderBoxModelObject.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderBoxModelObject.h (modified) (1 diff)
• Source/WebCore/rendering/RenderInline.cpp (modified) (1 diff)
• Source/WebCore/rendering/RenderInline.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-01-14  Zalan Bujtas  <zalan@apple.com>
+
+        Long continuation chain could lead to stack exhaustion
+        https://bugs.webkit.org/show_bug.cgi?id=206271
+        <rdar://problem/41189798>
+
+        Reviewed by Simon Fraser.
+
+        * fast/inline/long-continuation-crash.html: Added.
+
 2020-01-14  Peng Liu  <peng.liu6@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-01-14  Zalan Bujtas  <zalan@apple.com>
+
+        Long continuation chain could lead to stack exhaustion
+        https://bugs.webkit.org/show_bug.cgi?id=206271
+        <rdar://problem/41189798>
+
+        Reviewed by Simon Fraser.
+
+        This patch replaces the recursive approach with an iterative one
+        to collect absolute quads across continuation.
+
+        Test: fast/inline/long-continuation-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::absoluteQuads const):
+        (WebCore::RenderBlock::absoluteQuadsIgnoringContinuation const):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::collectAbsoluteQuadsForContinuation const):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::absoluteQuadsIgnoringContinuation const):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteQuads const):
+        (WebCore::RenderInline::absoluteQuadsIgnoringContinuation const):
+        * rendering/RenderInline.h:
+
 2020-01-14  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -2782 +2782 @@
 void RenderBlock::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
 {
+    if (!continuation()) {
+        absoluteQuadsIgnoringContinuation({ { }, size() }, quads, wasFixed);
+        return;
+    }
     // For blocks inside inlines, we include margins so that we run right up to the inline boxes
     // above and below us (thus getting merged with them to form a single irregular shape).
-    auto* continuation = this->continuation();
-    FloatRect localRect = continuation
-        ? FloatRect(0, -collapsedMarginBefore(), width(), height() + collapsedMarginBefore() + collapsedMarginAfter())
-        : FloatRect(0, 0, width(), height());
-    
+    auto logicalRect = FloatRect { 0, -collapsedMarginBefore(), width(), height() + collapsedMarginBefore() + collapsedMarginAfter() };
+    absoluteQuadsIgnoringContinuation(logicalRect, quads, wasFixed);
+    collectAbsoluteQuadsForContinuation(quads, wasFixed);
+}
+
+void RenderBlock::absoluteQuadsIgnoringContinuation(const FloatRect& logicalRect, Vector<FloatQuad>& quads, bool* wasFixed) const
+{
     // FIXME: This is wrong for block-flows that are horizontal.
     // https://bugs.webkit.org/show_bug.cgi?id=46781
-    RenderFragmentedFlow* fragmentedFlow = enclosingFragmentedFlow();
-    if (!fragmentedFlow || !fragmentedFlow->absoluteQuadsForBox(quads, wasFixed, this, localRect.y(), localRect.maxY()))
-        quads.append(localToAbsoluteQuad(localRect, UseTransforms, wasFixed));
-
-    if (continuation)
-        continuation->absoluteQuads(quads, wasFixed);
+    auto* fragmentedFlow = enclosingFragmentedFlow();
+    if (!fragmentedFlow || !fragmentedFlow->absoluteQuadsForBox(quads, wasFixed, this, logicalRect.y(), logicalRect.maxY()))
+        quads.append(localToAbsoluteQuad(logicalRect, UseTransforms, wasFixed));
 }
 

trunk/Source/WebCore/rendering/RenderBlock.h

@@ -494 +494 @@
     void removePositionedObjectsIfNeeded(const RenderStyle& oldStyle, const RenderStyle& newStyle);
 
+    void absoluteQuadsIgnoringContinuation(const FloatRect&, Vector<FloatQuad>&, bool* wasFixed) const override;
+
 private:
     bool hasRareData() const;

trunk/Source/WebCore/rendering/RenderBoxModelObject.cpp

@@ -2696 +2696 @@
 }
 
+void RenderBoxModelObject::collectAbsoluteQuadsForContinuation(Vector<FloatQuad>& quads, bool* wasFixed) const
+{
+    ASSERT(continuation());
+    for (auto* nextInContinuation = this->continuation(); nextInContinuation; nextInContinuation = nextInContinuation->continuation()) {
+        if (is<RenderBlock>(*nextInContinuation)) {
+            auto& blockBox = downcast<RenderBlock>(*nextInContinuation);
+            // For blocks inside inlines, we include margins so that we run right up to the inline boxes
+            // above and below us (thus getting merged with them to form a single irregular shape).
+            auto logicalRect = FloatRect { 0, -blockBox.collapsedMarginBefore(), blockBox.width(),
+                blockBox.height() + blockBox.collapsedMarginBefore() + blockBox.collapsedMarginAfter() };
+            nextInContinuation->absoluteQuadsIgnoringContinuation(logicalRect, quads, wasFixed);
+            continue;
+        }
+        nextInContinuation->absoluteQuadsIgnoringContinuation({ }, quads, wasFixed);
+    }
+}
+
 } // namespace WebCore

trunk/Source/WebCore/rendering/RenderBoxModelObject.h

@@ -295 +295 @@
 protected:
     LayoutUnit computedCSSPadding(const Length&) const;
+    virtual void absoluteQuadsIgnoringContinuation(const FloatRect&, Vector<FloatQuad>&, bool* /*wasFixed*/) const { ASSERT_NOT_REACHED(); }
+    void collectAbsoluteQuadsForContinuation(Vector<FloatQuad>& quads, bool* wasFixed) const;
 
 private:

trunk/Source/WebCore/rendering/RenderInline.cpp

@@ -413 +413 @@
 void RenderInline::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
 {
+    absoluteQuadsIgnoringContinuation({ }, quads, wasFixed);
+    if (continuation())
+        collectAbsoluteQuadsForContinuation(quads, wasFixed);
+}
+
+void RenderInline::absoluteQuadsIgnoringContinuation(const FloatRect&, Vector<FloatQuad>& quads, bool*) const
+{
     AbsoluteQuadsGeneratorContext context(this, quads);
     generateLineBoxRects(context);
-
-    if (RenderBoxModelObject* continuation = this->continuation())
-        continuation->absoluteQuads(quads, wasFixed);
 }
 

trunk/Source/WebCore/rendering/RenderInline.h

@@ -110 +110 @@
     InlineBox* culledInlineLastLineBox() const;
 
+    void absoluteQuadsIgnoringContinuation(const FloatRect&, Vector<FloatQuad>&, bool* wasFixed) const override;
+
     template<typename GeneratorContext>
     void generateLineBoxRects(GeneratorContext& yield) const;