Changeset 286827 in webkit

Timestamp:

Dec 9, 2021, 7:37:04 PM (5 years ago)

Author:

cathiechen

Message:

Stack-overflow crash in WebCore::RenderBox::computeLogicalHeight()
​https://bugs.webkit.org/show_bug.cgi?id=233460

Reviewed by Sergio Villar Senin and Darin Adler.

Source/WebCore:

Like flexibleBox item, deprecatedFlexibleBox item should call clearOverridingContentSize if
it is positioned. Otherwise, RenderReplaced::computeAspectRatioInformationForRenderBox might call
itself recursively.

Test: fast/css/deprecated-flex-box-with-min-content-crashes.html

• rendering/RenderBox.cpp:

(WebCore::RenderBox::styleDidChange):

• rendering/style/RenderStyle.h:

(WebCore::RenderStyle::isDisplayFlexibleOrGridBoxIncludingDeprecated const):
(WebCore::RenderStyle::isDisplayDeprecatedFlexibleBox):

LayoutTests:

• fast/css/deprecated-flex-box-with-min-content-crashes-expected.txt: Added.
• fast/css/deprecated-flex-box-with-min-content-crashes.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/css/deprecated-flex-box-with-min-content-crashes-expected.txt (added)
• LayoutTests/fast/css/deprecated-flex-box-with-min-content-crashes.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBox.cpp (modified) (1 diff)
• Source/WebCore/rendering/style/RenderStyle.h (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-12-09  Cathie Chen  <cathiechen@igalia.com>
+
+        Stack-overflow crash in WebCore::RenderBox::computeLogicalHeight()
+        https://bugs.webkit.org/show_bug.cgi?id=233460
+
+        Reviewed by Sergio Villar Senin and Darin Adler.
+
+        * fast/css/deprecated-flex-box-with-min-content-crashes-expected.txt: Added.
+        * fast/css/deprecated-flex-box-with-min-content-crashes.html: Added.
+
 2021-12-09  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-12-09  Cathie Chen  <cathiechen@igalia.com>
+
+        Stack-overflow crash in WebCore::RenderBox::computeLogicalHeight()
+        https://bugs.webkit.org/show_bug.cgi?id=233460
+
+        Reviewed by Sergio Villar Senin and Darin Adler.
+
+        Like flexibleBox item, deprecatedFlexibleBox item should call clearOverridingContentSize if
+        it is positioned. Otherwise, RenderReplaced::computeAspectRatioInformationForRenderBox might call
+        itself recursively.
+
+        Test: fast/css/deprecated-flex-box-with-min-content-crashes.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::isDisplayFlexibleOrGridBoxIncludingDeprecated const):
+        (WebCore::RenderStyle::isDisplayDeprecatedFlexibleBox):
+
 2021-12-09  Devin Rousso  <drousso@apple.com>
 

trunk/Source/WebCore/rendering/RenderBox.cpp

@@ -418 +418 @@
     // children of a flex/grid box are out-of-flow, and thus, not flex/grid items. This means that we need to clear
     // any override content size set by our container, because it would likely be incorrect after the style change.
-    if (isOutOfFlowPositioned() && parent() && parent()->style().isDisplayFlexibleOrGridBox())
+    if (isOutOfFlowPositioned() && parent() && parent()->style().isDisplayFlexibleBoxIncludingDeprecatedOrGridBox())
         clearOverridingContentSize();
 

trunk/Source/WebCore/rendering/style/RenderStyle.h

@@ -1518 +1518 @@
     bool isOriginalDisplayInlineType() const { return isDisplayInlineType(originalDisplay()); }
     bool isDisplayFlexibleOrGridBox() const { return isDisplayFlexibleOrGridBox(display()); }
+    bool isDisplayFlexibleBoxIncludingDeprecatedOrGridBox() const { return isDisplayFlexibleOrGridBox() || isDisplayDeprecatedFlexibleBox(display()); }
     bool isDisplayRegionType() const;
     bool isDisplayTableOrTablePart() const { return isDisplayTableOrTablePart(display()); }
@@ -2007 +2008 @@
     static bool isDisplayGridBox(DisplayType);
     static bool isDisplayFlexibleOrGridBox(DisplayType);
+    static bool isDisplayDeprecatedFlexibleBox(DisplayType);
     static bool isDisplayListItemType(DisplayType);
     static bool isDisplayTableOrTablePart(DisplayType);
@@ -2425 +2427 @@
 }
 
+inline bool RenderStyle::isDisplayDeprecatedFlexibleBox(DisplayType display)
+{
+    return display == DisplayType::Box || display == DisplayType::InlineBox;
+}
+
 inline bool RenderStyle::isDisplayListItemType(DisplayType display)
 {