Changeset 169189 in webkit


Ignore:
Timestamp:
May 21, 2014 11:12:34 PM (10 years ago)
Author:
Antti Koivisto
Message:

REGRESSION(r167870): Crash in simple line layout code with :after
https://bugs.webkit.org/show_bug.cgi?id=133155

Source/WebCore:
<rdar://problem/16977696>

Reviewed by Darin Adler.

Fix https://bugs.webkit.org/show_bug.cgi?id=132241 in a safer way.
The underline behavior is tested by the existing fast/text/simple-lines-hover-underline.html

Test: fast/text/simple-lines-hover-after.html

  • rendering/RenderBlock.cpp:

(WebCore::RenderBlock::invalidateLineLayoutPath): Deleted.

Move to RenderBlockFlow.

  • rendering/RenderBlock.h:

(WebCore::RenderBlock::invalidateLineLayoutPath):

  • rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::styleDidChange):

Invalidate layout if style changes in a manner that makes us ineligible to use the simple line layout path.

(WebCore::RenderBlockFlow::invalidateLineLayoutPath):

Drop the simple line layout on path invalidation if it exists. It may not be valid anymore.
Also invalidate the layout if this happens so we'll reconstruct the lines later.

(WebCore::RenderBlockFlow::simpleLineLayout): Deleted.
(WebCore::RenderBlockFlow::ensureLineBoxes):
(WebCore::RenderBlockFlow::createLineBoxes): Deleted.

Revert some of the changes made it r167870.

  • rendering/RenderBlockFlow.h:

(WebCore::RenderBlockFlow::simpleLineLayout):

Add strong validity assert.

LayoutTests:

Reviewed by Darin Adler.

  • fast/text/simple-lines-hover-after-expected.html: Added.
  • fast/text/simple-lines-hover-after.html: Added.
Location:
trunk
Files:
2 added
6 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r169178 r169189  
     12014-05-21  Antti Koivisto  <antti@apple.com>
     2
     3        REGRESSION(r167870): Crash in simple line layout code with :after
     4        https://bugs.webkit.org/show_bug.cgi?id=133155
     5
     6        Reviewed by Darin Adler.
     7
     8        * fast/text/simple-lines-hover-after-expected.html: Added.
     9        * fast/text/simple-lines-hover-after.html: Added.
     10
    1112014-05-21  Zalan Bujtas  <zalan@apple.com>
    212
  • trunk/Source/WebCore/ChangeLog

    r169183 r169189  
     12014-05-21  Antti Koivisto  <antti@apple.com>
     2
     3        REGRESSION(r167870): Crash in simple line layout code with :after
     4        https://bugs.webkit.org/show_bug.cgi?id=133155
     5        <rdar://problem/16977696>
     6
     7        Reviewed by Darin Adler.
     8       
     9        Fix https://bugs.webkit.org/show_bug.cgi?id=132241 in a safer way.
     10        The underline behavior is tested by the existing fast/text/simple-lines-hover-underline.html
     11
     12        Test: fast/text/simple-lines-hover-after.html
     13
     14        * rendering/RenderBlock.cpp:
     15        (WebCore::RenderBlock::invalidateLineLayoutPath): Deleted.
     16
     17            Move to RenderBlockFlow.
     18
     19        * rendering/RenderBlock.h:
     20        (WebCore::RenderBlock::invalidateLineLayoutPath):
     21        * rendering/RenderBlockFlow.cpp:
     22        (WebCore::RenderBlockFlow::styleDidChange):
     23       
     24            Invalidate layout if style changes in a manner that makes us ineligible to use the simple line layout path.
     25
     26        (WebCore::RenderBlockFlow::invalidateLineLayoutPath):
     27       
     28            Drop the simple line layout on path invalidation if it exists. It may not be valid anymore.
     29            Also invalidate the layout if this happens so we'll reconstruct the lines later.
     30
     31        (WebCore::RenderBlockFlow::simpleLineLayout): Deleted.
     32        (WebCore::RenderBlockFlow::ensureLineBoxes):
     33        (WebCore::RenderBlockFlow::createLineBoxes): Deleted.
     34               
     35            Revert some of the changes made it r167870.
     36
     37        * rendering/RenderBlockFlow.h:
     38        (WebCore::RenderBlockFlow::simpleLineLayout):
     39       
     40            Add strong validity assert.
     41
    1422014-05-21  Eric Carlson  <eric.carlson@apple.com>
    243
  • trunk/Source/WebCore/rendering/RenderBlock.cpp

    r169128 r169189  
    625625    if (AXObjectCache* cache = document().existingAXObjectCache())
    626626        cache->recomputeIsIgnored(this);
    627 }
    628 
    629 void RenderBlock::invalidateLineLayoutPath()
    630 {
    631     if (m_lineLayoutPath == ForceLineBoxesPath)
    632         return;
    633     m_lineLayoutPath = UndeterminedPath;
    634627}
    635628
  • trunk/Source/WebCore/rendering/RenderBlock.h

    r169128 r169189  
    8282    virtual void layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeight = 0);
    8383
    84     void invalidateLineLayoutPath();
     84    virtual void invalidateLineLayoutPath() { }
    8585
    8686    void insertPositionedObject(RenderBox&);
  • trunk/Source/WebCore/rendering/RenderBlockFlow.cpp

    r169128 r169189  
    19631963        fragment->setStyle(RenderNamedFlowFragment::createStyle(style()));
    19641964
    1965     if (diff >= StyleDifferenceRepaint)
    1966         invalidateLineLayoutPath();
    1967    
     1965    if (diff >= StyleDifferenceRepaint) {
     1966        // FIXME: This could use a cheaper style-only test instead of SimpleLineLayout::canUseFor.
     1967        if (selfNeedsLayout() || !m_simpleLineLayout || !SimpleLineLayout::canUseFor(*this))
     1968            invalidateLineLayoutPath();
     1969    }
     1970
    19681971    if (multiColumnFlowThread()) {
    19691972        for (auto child = firstChildBox();
     
    33913394}
    33923395
     3396void RenderBlockFlow::invalidateLineLayoutPath()
     3397{
     3398    switch (m_lineLayoutPath) {
     3399    case UndeterminedPath:
     3400    case ForceLineBoxesPath:
     3401        ASSERT(!m_simpleLineLayout);
     3402        return;
     3403    case LineBoxesPath:
     3404        ASSERT(!m_simpleLineLayout);
     3405        m_lineLayoutPath = UndeterminedPath;
     3406        return;
     3407    case SimpleLinesPath:
     3408        // The simple line layout may have become invalid.
     3409        m_simpleLineLayout = nullptr;
     3410        setNeedsLayout();
     3411        m_lineLayoutPath = UndeterminedPath;
     3412        return;
     3413    }
     3414    ASSERT_NOT_REACHED();
     3415}
     3416
    33933417void RenderBlockFlow::layoutSimpleLines(LayoutUnit& repaintLogicalTop, LayoutUnit& repaintLogicalBottom)
    33943418{
     
    34133437}
    34143438
    3415 const SimpleLineLayout::Layout* RenderBlockFlow::simpleLineLayout() const
    3416 {
    3417     if (m_lineLayoutPath == UndeterminedPath)
    3418         const_cast<RenderBlockFlow&>(*this).m_lineLayoutPath = SimpleLineLayout::canUseFor(*this) ? SimpleLinesPath : LineBoxesPath;
    3419 
    3420     if (m_lineLayoutPath == SimpleLinesPath)
    3421         return m_simpleLineLayout.get();
    3422 
    3423     const_cast<RenderBlockFlow&>(*this).createLineBoxes();
    3424     return nullptr;
    3425 }
    3426 
    34273439void RenderBlockFlow::ensureLineBoxes()
    34283440{
    34293441    m_lineLayoutPath = ForceLineBoxesPath;
    3430     createLineBoxes();
    3431 }
    3432 
    3433 void RenderBlockFlow::createLineBoxes()
    3434 {
    3435     ASSERT(m_lineLayoutPath == LineBoxesPath || m_lineLayoutPath == ForceLineBoxesPath);
    3436 
    34373442    if (!m_simpleLineLayout)
    34383443        return;
  • trunk/Source/WebCore/rendering/RenderBlockFlow.h

    r169110 r169189  
    348348
    349349    virtual bool hasLines() const override final;
     350    virtual void invalidateLineLayoutPath() override final;
    350351
    351352    // Helper methods for computing line counts and heights for line counts.
     
    525526    virtual VisiblePosition positionForPointWithInlineChildren(const LayoutPoint& pointInLogicalContents, const RenderRegion*) override;
    526527    virtual void addFocusRingRectsForInlineChildren(Vector<IntRect>& rects, const LayoutPoint& additionalOffset, const RenderLayerModelObject*) override;
    527 
    528     void createLineBoxes();
    529528
    530529// FIXME-BLOCKFLOW: These methods have implementations in
     
    630629}
    631630
     631inline const SimpleLineLayout::Layout* RenderBlockFlow::simpleLineLayout() const
     632{
     633    ASSERT(m_lineLayoutPath == SimpleLinesPath || !m_simpleLineLayout);
     634    return m_simpleLineLayout.get();
     635}
     636
    632637} // namespace WebCore
    633638
Note: See TracChangeset for help on using the changeset viewer.