Changeset 209158 in webkit

Timestamp:

Nov 30, 2016 3:12:45 PM (7 years ago)

Author:

Alan Bujtas

Message:

ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage
​https://bugs.webkit.org/show_bug.cgi?id=155364
<rdar://problem/27720461>

Reviewed by David Hyatt.

Source/WebCore:

RenderNamedFlowThread is considered to be a root for the current renderer context so
we need to bail out from the containing block traversal here (like we do for the RenderView).

Test: fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html

• rendering/RenderBox.cpp:

(WebCore::RenderBox::computeReplacedLogicalHeightUsing):

LayoutTests:

• fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts-expected.txt: Added.
• fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts-expected.txt (added)
• LayoutTests/fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBox.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-11-30  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage
+        https://bugs.webkit.org/show_bug.cgi?id=155364
+        <rdar://problem/27720461>
+
+        Reviewed by David Hyatt.
+
+        * fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts-expected.txt: Added.
+        * fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html: Added.
+
 2016-11-30  Jiewen Tan  <jiewen_tan@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-11-30  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage
+        https://bugs.webkit.org/show_bug.cgi?id=155364
+        <rdar://problem/27720461>
+
+        Reviewed by David Hyatt.
+
+        RenderNamedFlowThread is considered to be a root for the current renderer context so
+        we need to bail out from the containing block traversal here (like we do for the RenderView). 
+
+        Test: fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+
 2016-11-30  Brady Eidson  <beidson@apple.com>
 

trunk/Source/WebCore/rendering/RenderBox.cpp

@@ -3142 +3142 @@
         case Calculated:
         {
-            auto cb = isOutOfFlowPositioned() ? container() : containingBlock();
-            while (cb && cb->isAnonymous() && !is<RenderView>(*cb)) {
-                cb = cb->containingBlock();
-                downcast<RenderBlock>(*cb).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
+            auto* container = isOutOfFlowPositioned() ? this->container() : containingBlock();
+            while (container && container->isAnonymous()) {
+                // Stop at rendering context root.
+                if (is<RenderView>(*container) || is<RenderNamedFlowThread>(*container))
+                    break;
+                container = container->containingBlock();
+                downcast<RenderBlock>(*container).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
             }
 
             // FIXME: This calculation is not patched for block-flow yet.
             // https://bugs.webkit.org/show_bug.cgi?id=46500
-            if (cb->isOutOfFlowPositioned() && cb->style().height().isAuto() && !(cb->style().top().isAuto() || cb->style().bottom().isAuto())) {
-                ASSERT_WITH_SECURITY_IMPLICATION(cb->isRenderBlock());
-                RenderBlock& block = downcast<RenderBlock>(*cb);
+            if (container->isOutOfFlowPositioned()
+                && container->style().height().isAuto()
+                && !(container->style().top().isAuto() || container->style().bottom().isAuto())) {
+                ASSERT_WITH_SECURITY_IMPLICATION(container->isRenderBlock());
+                auto& block = downcast<RenderBlock>(*container);
                 LogicalExtentComputedValues computedValues;
                 block.computeLogicalHeight(block.logicalHeight(), 0, computedValues);
@@ -3165 +3170 @@
             LayoutUnit availableHeight;
             if (isOutOfFlowPositioned())
-                availableHeight = containingBlockLogicalHeightForPositioned(downcast<RenderBoxModelObject>(*cb));
+                availableHeight = containingBlockLogicalHeightForPositioned(downcast<RenderBoxModelObject>(*container));
             else {
                 availableHeight = containingBlockLogicalHeightForContent(IncludeMarginBorderPadding);
@@ -3173 +3178 @@
                 // FIXME: This needs to be made block-flow-aware.  If the cell and image are perpendicular block-flows, this isn't right.
                 // https://bugs.webkit.org/show_bug.cgi?id=46997
-                while (cb && !is<RenderView>(*cb) && (cb->style().logicalHeight().isAuto() || cb->style().logicalHeight().isPercentOrCalculated())) {
-                    if (cb->isTableCell()) {
+                while (container && !is<RenderView>(*container)
+                    && (container->style().logicalHeight().isAuto() || container->style().logicalHeight().isPercentOrCalculated())) {
+                    if (container->isTableCell()) {
                         // Don't let table cells squeeze percent-height replaced elements
                         // <http://bugs.webkit.org/show_bug.cgi?id=15359>
@@ -3180 +3186 @@
                         return valueForLength(logicalHeight, availableHeight - borderAndPaddingLogicalHeight());
                     }
-                    downcast<RenderBlock>(*cb).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
-                    cb = cb->containingBlock();
+                    downcast<RenderBlock>(*container).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
+                    container = container->containingBlock();
                 }
             }