Changeset 259455 in webkit

Timestamp:

Apr 3, 2020 6:56:32 AM (4 years ago)

Author:

Alan Bujtas

Message:

[MultiColumn] Infinite loop in RenderBlockFlow::pushToNextPageWithMinimumLogicalHeight
​https://bugs.webkit.org/show_bug.cgi?id=209948
<rdar://problem/59331899>

Reviewed by Antti Koivisto.

Source/WebCore:

pushToNextPageWithMinimumLogicalHeight is supposed to find the next page/column with enough space for the content.
However we keep finding the same column because it is not balanced properly yet (while in layout, they have the initial height of LayoutUnit::max).

Test: fast/multicol/infinite-loop-with-unbalanced-column.html

• rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::pushToNextPageWithMinimumLogicalHeight const):

LayoutTests:

• fast/multicol/infinite-loop-with-unbalanced-column-expected.txt: Added.
• fast/multicol/infinite-loop-with-unbalanced-column.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/multicol/infinite-loop-with-unbalanced-column-expected.txt (added)
• LayoutTests/fast/multicol/infinite-loop-with-unbalanced-column.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockFlow.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-04-03  Zalan Bujtas  <zalan@apple.com>
+
+        [MultiColumn] Infinite loop in RenderBlockFlow::pushToNextPageWithMinimumLogicalHeight
+        https://bugs.webkit.org/show_bug.cgi?id=209948
+        <rdar://problem/59331899>
+
+        Reviewed by Antti Koivisto.
+
+        * fast/multicol/infinite-loop-with-unbalanced-column-expected.txt: Added.
+        * fast/multicol/infinite-loop-with-unbalanced-column.html: Added.
+
 2020-04-03  youenn fablet  <youenn@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-04-03  Zalan Bujtas  <zalan@apple.com>
+
+        [MultiColumn] Infinite loop in RenderBlockFlow::pushToNextPageWithMinimumLogicalHeight
+        https://bugs.webkit.org/show_bug.cgi?id=209948
+        <rdar://problem/59331899>
+
+        Reviewed by Antti Koivisto.
+
+        pushToNextPageWithMinimumLogicalHeight is supposed to find the next page/column with enough space for the content.
+        However we keep finding the same column because it is not balanced properly yet (while in layout, they have the initial height of LayoutUnit::max).    
+
+        Test: fast/multicol/infinite-loop-with-unbalanced-column.html
+
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::pushToNextPageWithMinimumLogicalHeight const):
+
 2020-04-03  youenn fablet  <youenn@apple.com>
 

trunk/Source/WebCore/rendering/RenderBlockFlow.cpp

@@ -1940 +1940 @@
 {
     bool checkFragment = false;
-    for (LayoutUnit pageLogicalHeight = pageLogicalHeightForOffset(logicalOffset + adjustment); pageLogicalHeight;
-        pageLogicalHeight = pageLogicalHeightForOffset(logicalOffset + adjustment)) {
+    auto* fragmentedFlow = enclosingFragmentedFlow();
+    RenderFragmentContainer* currentFragmentContainer = nullptr;
+    for (auto pageLogicalHeight = pageLogicalHeightForOffset(logicalOffset + adjustment); pageLogicalHeight; pageLogicalHeight = pageLogicalHeightForOffset(logicalOffset + adjustment)) {
         if (minimumLogicalHeight <= pageLogicalHeight)
             return true;
-        if (!hasNextPage(logicalOffset + adjustment))
+        auto adjustedOffset = logicalOffset + adjustment;
+        if (!hasNextPage(adjustedOffset))
             return false;
+        if (fragmentedFlow) {
+            // While in layout and the columnsets are not balanced yet, we keep finding the same (infinite tall) column over and over again.
+            auto* nextFragmentContainer = fragmentedFlow->fragmentAtBlockOffset(this, adjustedOffset, true);
+            ASSERT(nextFragmentContainer);
+            if (nextFragmentContainer == currentFragmentContainer)
+                return false;
+            currentFragmentContainer = nextFragmentContainer;
+        }
         adjustment += pageLogicalHeight;
         checkFragment = true;