Changeset 269728 in webkit

Timestamp:

Nov 12, 2020 3:25:22 AM (3 years ago)

Author:

svillar@igalia.com

Message:

Crash in RenderBox::overrideContainingBlockContentHeight()
​https://bugs.webkit.org/show_bug.cgi?id=218504
<rdar://problem/70989103>

Reviewed by Zalan Bujtas.

Source/WebCore:

It should check the overriding widths map for vertical writing modes because it deals with logical sizes. Instead it was always checking the
overriding heights map and thus giving incorrect results.

Test: fast/flexbox/flex-column-vertical-rl-dynamic-child-crash.html

• rendering/RenderBox.cpp:

(WebCore::RenderBox::hasOverridingContainingBlockContentHeight const): Check gOverridingContainingBlockContentLogicalWidthMap
for vertical writing modes.

LayoutTests:

• fast/flexbox/flex-column-vertical-rl-dynamic-child-crash-expected.txt: Added.
• fast/flexbox/flex-column-vertical-rl-dynamic-child-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/flexbox/flex-column-vertical-rl-dynamic-child-crash-expected.txt (added)
• LayoutTests/fast/flexbox/flex-column-vertical-rl-dynamic-child-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBox.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-11-12  Sergio Villar Senin  <svillar@igalia.com>
+
+        Crash in RenderBox::overrideContainingBlockContentHeight()
+        https://bugs.webkit.org/show_bug.cgi?id=218504
+        <rdar://problem/70989103>
+
+        Reviewed by Zalan Bujtas.
+
+        * fast/flexbox/flex-column-vertical-rl-dynamic-child-crash-expected.txt: Added.
+        * fast/flexbox/flex-column-vertical-rl-dynamic-child-crash.html: Added.
+
 2020-11-12  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-11-12  Sergio Villar Senin  <svillar@igalia.com>
+
+        Crash in RenderBox::overrideContainingBlockContentHeight()
+        https://bugs.webkit.org/show_bug.cgi?id=218504
+        <rdar://problem/70989103>
+
+        Reviewed by Zalan Bujtas.
+
+        It should check the overriding widths map for vertical writing modes because it deals with logical sizes. Instead it was always checking the
+        overriding heights map and thus giving incorrect results.
+
+        Test: fast/flexbox/flex-column-vertical-rl-dynamic-child-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::hasOverridingContainingBlockContentHeight const): Check gOverridingContainingBlockContentLogicalWidthMap
+        for vertical writing modes.
+
 2020-11-12  Zalan Bujtas  <zalan@apple.com>
 

trunk/Source/WebCore/rendering/RenderBox.cpp

@@ -1179 +1179 @@
     return cb->style().isHorizontalWritingMode()
         ? gOverridingContainingBlockContentLogicalHeightMap && gOverridingContainingBlockContentLogicalHeightMap->contains(this)
-        : gOverridingContainingBlockContentLogicalHeightMap && gOverridingContainingBlockContentLogicalHeightMap->contains(this);
+        : gOverridingContainingBlockContentLogicalWidthMap && gOverridingContainingBlockContentLogicalWidthMap->contains(this);
 }