Changeset 84096 in webkit

Timestamp:

Apr 16, 2011 2:59:36 PM (13 years ago)

Author:

mitz@apple.com

Message:

<rdar://problem/9190108> Crash when hiding a float

Reviewed by Simon Fraser.

Source/WebCore:

Test: fast/block/float/overhanging-tall-block.html

• rendering/RenderBlock.cpp:

(WebCore::RenderBlock::addOverhangingFloats): Moved the call to childLogicalTop() out of the loop.
Capped the logical bottom so that we get the correct maximum.

• rendering/RenderBlock.h: Decleared appendFloatingObjectToLastLine().
• rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlock::appendFloatingObjectToLastLine): Added. Ensures correct bookkeeping by
extending the float if needed so that it touches the line.
(WebCore::RenderBlock::layoutInlineChildren): Changed to call appendFloatingObjectToLastLine().
(WebCore::RenderBlock::checkFloatsInCleanLine): Capped the float height so the we mark the right
range of lines as dirty.

• rendering/RootInlineBox.h:

(WebCore::RootInlineBox::appendFloat): Replaced the floats() accessor with this function, which
allows the creation of the vector to be combined with appending the first float.

LayoutTests:

• fast/block/float/overhanging-tall-block.html: Added.
• platform/mac/fast/block/float/overhanging-tall-block-expected.checksum: Added.
• platform/mac/fast/block/float/overhanging-tall-block-expected.png: Added.
• platform/mac/fast/block/float/overhanging-tall-block-expected.txt: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/block/float/overhanging-tall-block.html (added)
• LayoutTests/platform/mac/fast/block/float/overhanging-tall-block-expected.checksum (added)
• LayoutTests/platform/mac/fast/block/float/overhanging-tall-block-expected.png (added)
• LayoutTests/platform/mac/fast/block/float/overhanging-tall-block-expected.txt (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/rendering/RenderBlock.cpp (modified) (2 diffs)
• Source/WebCore/rendering/RenderBlock.h (modified) (1 diff)
• Source/WebCore/rendering/RenderBlockLineLayout.cpp (modified) (4 diffs)
• Source/WebCore/rendering/RootInlineBox.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-04-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/9190108> Crash when hiding a float
+
+        * fast/block/float/overhanging-tall-block.html: Added.
+        * platform/mac/fast/block/float/overhanging-tall-block-expected.checksum: Added.
+        * platform/mac/fast/block/float/overhanging-tall-block-expected.png: Added.
+        * platform/mac/fast/block/float/overhanging-tall-block-expected.txt: Added.
+
 2011-04-16  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-04-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/9190108> Crash when hiding a float
+
+        Test: fast/block/float/overhanging-tall-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverhangingFloats): Moved the call to childLogicalTop() out of the loop.
+        Capped the logical bottom so that we get the correct maximum.
+        * rendering/RenderBlock.h: Decleared appendFloatingObjectToLastLine().
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::appendFloatingObjectToLastLine): Added. Ensures correct bookkeeping by
+        extending the float if needed so that it touches the line.
+        (WebCore::RenderBlock::layoutInlineChildren): Changed to call appendFloatingObjectToLastLine().
+        (WebCore::RenderBlock::checkFloatsInCleanLine): Capped the float height so the we mark the right
+        range of lines as dirty.
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::appendFloat): Replaced the floats() accessor with this function, which
+        allows the creation of the vector to be combined with appending the first float.
+
 2011-04-16  Sam Weinig  <sam@webkit.org>
 

trunk/Source/WebCore/rendering/RenderBlock.cpp

@@ -3651 +3651 @@
         return 0;
 
+    int childLogicalTop = child->logicalTop();
     int lowestFloatLogicalBottom = 0;
 
@@ -3658 +3659 @@
     for (FloatingObjectSetIterator childIt = child->m_floatingObjects->set().begin(); childIt != childEnd; ++childIt) {
         FloatingObject* r = *childIt;
-        int logicalBottom = child->logicalTop() + logicalBottomForFloat(r);
+        int logicalBottomForFloat = min(this->logicalBottomForFloat(r), numeric_limits<int>::max() - childLogicalTop);
+        int logicalBottom = childLogicalTop + logicalBottomForFloat;
         lowestFloatLogicalBottom = max(lowestFloatLogicalBottom, logicalBottom);
 

trunk/Source/WebCore/rendering/RenderBlock.h

@@ -512 +512 @@
     // have to move to the next page/column.
     bool positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, LineWidth&);
+    void appendFloatingObjectToLastLine(FloatingObject*);
 
     // End of functions defined in RenderBlockLineLayout.cpp.

trunk/Source/WebCore/rendering/RenderBlockLineLayout.cpp

@@ -713 +713 @@
     }
     return trailingSpaceRun;
+}
+
+void RenderBlock::appendFloatingObjectToLastLine(FloatingObject* floatingObject)
+{
+    // Ensure that the float touches the line.
+    if (logicalBottomForFloat(floatingObject) < lastRootBox()->blockLogicalHeight())
+        setLogicalHeightForFloat(floatingObject, lastRootBox()->blockLogicalHeight() - logicalTopForFloat(floatingObject));
+
+    lastRootBox()->appendFloat(floatingObject->renderer());
 }
 
@@ -999 +1008 @@
                 for (; it != end; ++it) {
                     FloatingObject* f = *it;
-                    lastRootBox()->floats().append(f->m_renderer);
+                    appendFloatingObjectToLastLine(f);
                     ASSERT(f->m_renderer == floats[floatIndex].object);
                     // If a float's geometry has changed, give up on syncing with clean lines.
@@ -1081 +1090 @@
             }
             for (; it != end; ++it)
-                lastRootBox()->floats().append((*it)->m_renderer);
+                appendFloatingObjectToLastLine(*it);
             lastFloat = !floatingObjectSet.isEmpty() ? floatingObjectSet.last() : 0;
         }
@@ -1139 +1148 @@
             int floatHeight = isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height()) 
                                                                  : max(floats[floatIndex].rect.width(), newSize.width());
+            floatHeight = min(floatHeight, numeric_limits<int>::max() - floatTop);
             line->markDirty();
             markLinesDirtyInBlockRange(line->blockLogicalHeight(), floatTop + floatHeight, line);

trunk/Source/WebCore/rendering/RootInlineBox.h

@@ -112 +112 @@
     InlineBox* closestLeafChildForLogicalLeftPosition(int, bool onlyEditableLeaves = false);
 
-    Vector<RenderBox*>& floats()
+    void appendFloat(RenderBox* floatingBox)
     {
         ASSERT(!isDirty());
-        if (!m_floats)
-            m_floats= adoptPtr(new Vector<RenderBox*>);
-        return *m_floats;
+        if (m_floats)
+            m_floats->append(floatingBox);
+        else
+            m_floats= adoptPtr(new Vector<RenderBox*>(1, floatingBox));
     }