Title: [210534] trunk
- Revision
- 210534
- Author
- za...@apple.com
- Date
- 2017-01-09 18:17:19 -0800 (Mon, 09 Jan 2017)
Log Message
ASSERTION FAILED: newLogicalTop >= logicalTop in WebCore::RenderBlockFlow::getClearDelta
https://bugs.webkit.org/show_bug.cgi?id=151202
<rdar://problem/27711822>
Reviewed by Myles C. Maxfield.
Source/WebCore:
FindNextFloatLogicalBottomAdapter uses LayoutUnit::max() to flag m_nextLogicalBottom uninitialized.
However LayoutUnit::max() can also be a valid value for m_nextLogicalBottom.
FindNextFloatLogicalBottomAdapter::nextLogicalBottom() returns 0 instead of the actual value when
it sees m_nextLogicalBottom uninitialized. In certain cases, it confuses the caller and we end up
with a runaway loop.
Test: fast/block/float/assert-when-line-has-not-enough-space-left.html
* rendering/FloatingObjects.cpp:
(WebCore::FindNextFloatLogicalBottomAdapter::FindNextFloatLogicalBottomAdapter):
(WebCore::FindNextFloatLogicalBottomAdapter::highValue):
(WebCore::FindNextFloatLogicalBottomAdapter::nextLogicalBottom):
(WebCore::FindNextFloatLogicalBottomAdapter::nextShapeLogicalBottom):
(WebCore::FindNextFloatLogicalBottomAdapter::collectIfNeeded):
LayoutTests:
* fast/block/float/assert-when-line-has-not-enough-space-left-expected.txt: Added.
* fast/block/float/assert-when-line-has-not-enough-space-left.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (210533 => 210534)
--- trunk/LayoutTests/ChangeLog 2017-01-10 01:28:53 UTC (rev 210533)
+++ trunk/LayoutTests/ChangeLog 2017-01-10 02:17:19 UTC (rev 210534)
@@ -1,3 +1,14 @@
+2017-01-09 Zalan Bujtas <za...@apple.com>
+
+ ASSERTION FAILED: newLogicalTop >= logicalTop in WebCore::RenderBlockFlow::getClearDelta
+ https://bugs.webkit.org/show_bug.cgi?id=151202
+ <rdar://problem/27711822>
+
+ Reviewed by Myles C. Maxfield.
+
+ * fast/block/float/assert-when-line-has-not-enough-space-left-expected.txt: Added.
+ * fast/block/float/assert-when-line-has-not-enough-space-left.html: Added.
+
2017-01-09 Tim Horton <timothy_hor...@apple.com>
Unindenting text inside a blockquote can result in the text being reordered
Added: trunk/LayoutTests/fast/block/float/assert-when-line-has-not-enough-space-left-expected.txt (0 => 210534)
--- trunk/LayoutTests/fast/block/float/assert-when-line-has-not-enough-space-left-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/block/float/assert-when-line-has-not-enough-space-left-expected.txt 2017-01-10 02:17:19 UTC (rev 210534)
@@ -0,0 +1,2 @@
+PASS if no crash or hang.
+
Added: trunk/LayoutTests/fast/block/float/assert-when-line-has-not-enough-space-left.html (0 => 210534)
--- trunk/LayoutTests/fast/block/float/assert-when-line-has-not-enough-space-left.html (rev 0)
+++ trunk/LayoutTests/fast/block/float/assert-when-line-has-not-enough-space-left.html 2017-01-10 02:17:19 UTC (rev 210534)
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>This tests that we can handle float placement even when the float takes over the entire line.</title>
+<style>
+th {
+ margin: 100000000px;
+}
+tr, th {
+ float: left;
+}
+</style>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+</head>
+<body>
+PASS if no crash or hang.
+<table><tr><th></th><td></td></tr></table>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (210533 => 210534)
--- trunk/Source/WebCore/ChangeLog 2017-01-10 01:28:53 UTC (rev 210533)
+++ trunk/Source/WebCore/ChangeLog 2017-01-10 02:17:19 UTC (rev 210534)
@@ -1,3 +1,26 @@
+2017-01-09 Zalan Bujtas <za...@apple.com>
+
+ ASSERTION FAILED: newLogicalTop >= logicalTop in WebCore::RenderBlockFlow::getClearDelta
+ https://bugs.webkit.org/show_bug.cgi?id=151202
+ <rdar://problem/27711822>
+
+ Reviewed by Myles C. Maxfield.
+
+ FindNextFloatLogicalBottomAdapter uses LayoutUnit::max() to flag m_nextLogicalBottom uninitialized.
+ However LayoutUnit::max() can also be a valid value for m_nextLogicalBottom.
+ FindNextFloatLogicalBottomAdapter::nextLogicalBottom() returns 0 instead of the actual value when
+ it sees m_nextLogicalBottom uninitialized. In certain cases, it confuses the caller and we end up
+ with a runaway loop.
+
+ Test: fast/block/float/assert-when-line-has-not-enough-space-left.html
+
+ * rendering/FloatingObjects.cpp:
+ (WebCore::FindNextFloatLogicalBottomAdapter::FindNextFloatLogicalBottomAdapter):
+ (WebCore::FindNextFloatLogicalBottomAdapter::highValue):
+ (WebCore::FindNextFloatLogicalBottomAdapter::nextLogicalBottom):
+ (WebCore::FindNextFloatLogicalBottomAdapter::nextShapeLogicalBottom):
+ (WebCore::FindNextFloatLogicalBottomAdapter::collectIfNeeded):
+
2017-01-09 Ryan Haddad <ryanhad...@apple.com>
Unreviewed, rolling out r210531.
Modified: trunk/Source/WebCore/rendering/FloatingObjects.cpp (210533 => 210534)
--- trunk/Source/WebCore/rendering/FloatingObjects.cpp 2017-01-10 01:28:53 UTC (rev 210533)
+++ trunk/Source/WebCore/rendering/FloatingObjects.cpp 2017-01-10 02:17:19 UTC (rev 210534)
@@ -185,39 +185,35 @@
FindNextFloatLogicalBottomAdapter(const RenderBlockFlow& renderer, LayoutUnit belowLogicalHeight)
: m_renderer(renderer)
, m_belowLogicalHeight(belowLogicalHeight)
- , m_aboveLogicalHeight(LayoutUnit::max())
- , m_nextLogicalBottom(LayoutUnit::max())
- , m_nextShapeLogicalBottom(LayoutUnit::max())
{
}
LayoutUnit lowValue() const { return m_belowLogicalHeight; }
- LayoutUnit highValue() const { return m_aboveLogicalHeight; }
+ LayoutUnit highValue() const { return LayoutUnit::max(); }
void collectIfNeeded(const IntervalType&);
- LayoutUnit nextLogicalBottom() { return m_nextLogicalBottom == LayoutUnit::max() ? LayoutUnit() : m_nextLogicalBottom; }
- LayoutUnit nextShapeLogicalBottom() { return m_nextShapeLogicalBottom == LayoutUnit::max() ? nextLogicalBottom() : m_nextShapeLogicalBottom; }
+ LayoutUnit nextLogicalBottom() const { return m_nextLogicalBottom.value_or(0); }
+ LayoutUnit nextShapeLogicalBottom() const { return m_nextShapeLogicalBottom.value_or(nextLogicalBottom()); }
private:
const RenderBlockFlow& m_renderer;
LayoutUnit m_belowLogicalHeight;
- LayoutUnit m_aboveLogicalHeight;
- LayoutUnit m_nextLogicalBottom;
- LayoutUnit m_nextShapeLogicalBottom;
+ std::optional<LayoutUnit> m_nextLogicalBottom;
+ std::optional<LayoutUnit> m_nextShapeLogicalBottom;
};
inline void FindNextFloatLogicalBottomAdapter::collectIfNeeded(const IntervalType& interval)
{
const auto& floatingObject = *interval.data();
- if (!rangesIntersect(interval.low(), interval.high(), m_belowLogicalHeight, m_aboveLogicalHeight))
+ if (!rangesIntersect(interval.low(), interval.high(), m_belowLogicalHeight, LayoutUnit::max()))
return;
// All the objects returned from the tree should be already placed.
ASSERT(floatingObject.isPlaced());
- ASSERT(rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_belowLogicalHeight, m_aboveLogicalHeight));
+ ASSERT(rangesIntersect(m_renderer.logicalTopForFloat(floatingObject), m_renderer.logicalBottomForFloat(floatingObject), m_belowLogicalHeight, LayoutUnit::max()));
LayoutUnit floatBottom = m_renderer.logicalBottomForFloat(floatingObject);
- if (m_nextLogicalBottom < floatBottom)
+ if (m_nextLogicalBottom && m_nextLogicalBottom.value() < floatBottom)
return;
if (ShapeOutsideInfo* shapeOutside = floatingObject.renderer().shapeOutsideInfo()) {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
