Title: [257046] trunk
- Revision
- 257046
- Author
- commit-qu...@webkit.org
- Date
- 2020-02-19 22:41:20 -0800 (Wed, 19 Feb 2020)
Log Message
ASSERTION FAILED: roundedIntPoint(LayoutPoint(rendererMappedResult)) == result in WebCore::RenderGeometryMap::mapToContainer
https://bugs.webkit.org/show_bug.cgi?id=151030
<rdar://problem/27711142>
Patch by Jack Lee <shihchieh_...@apple.com> on 2020-02-19
Reviewed by Darin Adler.
Track if m_accumulatedOffset ever becomes saturated, and if so, do not assert on unexpected rendererMappedResult.
Source/WebCore:
Test: fast/layers/geometry-map-saturated-offset-assert.html
* platform/graphics/LayoutSize.h:
(WebCore::LayoutSize::mightBeSaturated const):
* rendering/RenderGeometryMap.cpp:
(WebCore::RenderGeometryMap::mapToContainer const):
(WebCore::RenderGeometryMap::stepInserted):
(WebCore::RenderGeometryMap::stepRemoved):
* rendering/RenderGeometryMap.h:
LayoutTests:
* fast/layers/geometry-map-saturated-offset-assert-expected.txt: Added.
* fast/layers/geometry-map-saturated-offset-assert.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (257045 => 257046)
--- trunk/LayoutTests/ChangeLog 2020-02-20 06:25:44 UTC (rev 257045)
+++ trunk/LayoutTests/ChangeLog 2020-02-20 06:41:20 UTC (rev 257046)
@@ -1,3 +1,16 @@
+2020-02-19 Jack Lee <shihchieh_...@apple.com>
+
+ ASSERTION FAILED: roundedIntPoint(LayoutPoint(rendererMappedResult)) == result in WebCore::RenderGeometryMap::mapToContainer
+ https://bugs.webkit.org/show_bug.cgi?id=151030
+ <rdar://problem/27711142>
+
+ Reviewed by Darin Adler.
+
+ Track if m_accumulatedOffset ever becomes saturated, and if so, do not assert on unexpected rendererMappedResult.
+
+ * fast/layers/geometry-map-saturated-offset-assert-expected.txt: Added.
+ * fast/layers/geometry-map-saturated-offset-assert.html: Added.
+
2020-02-19 Youenn Fablet <you...@apple.com>
Add support for AudioSession handling in GPUProcess for capture
Added: trunk/LayoutTests/fast/layers/geometry-map-saturated-offset-assert-expected.txt (0 => 257046)
--- trunk/LayoutTests/fast/layers/geometry-map-saturated-offset-assert-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/layers/geometry-map-saturated-offset-assert-expected.txt 2020-02-20 06:41:20 UTC (rev 257046)
@@ -0,0 +1 @@
+Tests geometry map with saturated offset. The test passes if WebKit doesn't crash or hit an assertion.
Added: trunk/LayoutTests/fast/layers/geometry-map-saturated-offset-assert.html (0 => 257046)
--- trunk/LayoutTests/fast/layers/geometry-map-saturated-offset-assert.html (rev 0)
+++ trunk/LayoutTests/fast/layers/geometry-map-saturated-offset-assert.html 2020-02-20 06:41:20 UTC (rev 257046)
@@ -0,0 +1,13 @@
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
+<style>
+ input, big {
+ -webkit-appearance:button;
+ vertical-align:-53772756.9in;
+ overflow-y:hidden;
+ -webkit-padding-before:+.8mm;
+ }
+</style>
+<li></li><input></input><big></big><span>Tests geometry map with saturated offset. The test passes if WebKit doesn't crash or hit an assertion.</span>
Modified: trunk/Source/WebCore/ChangeLog (257045 => 257046)
--- trunk/Source/WebCore/ChangeLog 2020-02-20 06:25:44 UTC (rev 257045)
+++ trunk/Source/WebCore/ChangeLog 2020-02-20 06:41:20 UTC (rev 257046)
@@ -1,3 +1,23 @@
+2020-02-19 Jack Lee <shihchieh_...@apple.com>
+
+ ASSERTION FAILED: roundedIntPoint(LayoutPoint(rendererMappedResult)) == result in WebCore::RenderGeometryMap::mapToContainer
+ https://bugs.webkit.org/show_bug.cgi?id=151030
+ <rdar://problem/27711142>
+
+ Reviewed by Darin Adler.
+
+ Track if m_accumulatedOffset ever becomes saturated, and if so, do not assert on unexpected rendererMappedResult.
+
+ Test: fast/layers/geometry-map-saturated-offset-assert.html
+
+ * platform/graphics/LayoutSize.h:
+ (WebCore::LayoutSize::mightBeSaturated const):
+ * rendering/RenderGeometryMap.cpp:
+ (WebCore::RenderGeometryMap::mapToContainer const):
+ (WebCore::RenderGeometryMap::stepInserted):
+ (WebCore::RenderGeometryMap::stepRemoved):
+ * rendering/RenderGeometryMap.h:
+
2020-02-19 Youenn Fablet <you...@apple.com>
Add support for AudioSession handling in GPUProcess for capture
Modified: trunk/Source/WebCore/platform/graphics/LayoutSize.h (257045 => 257046)
--- trunk/Source/WebCore/platform/graphics/LayoutSize.h 2020-02-20 06:25:44 UTC (rev 257045)
+++ trunk/Source/WebCore/platform/graphics/LayoutSize.h 2020-02-20 06:41:20 UTC (rev 257046)
@@ -136,6 +136,11 @@
return LayoutSize(width(), width() * aspectRatio.height() / aspectRatio.width());
}
+ bool mightBeSaturated() const
+ {
+ return m_width.mightBeSaturated() || m_height.mightBeSaturated();
+ }
+
private:
LayoutUnit m_width;
LayoutUnit m_height;
Modified: trunk/Source/WebCore/rendering/RenderGeometryMap.cpp (257045 => 257046)
--- trunk/Source/WebCore/rendering/RenderGeometryMap.cpp 2020-02-20 06:25:44 UTC (rev 257045)
+++ trunk/Source/WebCore/rendering/RenderGeometryMap.cpp 2020-02-20 06:41:20 UTC (rev 257046)
@@ -109,7 +109,7 @@
if (!hasFixedPositionStep() && !hasTransformStep() && !hasNonUniformStep() && (!container || (m_mapping.size() && container == m_mapping[0].m_renderer))) {
result = p + roundedIntSize(m_accumulatedOffset);
// Should convert to a LayoutPoint because of the uniqueness of LayoutUnit::round
- ASSERT(roundedIntPoint(LayoutPoint(rendererMappedResult)) == result);
+ ASSERT(m_accumulatedOffsetMightBeSaturated || roundedIntPoint(LayoutPoint(rendererMappedResult)) == result);
} else {
TransformState transformState(TransformState::ApplyTransformDirection, p);
mapToContainer(transformState, container);
@@ -265,8 +265,12 @@
void RenderGeometryMap::stepInserted(const RenderGeometryMapStep& step)
{
// RenderView's offset, is only applied when we have fixed-positions.
- if (!step.m_renderer->isRenderView())
+ if (!step.m_renderer->isRenderView()) {
m_accumulatedOffset += step.m_offset;
+#if ASSERT_ENABLED
+ m_accumulatedOffsetMightBeSaturated |= m_accumulatedOffset.mightBeSaturated();
+#endif
+ }
if (step.m_isNonUniform)
++m_nonUniformStepsCount;
@@ -281,8 +285,12 @@
void RenderGeometryMap::stepRemoved(const RenderGeometryMapStep& step)
{
// RenderView's offset, is only applied when we have fixed-positions.
- if (!step.m_renderer->isRenderView())
+ if (!step.m_renderer->isRenderView()) {
m_accumulatedOffset -= step.m_offset;
+#if ASSERT_ENABLED
+ m_accumulatedOffsetMightBeSaturated |= m_accumulatedOffset.mightBeSaturated();
+#endif
+ }
if (step.m_isNonUniform) {
ASSERT(m_nonUniformStepsCount);
Modified: trunk/Source/WebCore/rendering/RenderGeometryMap.h (257045 => 257046)
--- trunk/Source/WebCore/rendering/RenderGeometryMap.h 2020-02-20 06:25:44 UTC (rev 257045)
+++ trunk/Source/WebCore/rendering/RenderGeometryMap.h 2020-02-20 06:41:20 UTC (rev 257046)
@@ -130,6 +130,9 @@
RenderGeometryMapSteps m_mapping;
LayoutSize m_accumulatedOffset;
MapCoordinatesFlags m_mapCoordinatesFlags;
+#if ASSERT_ENABLED
+ bool m_accumulatedOffsetMightBeSaturated { false };
+#endif
};
} // namespace WebCore
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
