Title: [274456] trunk
- Revision
- 274456
- Author
- za...@apple.com
- Date
- 2021-03-15 17:52:06 -0700 (Mon, 15 Mar 2021)
Log Message
[Multi-column] Ignore line grid offset when the grid line is shorter than 0.5px
https://bugs.webkit.org/show_bug.cgi?id=223220
<rdar://73192773>
Reviewed by Simon Fraser.
Source/WebCore:
This is a simple check on roundToInt(line box height) to make sure we don't divide by zero.
Test: fast/multicol/crash-when-line-grid-is-shorter-than-half-px.html
* rendering/RenderLayoutState.cpp:
(WebCore::RenderLayoutState::computeLineGridPaginationOrigin):
* rendering/RootInlineBox.h:
(WebCore::RootInlineBox::lineBoxHeight const):
LayoutTests:
* fast/multicol/crash-when-line-grid-is-shorter-than-half-px-expected.txt: Added.
* fast/multicol/crash-when-line-grid-is-shorter-than-half-px.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (274455 => 274456)
--- trunk/LayoutTests/ChangeLog 2021-03-16 00:37:11 UTC (rev 274455)
+++ trunk/LayoutTests/ChangeLog 2021-03-16 00:52:06 UTC (rev 274456)
@@ -1,3 +1,14 @@
+2021-03-15 Zalan Bujtas <za...@apple.com>
+
+ [Multi-column] Ignore line grid offset when the grid line is shorter than 0.5px
+ https://bugs.webkit.org/show_bug.cgi?id=223220
+ <rdar://73192773>
+
+ Reviewed by Simon Fraser.
+
+ * fast/multicol/crash-when-line-grid-is-shorter-than-half-px-expected.txt: Added.
+ * fast/multicol/crash-when-line-grid-is-shorter-than-half-px.html: Added.
+
2021-03-15 Robert Jenner <jen...@apple.com>
[ macOS Debug ARM64 ] 2X w3c/svg tests are constantly text failing
Added: trunk/LayoutTests/fast/multicol/crash-when-line-grid-is-shorter-than-half-px-expected.txt (0 => 274456)
--- trunk/LayoutTests/fast/multicol/crash-when-line-grid-is-shorter-than-half-px-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/multicol/crash-when-line-grid-is-shorter-than-half-px-expected.txt 2021-03-16 00:52:06 UTC (rev 274456)
@@ -0,0 +1 @@
+PASS if no crash or assert.
Added: trunk/LayoutTests/fast/multicol/crash-when-line-grid-is-shorter-than-half-px.html (0 => 274456)
--- trunk/LayoutTests/fast/multicol/crash-when-line-grid-is-shorter-than-half-px.html (rev 0)
+++ trunk/LayoutTests/fast/multicol/crash-when-line-grid-is-shorter-than-half-px.html 2021-03-16 00:52:06 UTC (rev 274456)
@@ -0,0 +1,18 @@
+<style>
+* {
+ -webkit-border-before: 4px solid;
+ -webkit-line-grid: simple;
+ transition: border-width 100ms linear;
+ column-width: 1000px;
+ cursor: auto;
+ padding-top: 10000000000px;
+}
+*::after {
+ content: 'a'
+}
+</style>
+PASS if no crash or assert.
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText()
+</script>
Modified: trunk/Source/WebCore/ChangeLog (274455 => 274456)
--- trunk/Source/WebCore/ChangeLog 2021-03-16 00:37:11 UTC (rev 274455)
+++ trunk/Source/WebCore/ChangeLog 2021-03-16 00:52:06 UTC (rev 274456)
@@ -1,3 +1,20 @@
+2021-03-15 Zalan Bujtas <za...@apple.com>
+
+ [Multi-column] Ignore line grid offset when the grid line is shorter than 0.5px
+ https://bugs.webkit.org/show_bug.cgi?id=223220
+ <rdar://73192773>
+
+ Reviewed by Simon Fraser.
+
+ This is a simple check on roundToInt(line box height) to make sure we don't divide by zero.
+
+ Test: fast/multicol/crash-when-line-grid-is-shorter-than-half-px.html
+
+ * rendering/RenderLayoutState.cpp:
+ (WebCore::RenderLayoutState::computeLineGridPaginationOrigin):
+ * rendering/RootInlineBox.h:
+ (WebCore::RootInlineBox::lineBoxHeight const):
+
2021-03-15 Alex Christensen <achristen...@webkit.org>
REGRESSION(r271642) Another app was relying on DOMWindow reuse
Modified: trunk/Source/WebCore/rendering/RenderLayoutState.cpp (274455 => 274456)
--- trunk/Source/WebCore/rendering/RenderLayoutState.cpp 2021-03-16 00:37:11 UTC (rev 274455)
+++ trunk/Source/WebCore/rendering/RenderLayoutState.cpp 2021-03-16 00:52:06 UTC (rev 274456)
@@ -193,10 +193,6 @@
// as established by the line box.
// FIXME: Need to handle crazy line-box-contain values that cause the root line box to not be considered. I assume
// the grid should honor line-box-contain.
- LayoutUnit gridLineHeight = lineGridBox->lineBoxBottom() - lineGridBox->lineBoxTop();
- if (!gridLineHeight)
- return;
-
bool isHorizontalWritingMode = m_lineGrid->isHorizontalWritingMode();
LayoutUnit lineGridBlockOffset = isHorizontalWritingMode ? m_lineGridOffset.height() : m_lineGridOffset.width();
LayoutUnit firstLineTopWithLeading = lineGridBlockOffset + lineGridBox->lineBoxTop();
@@ -206,8 +202,11 @@
// Shift to the next highest line grid multiple past the page logical top. Cache the delta
// between this new value and the page logical top as the pagination origin.
- LayoutUnit remainder = roundToInt(pageLogicalTop - firstLineTopWithLeading) % roundToInt(gridLineHeight);
- LayoutUnit paginationDelta = gridLineHeight - remainder;
+ auto lineBoxHeight = lineGridBox->lineBoxHeight();
+ if (!roundToInt(lineBoxHeight))
+ return;
+ LayoutUnit remainder = roundToInt(pageLogicalTop - firstLineTopWithLeading) % roundToInt(lineBoxHeight);
+ LayoutUnit paginationDelta = lineBoxHeight - remainder;
if (isHorizontalWritingMode)
m_lineGridPaginationOrigin.setHeight(paginationDelta);
else
Modified: trunk/Source/WebCore/rendering/RootInlineBox.h (274455 => 274456)
--- trunk/Source/WebCore/rendering/RootInlineBox.h 2021-03-16 00:37:11 UTC (rev 274455)
+++ trunk/Source/WebCore/rendering/RootInlineBox.h 2021-03-16 00:52:06 UTC (rev 274456)
@@ -56,6 +56,7 @@
LayoutUnit lineBoxTop() const { return m_lineBoxTop; }
LayoutUnit lineBoxBottom() const { return m_lineBoxBottom; }
+ LayoutUnit lineBoxHeight() const { return lineBoxBottom() - lineBoxTop(); }
LayoutUnit paginationStrut() const { return m_paginationStrut; }
void setPaginationStrut(LayoutUnit strut) { m_paginationStrut = strut; }
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
