Skip to content

GitLab

T
tangled
Commit 331294c5 authored by Koji Ishii's avatar Koji Ishii Committed by Commit Bot
Browse files
Options

[FragmentItem] Skip children of self-painting item 

When painting floating children, PaintFragment skips
descendants of self-painting boxes, but FragmentItem
did not. This patch matches PaintFragment logic.

Bug: 1109565
Change-Id: I660053e149638bb8728e4405f2d562b795a918f5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2332093Reviewed-by: default avatarXianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: default avatarIan Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#794181}
parent b3abac1d
Hide whitespace changes
Inline Side-by-side
Showing with 32 additions and 7 deletions
third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc
View file @ 331294c5
......@@ -755,19 +755,28 @@ void NGBoxFragmentPainter::PaintBlockChildren(const PaintInfo& paint_info,
void NGBoxFragmentPainter::PaintFloatingItems(const PaintInfo& paint_info,
NGInlineCursor* cursor) {
for (; *cursor; cursor->MoveToNext()) {
while (*cursor) {
const NGFragmentItem* item = cursor->Current().Item();
DCHECK(item);
const NGPhysicalBoxFragment* child_fragment = item->BoxFragment();
if (!child_fragment || child_fragment->HasSelfPaintingLayer() ||
!child_fragment->IsFloating())
if (!child_fragment) {
cursor->MoveToNext();
continue;
if (child_fragment->CanTraverse()) {
NGBoxFragmentPainter(*child_fragment).Paint(paint_info);
}
if (child_fragment->HasSelfPaintingLayer()) {
cursor->MoveToNextSkippingChildren();
continue;
}
ObjectPainter(*child_fragment->GetLayoutObject())
.PaintAllPhasesAtomically(paint_info);
if (child_fragment->IsFloating()) {
if (child_fragment->CanTraverse()) {
NGBoxFragmentPainter(*child_fragment).Paint(paint_info);
} else {
ObjectPainter(*child_fragment->GetLayoutObject())
.PaintAllPhasesAtomically(paint_info);
}
}
DCHECK(child_fragment->IsInlineBox() || !cursor->Current().HasChildren());
cursor->MoveToNext();
}
}
......@@ -1462,6 +1471,8 @@ void NGBoxFragmentPainter::PaintLineBoxChildItems(
for (; *children; children->MoveToNextSkippingChildren()) {
const NGFragmentItem* child_item = children->CurrentItem();
DCHECK(child_item);
if (child_item->IsFloating())
continue;
// Check if CullRect intersects with this child, only in block direction
// because soft-wrap and <br> needs to paint outside of InkOverflow() in
......@@ -1496,6 +1507,7 @@ void NGBoxFragmentPainter::PaintLineBoxChildItems(
if (const NGPhysicalBoxFragment* child_fragment =
child_item->BoxFragment()) {
DCHECK(!child_fragment->IsOutOfFlowPositioned());
if (child_fragment->IsListMarker()) {
PaintBoxItem(*child_item, *child_fragment, *children, paint_info,
paint_offset);
......
third_party/blink/web_tests/external/wpt/css/CSS2/floats/float-in-self-painting-inline.html 0 → 100644
View file @ 331294c5
<!DOCTYPE html>
<title>Floats in self-painting inline box should not crash</title>
<link rel="help" href="https://crbug.com/1109565">
<link rel="author" href="kojii@chromium.org">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<span style='opacity: 0.5'>
<div style="float: right">X</div>
</span>
<img title="ABC">
<script>
test(() => {}, "Pass if not crashes");
</script>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment