Skip to content

GitLab

T
tangled
Commit 5a83553e authored by wkorman's avatar wkorman Committed by Commit bot
Browse files
Options

Validate objects are a box when clipping layers for clip-path. 

http://crrev.com/2558633005 modified
LayoutObject::hasClipRelatedProperty() to consider clip path,
unintentionally introducing this issue.

BUG=675081
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2602823002
Cr-Commit-Position: refs/heads/master@{#440825}
parent fda5dd03
Hide whitespace changes
Inline Side-by-side
Showing with 11 additions and 3 deletions
third_party/WebKit/LayoutTests/fast/clip/clip-path-inline-element-crash-expected.html 0 → 100644
View file @ 5a83553e
<!doctype html>
<!-- Test passes if it does not crash. -->
third_party/WebKit/LayoutTests/fast/clip/clip-path-inline-element-crash.html 0 → 100644
View file @ 5a83553e
<!doctype html>
<!-- Test passes if it does not crash. -->
<custom-element style="clip-path: inset(10px 10px)">
<span style="clip-path: inset(10px 10px); will-change: transform;">
third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
View file @ 5a83553e
......@@ -967,7 +967,7 @@ void CompositedLayerMapping::updateGraphicsLayerGeometry(
// If we have a layer that clips children, position it.
IntRect clippingBox;
if (m_childContainmentLayer)
if (m_childContainmentLayer && layoutObject()->isBox())
clippingBox = clipBox(toLayoutBox(layoutObject()));
updateChildTransformLayerGeometry();
......@@ -1043,7 +1043,8 @@ void CompositedLayerMapping::computeGraphicsLayerParentLocation(
const IntRect& ancestorCompositingBounds,
IntPoint& graphicsLayerParentLocation) {
if (compositingContainer &&
compositingContainer->compositedLayerMapping()->hasClippingLayer()) {
compositingContainer->compositedLayerMapping()->hasClippingLayer() &&
compositingContainer->layoutObject()->isBox()) {
// If the compositing ancestor has a layer to clip children, we parent in
// that, and therefore position relative to it.
IntRect clippingBox =
......@@ -1360,7 +1361,8 @@ void CompositedLayerMapping::updateScrollingLayerGeometry(
}
void CompositedLayerMapping::updateChildClippingMaskLayerGeometry() {
if (!m_childClippingMaskLayer || !layoutObject()->style()->clipPath())
if (!m_childClippingMaskLayer || !layoutObject()->style()->clipPath() ||
!layoutObject()->isBox())
return;
LayoutBox* layoutBox = toLayoutBox(layoutObject());
IntRect clientBox = enclosingIntRect(layoutBox->clientBoxRect());
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment