Fix when orthogonal writing mode roots have floating siblings

When orthogonal writing mode roots have floating siblings, its containing block may still have old or even deleted LayoutObjects. This occurs when LayoutMultiColumnFlowThread::populate(), LayoutBoxModelObject::moveChildrenTo() with !fullRemoveInsert, or more, for the optimization purposes. This patch clears such objects to be re-created when the containing block is laid out. BUG=604095, 633409, 646178 Review-Url: https://codereview.chromium.org/2025543002 Cr-Commit-Position: refs/heads/master@{#419376}

Fix when orthogonal writing mode roots have floating siblings
When orthogonal writing mode roots have floating siblings, its containing block may still have old or even deleted LayoutObjects. This occurs when LayoutMultiColumnFlowThread::populate(), LayoutBoxModelObject::moveChildrenTo() with !fullRemoveInsert, or more, for the optimization purposes. This patch clears such objects to be re-created when the containing block is laid out. BUG=604095, 633409, 646178 Review-Url: https://codereview.chromium.org/2025543002 Cr-Commit-Position: refs/heads/master@{#419376}
5c433826 · kojii · Commit bot · d0ab2edb · 5c433826 · 5c433826
Commit 5c433826 authored Sep 17, 2016 by kojii Committed by Commit bot Sep 17, 2016
3 changed files
--- a/third_party/WebKit/LayoutTests/fast/writing-mode/orthogonal-writing-modes-floats-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/writing-mode/orthogonal-writing-modes-floats-crash-expected.txt
+crbug.com/604095: Passes if it doesn't crash crbug.com/604095: Passes if it doesn't crash crbug.com/604095: Passes if it doesn't crash crbug.com/604095: Passes if it doesn't crash
+Text
--- a/third_party/WebKit/LayoutTests/fast/writing-mode/orthogonal-writing-modes-floats-crash.html
+++ b/third_party/WebKit/LayoutTests/fast/writing-mode/orthogonal-writing-modes-floats-crash.html
+<!DOCTYPE html>
+<div id="header">
+  <span style="float:left;"> crbug.com/604095: Passes if it doesn't crash crbug.com/604095: Passes if it doesn't crash crbug.com/604095: Passes if it doesn't crash crbug.com/604095: Passes if it doesn't crash</span>
+  <script>
+    if (window.testRunner)
+      testRunner.dumpAsText();
+    document.body.offsetTop;
+  </script>
+  <style>
+    html {
+      writing-mode:vertical-rl;
+    }
+    #h {
+      writing-mode: horizontal-tb;
+      background-color: green;
+    }
+  </style>
+  <div id="h">Text</div>
+</div>
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -1859,6 +1859,24 @@ bool FrameView::hasOrthogonalWritingModeRoots() const
    return !m_orthogonalWritingModeRootList.isEmpty();
 }

+static inline void removeFloatingObjectsForSubtreeRoot(LayoutObject& root)
+{
+    // TODO(kojii): Under certain conditions, moveChildTo() defers
+    // removeFloatingObjects() until the containing block layouts. For
+    // instance, when descendants of the moving child is floating,
+    // removeChildNode() does not clear them. In such cases, at this
+    // point, FloatingObjects may contain old or even deleted objects.
+    // Dealing this in markAllDescendantsWithFloatsForLayout() could
+    // solve, but since that is likely to suffer the performance and
+    // since the containing block of orthogonal writing mode roots
+    // having floats is very rare, prefer to re-create
+    // FloatingObjects.
+    if (LayoutBlock* cb = root.containingBlock()) {
+        if (cb->needsLayout() && cb->isLayoutBlockFlow())
+            toLayoutBlockFlow(cb)->removeFloatingObjects();
+    }
+}
+
 void FrameView::layoutOrthogonalWritingModeRoots()
 {
    for (auto& root : m_orthogonalWritingModeRootList.ordered()) {
@@ -1869,8 +1887,9 @@ void FrameView::layoutOrthogonalWritingModeRoots()
            || !root->styleRef().logicalHeight().isIntrinsicOrAuto()) {
            continue;
        }
-        LayoutState layoutState(*root);
-        root->layout();
+
+        removeFloatingObjectsForSubtreeRoot(*root);
+        layoutFromRootObject(*root);
    }
 }