Skip to content

GitLab

T
tangled
Commit 6a3af526 authored by Javier Fernández García-Boente's avatar Javier Fernández García-Boente Committed by Commit Bot
Browse files
Options

Reset trailing space structure when rewinding due to overflow handling 

During the HandleOverflow we consider the possibility of breaking at
previous opportunity. The logic for this case is implemented in the
BreakTextAtPreviousBreakOpportunity function.

In case that there is such suitable previous opportunity, we modify the
ItemResult that includes this opportunity in its offset range. We also
create a new ShapeResultView associated to this item_result, using the
new offset range.

However, it's possible that the trailing_collapsible_space_ structure
already has this ItemResult instance, that we are now altering as part
of the HandleOverflow logic.

The problem described in the issue 1131470 is caused by this situation,
where an ItemResult instance hold by the trailing_collapsible_space_ is
modified. During the computation of the trailing spaces size, as part
of the RemoveTrailingCollapsibleSpace function, we avoid calling to the
TruncateLineEndResult, which will reshape again, in case the item_result
considered is already present in the trailing_collapsible_space_
structure. This causes that we end up with an ItemREsult of a different
size than the previously computed collapsed_shape_result.

Bug: 1131470
Change-Id: I15b31303fb8ec52b6d7359880f2785d16e1a0c59
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2429411
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: default avatarKoji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#811115}
parent c5d7c0a7
Hide whitespace changes
Inline Side-by-side
Showing with 23 additions and 0 deletions
third_party/blink/renderer/core/layout/ng/inline/ng_line_breaker.cc
View file @ 6a3af526
...@@ -824,6 +824,7 @@ bool NGLineBreaker::BreakTextAtPreviousBreakOpportunity( ...@@ -824,6 +824,7 @@ bool NGLineBreaker::BreakTextAtPreviousBreakOpportunity(
DCHECK_EQ(item.Type(), NGInlineItem::kText); DCHECK_EQ(item.Type(), NGInlineItem::kText);
DCHECK(item.Style() && item.Style()->AutoWrap()); DCHECK(item.Style() && item.Style()->AutoWrap());
// TODO(jfernandez): Should we use the non-hangable-run-end instead ?
unsigned break_opportunity = break_iterator_.PreviousBreakOpportunity( unsigned break_opportunity = break_iterator_.PreviousBreakOpportunity(
item_result->EndOffset() - 1, item_result->StartOffset()); item_result->EndOffset() - 1, item_result->StartOffset());
if (break_opportunity <= item_result->StartOffset()) if (break_opportunity <= item_result->StartOffset())
...@@ -836,6 +837,12 @@ bool NGLineBreaker::BreakTextAtPreviousBreakOpportunity( ...@@ -836,6 +837,12 @@ bool NGLineBreaker::BreakTextAtPreviousBreakOpportunity(
item_result->inline_size = item_result->inline_size =
item_result->shape_result->SnappedWidth().ClampNegativeToZero(); item_result->shape_result->SnappedWidth().ClampNegativeToZero();
item_result->can_break_after = true; item_result->can_break_after = true;
if (trailing_collapsible_space_.has_value() ||
trailing_collapsible_space_->item_result == item_result) {
trailing_collapsible_space_.reset();
}
return true; return true;
} }
......
third_party/blink/web_tests/external/wpt/css/css-text/removing-collapsible-spaces-before-float-crash.html 0 → 100644
View file @ 6a3af526
<title>CSS Text Test: Removing collapsible space before a float element cause Chrome to crash</title>
<link rel="help" href="https://crbug.com/1131470">
<!DOCTYPE html>
<style type="text/css">
.CLASS9 {
zoom:1.3%;
padding:8589934592%;
}
.CLASS13 { float:left; }
</style>
<b class="CLASS9">
>
a C
</b>
<input class="CLASS13"/>
c
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment