Skip to content

GitLab

T
tangled
Commit 6f208d56 authored by robhogan's avatar robhogan Committed by Commit bot
Browse files
Options

Copy float list of ruby base when merging it with a sibling 

When merging two ruby bases ensure that the new base has a complete float list.

BUG=619380,624028

Review-Url: https://codereview.chromium.org/2283413003
Cr-Commit-Position: refs/heads/master@{#415337}
parent eaf70ab3
Hide whitespace changes
Inline Side-by-side
Showing with 25 additions and 31 deletions
third_party/WebKit/LayoutTests/fast/block/float/float-reparent-during-detach-crash.html
View file @ 6f208d56
<!doctype HTML>
Passes if it does not crash.
<!DOCTYPE html>
<style>
.list{display:list-item;}
.float{float:right;}
</style>
<ruby>
test
crbug.com/619380: Passes if it does not crash.
<rt>
<rtc>
<a style="display:list-item">
<input style="float:right"></input>
</rtc>
</a>
</rt>
</ruby>
<rtc>
<a class="list">
<input class="float">
</rtc>
</rt>
</ruby>
<script>
if (window.testRunner)
window.testRunner.dumpAsText();
onload = function() {
var mySelection=window.getSelection();
document.execCommand("SelectAll");
mySelection.deleteFromDocument();
}
if (window.testRunner)
window.testRunner.dumpAsText();
document.execCommand("SelectAll");
window.getSelection().deleteFromDocument();
</script>
third_party/WebKit/Source/core/layout/FloatingObjects.cpp
View file @ 6f208d56
......@@ -64,7 +64,7 @@ FloatingObject::FloatingObject(LayoutBox* layoutObject)
m_type = FloatRight;
}
FloatingObject::FloatingObject(LayoutBox* layoutObject, Type type, const LayoutRect& frameRect, bool shouldPaint, bool isDescendant, bool isLowestNonOverhangingFloatInChild, bool performingUnsafeClone)
FloatingObject::FloatingObject(LayoutBox* layoutObject, Type type, const LayoutRect& frameRect, bool shouldPaint, bool isDescendant, bool isLowestNonOverhangingFloatInChild)
: m_layoutObject(layoutObject)
, m_originatingLine(nullptr)
, m_frameRect(frameRect)
......@@ -76,15 +76,7 @@ FloatingObject::FloatingObject(LayoutBox* layoutObject, Type type, const LayoutR
, m_isInPlacedTree(false)
#endif
{
m_shouldPaint = shouldPaint;
// TODO(chrishtr): Avoid the following hack when performing an unsafe clone.
// This avoids a use-after-free bug due to the fact that we sometimes fail to remove
// floats from their container when detaching (crbug.com/619380). This is actually a bug in the
// floats detach machinery, which needs to be fixed, in which case this workaround can be removed.
// In any case, it should be safe because moving floats from one owner to another should cause layout,
// which will in turn update the m_shouldPaint property.
if (!performingUnsafeClone)
m_shouldPaint = m_shouldPaint || shouldPaintForCompositedLayoutPart();
m_shouldPaint = shouldPaint || shouldPaintForCompositedLayoutPart();
}
bool FloatingObject::shouldPaintForCompositedLayoutPart()
......@@ -121,7 +113,7 @@ std::unique_ptr<FloatingObject> FloatingObject::copyToNewContainer(LayoutSize of
std::unique_ptr<FloatingObject> FloatingObject::unsafeClone() const
{
std::unique_ptr<FloatingObject> cloneObject = wrapUnique(new FloatingObject(layoutObject(), getType(), m_frameRect, m_shouldPaint, m_isDescendant, false, true));
std::unique_ptr<FloatingObject> cloneObject = wrapUnique(new FloatingObject(layoutObject(), getType(), m_frameRect, m_shouldPaint, m_isDescendant, false));
cloneObject->m_isPlaced = m_isPlaced;
return cloneObject;
}
......
third_party/WebKit/Source/core/layout/FloatingObjects.h
View file @ 6f208d56
......@@ -91,7 +91,7 @@ public:
private:
explicit FloatingObject(LayoutBox*);
FloatingObject(LayoutBox*, Type, const LayoutRect&, bool shouldPaint, bool isDescendant, bool isLowestNonOverhangingFloatInChild, bool performingUnsafeClone = false);
FloatingObject(LayoutBox*, Type, const LayoutRect&, bool shouldPaint, bool isDescendant, bool isLowestNonOverhangingFloatInChild);
bool shouldPaintForCompositedLayoutPart();
......
third_party/WebKit/Source/core/layout/LayoutRubyBase.cpp
View file @ 6f208d56
......@@ -123,8 +123,11 @@ void LayoutRubyBase::moveBlockChildren(LayoutRubyBase* toBase, LayoutObject* bef
anonBlockHere->deleteLineBoxTree();
anonBlockHere->destroy();
}
// Move all remaining children normally.
moveChildrenTo(toBase, firstChild(), beforeChild);
// Move all remaining children normally. If moving all children, include our float list.
if (!beforeChild)
moveAllChildrenIncludingFloatsTo(toBase, false);
else
moveChildrenTo(toBase, firstChild(), beforeChild);
}
ETextAlign LayoutRubyBase::textAlignmentForLine(bool /* endsWithSoftBreak */) const
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment