Skip to content

GitLab

T
tangled
Commit 8b2b44ca authored by Manuel Rego Casasnovas's avatar Manuel Rego Casasnovas Committed by Commit Bot
Browse files
Options

[css-contain] Fix crash on SetText optimization 

This optimization was introduced in r578233, but with the test
included in this patch it was causing a crash.
The problem is that the RootInlineBox has more than one children
which is not expected.
In that case we shouldn't apply the optimization,
so a new condition has been added in
LayoutText::CanOptimizeSetText() to avoid it.

BUG=805785
TEST=fast/css/containment/change-text-node-data-crash.html

Change-Id: I924f30f4d0e0ae3e40f2437b54e5323a81a40051
Reviewed-on: https://chromium-review.googlesource.com/c/1356590Reviewed-by: default avatarKoji Ishii <kojii@chromium.org>
Reviewed-by: default avatarEmil A Eklund <eae@chromium.org>
Commit-Queue: Manuel Rego <rego@igalia.com>
Cr-Commit-Position: refs/heads/master@{#613036}
parent 050bc103
Hide whitespace changes
Inline Side-by-side
Showing with 36 additions and 9 deletions
third_party/blink/renderer/core/layout/layout_text.cc
View file @ 8b2b44ca
...@@ -1608,15 +1608,16 @@ bool LayoutText::CanOptimizeSetText() const { ...@@ -1608,15 +1608,16 @@ bool LayoutText::CanOptimizeSetText() const {
return Parent()->IsLayoutBlockFlow() && return Parent()->IsLayoutBlockFlow() &&
(Parent()->ShouldApplyLayoutContainment() && (Parent()->ShouldApplyLayoutContainment() &&
Parent()->ShouldApplySizeContainment()) && Parent()->ShouldApplySizeContainment()) &&
FirstTextBox() && FirstTextBox() && FirstTextBox() == LastTextBox() &&
(FirstTextBox() == LastTextBox() && FirstTextBox()->Root().FirstChild() ==
// If "line-height" is "normal" we might need to recompute the FirstTextBox()->Root().LastChild() &&
// baseline which is not straight forward. // If "line-height" is "normal" we might need to recompute the
!StyleRef().LineHeight().IsNegative() && // baseline which is not straight forward.
// We would need to recompute the position if "direction" is "rtl". !StyleRef().LineHeight().IsNegative() &&
StyleRef().IsLeftToRightDirection() && // We would need to recompute the position if "direction" is "rtl".
// We would need to layout the text if it is justified. StyleRef().IsLeftToRightDirection() &&
(StyleRef().GetTextAlign(true) != ETextAlign::kJustify)); // We would need to layout the text if it is justified.
(StyleRef().GetTextAlign(true) != ETextAlign::kJustify);
} }
void LayoutText::SetFirstTextBoxLogicalLeft(float text_width) const { void LayoutText::SetFirstTextBoxLogicalLeft(float text_width) const {
......
third_party/blink/web_tests/fast/css/containment/change-text-node-data-crash-expected.txt 0 → 100644
View file @ 8b2b44ca
The test passes if you see the word "PASS" below and it doesn't crash in debug.
PASS
third_party/blink/web_tests/fast/css/containment/change-text-node-data-crash.html 0 → 100644
View file @ 8b2b44ca
<!DOCTYPE html>
<meta charset="utf-8">
<style>
#test {
contain: layout size;
line-height: 1;
}
</style>
<p>The test passes if you see the word "PASS" below and it doesn't crash in debug.</p>
<div id="test">
<div style="display: inline-block;"></div>
</div>
<script>
if (window.testRunner)
testRunner.dumpAsText();
let contentNode = document.createTextNode("");
contentNode.data = "FAIL";
test.appendChild(contentNode);
document.body.offsetLeft;
contentNode.data = "PASS";
</script>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment