Skip to content

GitLab

T
tangled
Commit 9ac62d64 authored by robhogan's avatar robhogan Committed by Commit bot
Browse files
Options

Revert of Re-land 'Fold out-of-flow objects into anonymous blocks when... 

Revert of Re-land 'Fold out-of-flow objects into anonymous blocks when removing children' (patchset #2 id:20001 of https://codereview.chromium.org/1543283002/ )

Reason for revert:
Ton of use-after-free security regressions.
BUG=573281

TBR=mstensho@opera.com

Review URL: https://codereview.chromium.org/1553853002

Cr-Commit-Position: refs/heads/master@{#367233}
parent f31507c9
Hide whitespace changes
Inline Side-by-side
Showing with 12 additions and 126 deletions
third_party/WebKit/LayoutTests/fast/block/float/add-float-after-anonymous-block-being-destroyed-expected.txt deleted 100644 → 0
View file @ f31507c9
crbug.com/322039: Don't attempt to fold a float into an anonymous block if it is being destroyed. The test should not crash.
third_party/WebKit/LayoutTests/fast/block/float/add-float-after-anonymous-block-being-destroyed.html deleted 100644 → 0
View file @ f31507c9
<!DOCTYPE html>
<style>
.float { float: right; }
.span { content: ""; }
</style>
<body>
<p>crbug.com/322039: Don't attempt to fold a float into an anonymous block if it is being destroyed. The test should not crash.</p>
<span id="span" class="span"><div></div></span>
<div id="div"></div>
<div class="float"></div>
</body>
<script>
if (window.testRunner)
testRunner.dumpAsText();
document.body.offsetTop;
span.setAttribute('class', '');
div.setAttribute('class', 'float');
</script>
third_party/WebKit/LayoutTests/fast/block/float/add-inline-before-float-and-into-anonymous-block-container-expected.html deleted 100644 → 0
View file @ f31507c9
<!DOCTYPE html>
<style>
.block {
width: 50px;
height: 50px;
background-color: green;
}
</style>
<p>crbug.com/322039: There should be a green <em>square</em> below.</p>
<div>
<br>
<div id="first" class="block"></div>
</div>
third_party/WebKit/LayoutTests/fast/block/float/add-inline-before-float-and-into-anonymous-block-container.html deleted 100644 → 0
View file @ f31507c9
<!DOCTYPE html>
<style>
.block {
width: 25px;
height: 50px;
background-color: green;
}
.float {
width: 25px;
height: 50px;
background-color: green;
float: left;
}
</style>
<p>crbug.com/322039: There should be a green <em>square</em> below.</p>
<div>
<div></div>
<br>
<div id="first" class="block"></div>
<div class="float"></div>
</div>
<script>
document.body.offsetTop;
document.getElementById("first").style.display = "inline-block";
</script>
third_party/WebKit/LayoutTests/fast/block/float/remove-div-after-float-and-before-anonymous-block-container.html deleted 100644 → 0
View file @ f31507c9
<!DOCTYPE html>
<style>
.block {
width: 50px;
height: 25px;
background-color: green;
}
.float {
width: 50px;
height: 25px;
background-color: green;
float: left;
}
</style>
<p>crbug.com/322039: There should be a green <em>square</em> below. In the layout tree the float should be inside the anonymous block.</p>
<div style="width: 150px;">
<div class="block"></div>
<div class="float"></div>
<div id="div"></div>
Text.
</div>
<script>
document.body.offsetTop;
var div = document.getElementById("div");
div.parentNode.removeChild(div);
</script>
third_party/WebKit/Source/core/layout/LayoutBlock.cpp
View file @ 9ac62d64
......@@ -374,32 +374,6 @@ void LayoutBlock::invalidateDisplayItemClients(const LayoutBoxModelObject& paint
invalidateDisplayItemClientForStartOfContinuationsIfNeeded(*this);
}
static void addNextFloatingOrOutOfFlowSiblingsToBlock(LayoutBlock* block, LayoutBlock* container)
{
if (block->beingDestroyed())
return;
LayoutObject* child = block->nextSibling();
while (child && child->isFloatingOrOutOfFlowPositioned()) {
LayoutObject* sibling = child->nextSibling();
container->moveChildTo(block, child, nullptr, false);
child = sibling;
}
}
static void addPreviousFloatingOrOutOfFlowSiblingsToBlock(LayoutBlock* block, LayoutBlock* container)
{
if (block->beingDestroyed())
return;
LayoutObject* child = block->previousSibling();
while (child && child->isFloatingOrOutOfFlowPositioned()) {
LayoutObject* sibling = child->previousSibling();
container->moveChildTo(block, child, block->firstChild(), false);
child = sibling;
}
}
void LayoutBlock::addChildIgnoringContinuation(LayoutObject* newChild, LayoutObject* beforeChild)
{
if (beforeChild && beforeChild->parent() != this) {
......@@ -474,9 +448,19 @@ void LayoutBlock::addChildIgnoringContinuation(LayoutObject* newChild, LayoutObj
LayoutBlock* newBox = createAnonymousBlock();
LayoutBox::addChild(newBox, beforeChild);
// Reparent adjacent floating or out-of-flow siblings to the new box.
addPreviousFloatingOrOutOfFlowSiblingsToBlock(newBox, this);
LayoutObject* child = newBox->previousSibling();
while (child && child->isFloatingOrOutOfFlowPositioned()) {
LayoutObject* sibling = child->previousSibling();
moveChildTo(newBox, child, newBox->firstChild(), false);
child = sibling;
}
newBox->addChild(newChild);
addNextFloatingOrOutOfFlowSiblingsToBlock(newBox, this);
child = newBox->nextSibling();
while (child && child->isFloatingOrOutOfFlowPositioned()) {
LayoutObject* sibling = child->nextSibling();
moveChildTo(newBox, child, nullptr, false);
child = sibling;
}
return;
}
}
......@@ -754,13 +738,6 @@ void LayoutBlock::removeChild(LayoutObject* oldChild)
&& (!anonymousBlock->previousSibling() || (anonymousBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonymousBlock->previousSibling()->isFloating() && !anonymousBlock->previousSibling()->previousSibling()))
&& (!anonymousBlock->nextSibling() || (anonymousBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonymousBlock->nextSibling()->isFloating() && !anonymousBlock->nextSibling()->nextSibling()))) {
collapseAnonymousBlockChild(this, anonymousBlock);
} else {
// If we have floating or out-of-flow siblings now adjacent to an anonymous block, fold them
// into it.
if (prev && prev->isAnonymousBlock())
addNextFloatingOrOutOfFlowSiblingsToBlock(toLayoutBlock(prev), this);
else if (next && next->isAnonymousBlock())
addPreviousFloatingOrOutOfFlowSiblingsToBlock(toLayoutBlock(next), this);
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment