ASSERTION FAILED: !newRelayoutRoot.container() || !newRelayoutRoot.co…

…ntainer()->needsLayout() in WebCore::FrameView::scheduleRelayoutOfSubtree

https://bugs.webkit.org/show_bug.cgi?id=151605#c1

Reviewed by David Hyatt.

Do not let RenderMultiColumnSet/RenderFlowThread mark ancestors dirty while updating scrollbars
for overflow content. While updating scrollbars, we only layout descendants so marking parents dirty
is unnecessary and could lead to an invalid dirty state.

Source/WebCore:

Test: fast/multicol/body-stuck-with-dirty-bit-with-columns.html

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::layoutSpecialExcludedChild):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::invalidateRegions):
* rendering/RenderFlowThread.h:
* rendering/RenderMultiColumnSet.cpp:
(WebCore::RenderMultiColumnSet::prepareForLayout):

LayoutTests:

* fast/multicol/body-stuck-with-dirty-bit-with-columns-expected.txt: Added.
* fast/multicol/body-stuck-with-dirty-bit-with-columns.html: Added.

Canonical link: https://commits.webkit.org/171192@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@195069 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog

@@ -1,3 +1,17 @@
+2016-01-14  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION FAILED: !newRelayoutRoot.container() || !newRelayoutRoot.container()->needsLayout() in WebCore::FrameView::scheduleRelayoutOfSubtree
+        https://bugs.webkit.org/show_bug.cgi?id=151605#c1
+
+        Reviewed by David Hyatt.
+
+        Do not let RenderMultiColumnSet/RenderFlowThread mark ancestors dirty while updating scrollbars
+        for overflow content. While updating scrollbars, we only layout descendants so marking parents dirty
+        is unnecessary and could lead to an invalid dirty state.
+
+        * fast/multicol/body-stuck-with-dirty-bit-with-columns-expected.txt: Added.
+        * fast/multicol/body-stuck-with-dirty-bit-with-columns.html: Added.
+
 2016-01-14  Dave Hyatt  <hyatt@apple.com>
 
         Avoid downloading the wrong image for <picture> elements.

LayoutTests/fast/multicol/body-stuck-with-dirty-bit-with-columns-expected.txt

@@ -0,0 +1 @@
+

LayoutTests/fast/multicol/body-stuck-with-dirty-bit-with-columns.html

@@ -0,0 +1,39 @@
+<title>This tests that we don't leave any renderer dirty when layout is done. PASS if no crash or assert in debug.</title>
+<style>
+*{
+    -webkit-columns: 55px 87;
+    overflow-y: scroll;
+    -webkit-background-composite: source-out;
+    width: 0%;
+}
+*|* {
+    display: inline-flex;
+}
+</style>
+<summary id="id_0">
+    aa
+    <progress></progress>
+</summary>
+<script>
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+setTimeout(function() {
+    if (window.localStorage.stage == 3) {
+        delete window.localStorage.stage;
+        if (window.testRunner) {
+            testRunner.dumpAsText();
+            testRunner.notifyDone();
+        }
+    } else {
+        if (window.localStorage.stage)
+        	window.localStorage.stage++;
+        else
+        	window.localStorage.stage = 1;
+        window.scrollTo(0,document.body.scrollHeight);
+        v_0 = document.getElementById('id_0');
+        v_0.removeChild(v_0.childNodes[0]);
+        location.reload();
+    }
+}, 0);
+</script>

Source/WebCore/ChangeLog

@@ -1,3 +1,24 @@
+2016-01-14  Zalan Bujtas  <zalan@apple.com>
+
+        ASSERTION FAILED: !newRelayoutRoot.container() || !newRelayoutRoot.container()->needsLayout() in WebCore::FrameView::scheduleRelayoutOfSubtree
+        https://bugs.webkit.org/show_bug.cgi?id=151605#c1
+
+        Reviewed by David Hyatt.
+
+        Do not let RenderMultiColumnSet/RenderFlowThread mark ancestors dirty while updating scrollbars
+        for overflow content. While updating scrollbars, we only layout descendants so marking parents dirty
+        is unnecessary and could lead to an invalid dirty state.
+
+        Test: fast/multicol/body-stuck-with-dirty-bit-with-columns.html
+
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::layoutSpecialExcludedChild):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::invalidateRegions):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderMultiColumnSet.cpp:
+        (WebCore::RenderMultiColumnSet::prepareForLayout):
+
 2016-01-14  Dave Hyatt  <hyatt@apple.com>
 
         Avoid downloading the wrong image for <picture> elements.

Source/WebCore/rendering/RenderBlockFlow.cpp

@@ -3766,7 +3766,7 @@ RenderObject* RenderBlockFlow::layoutSpecialExcludedChild(bool relayoutChildren)
         for (RenderMultiColumnSet* columnSet = flowThread->firstMultiColumnSet(); columnSet; columnSet = columnSet->nextSiblingMultiColumnSet())
             columnSet->prepareForLayout(!flowThread->inBalancingPass());
 
-        flowThread->invalidateRegions();
+        flowThread->invalidateRegions(MarkOnlyThis);
         flowThread->setNeedsHeightsRecalculation(true);
         flowThread->layout();
     } else {

Source/WebCore/rendering/RenderFlowThread.cpp

@@ -106,7 +106,7 @@ void RenderFlowThread::removeRegionFromThread(RenderRegion* renderRegion)
     m_regionList.remove(renderRegion);
 }
 
-void RenderFlowThread::invalidateRegions()
+void RenderFlowThread::invalidateRegions(MarkingBehavior markingParents)
 {
     ASSERT(!inFinalLayoutPhase());
 
@@ -125,7 +125,7 @@ void RenderFlowThread::invalidateRegions()
     if (m_lineToRegionMap)
         m_lineToRegionMap->clear();
     m_layersToRegionMappingsDirty = true;
-    setNeedsLayout();
+    setNeedsLayout(markingParents);
 
     m_regionsInvalidated = true;
 }

Source/WebCore/rendering/RenderFlowThread.h

@@ -85,7 +85,7 @@ class RenderFlowThread: public RenderBlockFlow {
     virtual void regionChangedWritingMode(RenderRegion*) { }
 
     void validateRegions();
-    void invalidateRegions();
+    void invalidateRegions(MarkingBehavior = MarkContainingBlockChain);
     bool hasValidRegionInfo() const { return !m_regionsInvalidated && !m_regionList.isEmpty(); }
 
     // Some renderers (column spanners) are moved out of the flow thread to live among column

Source/WebCore/rendering/RenderMultiColumnSet.cpp

@@ -362,7 +362,7 @@ void RenderMultiColumnSet::prepareForLayout(bool initial)
     // Start with "infinite" flow thread portion height until height is known.
     setLogicalBottomInFlowThread(RenderFlowThread::maxLogicalHeight());
 
-    setNeedsLayout();
+    setNeedsLayout(MarkOnlyThis);
 }
 
 void RenderMultiColumnSet::beginFlow(RenderBlock* container)