Skip to content
Permalink
Browse files
ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderB… 
…lock::offsetFromLogicalTopOfFirstPage

https://bugs.webkit.org/show_bug.cgi?id=155364
<rdar://problem/27720461>

Reviewed by David Hyatt.

Source/WebCore:

RenderNamedFlowThread is considered to be a root for the current renderer context so
we need to bail out from the containing block traversal here (like we do for the RenderView).

Test: fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::computeReplacedLogicalHeightUsing):

LayoutTests:

* fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts-expected.txt: Added.
* fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html: Added.


Canonical link: https://commits.webkit.org/182844@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@209158 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
@alanbujtas
alanbujtas committed Nov 30, 2016
1 parent 281b0d0 commit 9420ed5fbfe559e61aaba8db0187f15ff3da0684
11 LayoutTests/ChangeLog
View file
@@ -1,3 +1,14 @@
2016-11-30 Zalan Bujtas <zalan@apple.com>

ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage
https://bugs.webkit.org/show_bug.cgi?id=155364
<rdar://problem/27720461>

Reviewed by David Hyatt.

* fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts-expected.txt: Added.
* fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html: Added.

2016-11-30 Jiewen Tan <jiewen_tan@apple.com>

Update SubtleCrypto::wrapKey to match the latest spec
1 ...sts/fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts-expected.txt
View file
@@ -0,0 +1 @@
PASS if no assert in debug.
22 LayoutTests/fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html
View file
@@ -0,0 +1,22 @@
<!DOCTYPE html>
<html>
<head>
<title></title>
<style>
canvas {
width: 100%;
position: fixed;
-webkit-flow-into: foobar;
-webkit-writing-mode: vertical-lr;
}
</style>
</head>
<body>
<canvas></canvas>
PASS if no assert in debug.
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script>
</body>
</html>
16 Source/WebCore/ChangeLog
View file
@@ -1,3 +1,19 @@
2016-11-30 Zalan Bujtas <zalan@apple.com>

ASSERTION FAILED: layoutState->m_renderer == this in WebCore::RenderBlock::offsetFromLogicalTopOfFirstPage
https://bugs.webkit.org/show_bug.cgi?id=155364
<rdar://problem/27720461>

Reviewed by David Hyatt.

RenderNamedFlowThread is considered to be a root for the current renderer context so
we need to bail out from the containing block traversal here (like we do for the RenderView).

Test: fast/replaced/replaced-element-with-percentage-width-inside-flow-asserts.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::computeReplacedLogicalHeightUsing):

2016-11-30 Brady Eidson <beidson@apple.com>

IndexedDB 2.0: Send operations off to the server in batches instead of one at a time.
30 Source/WebCore/rendering/RenderBox.cpp
View file
@@ -3141,17 +3141,22 @@ LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(SizeType heightType, Len
case Percent:
case Calculated:
{
auto cb = isOutOfFlowPositioned() ? container() : containingBlock();
while (cb && cb->isAnonymous() && !is<RenderView>(*cb)) {
cb = cb->containingBlock();
downcast<RenderBlock>(*cb).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
auto* container = isOutOfFlowPositioned() ? this->container() : containingBlock();
while (container && container->isAnonymous()) {
// Stop at rendering context root.
if (is<RenderView>(*container) || is<RenderNamedFlowThread>(*container))
break;
container = container->containingBlock();
downcast<RenderBlock>(*container).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
}

// FIXME: This calculation is not patched for block-flow yet.
// https://bugs.webkit.org/show_bug.cgi?id=46500
if (cb->isOutOfFlowPositioned() && cb->style().height().isAuto() && !(cb->style().top().isAuto() || cb->style().bottom().isAuto())) {
ASSERT_WITH_SECURITY_IMPLICATION(cb->isRenderBlock());
RenderBlock& block = downcast<RenderBlock>(*cb);
if (container->isOutOfFlowPositioned()
&& container->style().height().isAuto()
&& !(container->style().top().isAuto() || container->style().bottom().isAuto())) {
ASSERT_WITH_SECURITY_IMPLICATION(container->isRenderBlock());
auto& block = downcast<RenderBlock>(*container);
LogicalExtentComputedValues computedValues;
block.computeLogicalHeight(block.logicalHeight(), 0, computedValues);
LayoutUnit newContentHeight = computedValues.m_extent - block.borderAndPaddingLogicalHeight() - block.scrollbarLogicalHeight();
@@ -3164,23 +3169,24 @@ LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(SizeType heightType, Len
// https://bugs.webkit.org/show_bug.cgi?id=46496
LayoutUnit availableHeight;
if (isOutOfFlowPositioned())
availableHeight = containingBlockLogicalHeightForPositioned(downcast<RenderBoxModelObject>(*cb));
availableHeight = containingBlockLogicalHeightForPositioned(downcast<RenderBoxModelObject>(*container));
else {
availableHeight = containingBlockLogicalHeightForContent(IncludeMarginBorderPadding);
// It is necessary to use the border-box to match WinIE's broken
// box model. This is essential for sizing inside
// table cells using percentage heights.
// FIXME: This needs to be made block-flow-aware. If the cell and image are perpendicular block-flows, this isn't right.
// https://bugs.webkit.org/show_bug.cgi?id=46997
while (cb && !is<RenderView>(*cb) && (cb->style().logicalHeight().isAuto() || cb->style().logicalHeight().isPercentOrCalculated())) {
if (cb->isTableCell()) {
while (container && !is<RenderView>(*container)
&& (container->style().logicalHeight().isAuto() || container->style().logicalHeight().isPercentOrCalculated())) {
if (container->isTableCell()) {
// Don't let table cells squeeze percent-height replaced elements
// <http://bugs.webkit.org/show_bug.cgi?id=15359>
availableHeight = std::max(availableHeight, intrinsicLogicalHeight());
return valueForLength(logicalHeight, availableHeight - borderAndPaddingLogicalHeight());
}
downcast<RenderBlock>(*cb).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
cb = cb->containingBlock();
downcast<RenderBlock>(*container).addPercentHeightDescendant(const_cast<RenderBox&>(*this));
container = container->containingBlock();
}
}
return adjustContentBoxLogicalHeightForBoxSizing(valueForLength(logicalHeight, availableHeight));

0 comments on commit 9420ed5

Please sign in to comment.