Skip to content

Commit f2d2fb5

Browse files
author
[email protected]
committed
REGRESSION: Stack overflow in RenderBlockFlow::layoutBlock after increasing the font size to max in some RTL vertical books.
https://bugs.webkit.org/show_bug.cgi?id=174144 <rdar://problem/32781038> Reviewed by Simon Fraser. Source/WebCore: We set the start/end margin on the ruby renderer to support overhanging content. The margins ensure that adjacent boxes on the line are placed properly respecting the overhanging content. The line breaking algorithm also takes this value into account as it affects the line's available width. We need to reset this value before laying out the lines, otherwise we might end up using this value on the line twice; first as the renderer's margins (as the result of the previous layout) and second as the renderer's overhanging value. Since this is not strictly part of the renderer's layout context (i.e. we set them during the line layout and not at RenderRubyRun::layout) we can't rely on the ruby's layout logic to reset them. Test: fast/ruby/ruby-overhang-margin-crash.html * rendering/RenderBlockLineLayout.cpp: (WebCore::RenderBlockFlow::layoutLineBoxes): LayoutTests: * fast/ruby/ruby-overhang-margin-crash-expected.txt: Added. * fast/ruby/ruby-overhang-margin-crash.html: Added. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@219190 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 8b73308 commit f2d2fb5

File tree

5 files changed

+89
-0
lines changed

5 files changed

+89
-0
lines changed

‎LayoutTests/ChangeLog

+11
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
2017-07-05 Zalan Bujtas <[email protected]>
2+
3+
REGRESSION: Stack overflow in RenderBlockFlow::layoutBlock after increasing the font size to max in some RTL vertical books.
4+
https://bugs.webkit.org/show_bug.cgi?id=174144
5+
<rdar://problem/32781038>
6+
7+
Reviewed by Simon Fraser.
8+
9+
* fast/ruby/ruby-overhang-margin-crash-expected.txt: Added.
10+
* fast/ruby/ruby-overhang-margin-crash.html: Added.
11+
112
2017-07-05 Jonathan Bedard <[email protected]>
213

314
Move internal iOS 11 TestExpectations to OpenSource

‎LayoutTests/fast/ruby/ruby-overhang-margin-crash-expected.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
PASS if no crash.
2+
i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i凝ぎよう i i i i i i i

‎LayoutTests/fast/ruby/ruby-overhang-margin-crash.html

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
5+
<title>This tests ruby's overhanging margin.</title>
6+
<style>
7+
.col {
8+
column-count: 2;
9+
widows: 2;
10+
orphans: 1;
11+
width: 200px;
12+
font-size: 10px;
13+
}
14+
</style>
15+
<script>
16+
if (window.testRunner)
17+
testRunner.dumpAsText();
18+
</script>
19+
</head>
20+
<body>
21+
PASS if no crash.
22+
<div class=col><div>
23+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
24+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
25+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
26+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
27+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
28+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
29+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
30+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
31+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
32+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
33+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
34+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
35+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
36+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
37+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
38+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
39+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
40+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
41+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
42+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
43+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
44+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
45+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
46+
i i<ruby><rb>凝</rb><rt>ぎよう</rt></ruby>
47+
i i i i i i i</div></div>
48+
</body>
49+
</html>

‎Source/WebCore/ChangeLog

+21
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,24 @@
1+
2017-07-05 Zalan Bujtas <[email protected]>
2+
3+
REGRESSION: Stack overflow in RenderBlockFlow::layoutBlock after increasing the font size to max in some RTL vertical books.
4+
https://bugs.webkit.org/show_bug.cgi?id=174144
5+
<rdar://problem/32781038>
6+
7+
Reviewed by Simon Fraser.
8+
9+
We set the start/end margin on the ruby renderer to support overhanging content. The margins ensure that
10+
adjacent boxes on the line are placed properly respecting the overhanging content.
11+
The line breaking algorithm also takes this value into account as it affects the line's available width.
12+
We need to reset this value before laying out the lines, otherwise we might end up using this value on the line twice;
13+
first as the renderer's margins (as the result of the previous layout) and second as the renderer's overhanging value.
14+
Since this is not strictly part of the renderer's layout context (i.e. we set them during the line layout and not at
15+
RenderRubyRun::layout) we can't rely on the ruby's layout logic to reset them.
16+
17+
Test: fast/ruby/ruby-overhang-margin-crash.html
18+
19+
* rendering/RenderBlockLineLayout.cpp:
20+
(WebCore::RenderBlockFlow::layoutLineBoxes):
21+
122
2017-07-05 Yusuke Suzuki <[email protected]>
223

324
Upgrade GCC baseline

‎Source/WebCore/rendering/RenderBlockLineLayout.cpp

+6
Original file line numberDiff line numberDiff line change
@@ -1728,6 +1728,12 @@ void RenderBlockFlow::layoutLineBoxes(bool relayoutChildren, LayoutUnit& repaint
17281728
layoutState.floatList().append(FloatWithRect::create(box));
17291729
else if (isFullLayout || box.needsLayout()) {
17301730
// Replaced element.
1731+
if (isFullLayout && is<RenderRubyRun>(box)) {
1732+
// FIXME: This resets the overhanging margins that we set during line layout (see computeInlineDirectionPositionsForSegment)
1733+
// Find a more suitable place for this.
1734+
setMarginStartForChild(box, 0);
1735+
setMarginEndForChild(box, 0);
1736+
}
17311737
box.dirtyLineBoxes(isFullLayout);
17321738
if (!o.isAnonymousInlineBlock()) {
17331739
if (isFullLayout)

0 commit comments

Comments
 (0)