ASSERTION FAILED: !renderer->needsLayout() in WebCore::RenderBlock::checkPositionedOb...
authorfred.wang@free.fr <fred.wang@free.fr@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 15 Nov 2017 20:07:51 +0000 (20:07 +0000)
committerfred.wang@free.fr <fred.wang@free.fr@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 15 Nov 2017 20:07:51 +0000 (20:07 +0000)
commit9575d6276e7ab2e7837e18419a8f93cf9800d65d
tree2e314cb0a9030d05731bcb192cfabbd4e508c953
parentc5faaf891cbec7ad3d39b29ac221de7c9fa78b9c
ASSERTION FAILED: !renderer->needsLayout() in WebCore::RenderBlock::checkPositionedObjectsNeedLayout with MathML
https://bugs.webkit.org/show_bug.cgi?id=178865

Patch by Frederic Wang <fwang@igalia.com> on 2017-11-15
Reviewed by Manuel Rego Casasnovas.

Source/WebCore:

MathML token elements can contain HTML elements and hence MathML elements can contain
out-of-flow positioned descendants. Also all MathML elements can be containing block and hence
should position their out-of-flow positioned descendants before calling clearNeedsLayout().
This patch does that in all places in the MathML renderer classes, except a few of them:
- RenderMathMLSpace, which can not have descendants.
- RenderMathMLToken and RenderMathMLOperator, since they will use the layout implementation
  of RenderMathMLBlock when they contain non-text children.
The patch also fixes an ASSERTION failure in WebCore::RenderBlock::checkPositionedObjectsNeedLayout
due to some descendants that are not laid out.

Test: mathml/out-of-flow-in-token-crash.html

* rendering/mathml/RenderMathMLBlock.cpp:
(WebCore::RenderMathMLBlock::layoutBlock): Call layoutPositionedObjects.
(WebCore::RenderMathMLBlock::layoutInvalidMarkup): Ditto and pass the relayoutChildren boolean.
* rendering/mathml/RenderMathMLBlock.h: Add a relayoutChildren boolean to layoutInvalidMarkup.
* rendering/mathml/RenderMathMLFraction.cpp:
(WebCore::RenderMathMLFraction::layoutBlock): Pass the relayoutChildren boolean to layoutInvalidMarkup
and call layoutPositionedObjects.
* rendering/mathml/RenderMathMLRoot.cpp:
(WebCore::RenderMathMLRoot::layoutBlock): Ditto.
* rendering/mathml/RenderMathMLScripts.cpp:
(WebCore::RenderMathMLScripts::layoutBlock): Ditto.
* rendering/mathml/RenderMathMLUnderOver.cpp:
(WebCore::RenderMathMLUnderOver::layoutBlock): Ditto.
* rendering/mathml/RenderMathMLMenclose.cpp:
(WebCore::RenderMathMLMenclose::layoutBlock): Call layoutPositionedObjects.
* rendering/mathml/RenderMathMLPadded.cpp:
(WebCore::RenderMathMLPadded::layoutBlock): Ditto.
* rendering/mathml/RenderMathMLRow.cpp:
(WebCore::RenderMathMLRow::layoutBlock): Ditto.

LayoutTests:

Add a test to trigger various clearNeedsLayout() in a MathML containing block with
out-of-flow positioned descendants.

* mathml/out-of-flow-in-token-crash-expected.txt: Added.
* mathml/out-of-flow-in-token-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@224894 268f45cc-cd09-0410-ab3c-d52691b4dbfc
13 files changed:
LayoutTests/ChangeLog
LayoutTests/mathml/out-of-flow-in-token-crash-expected.txt [new file with mode: 0644]
LayoutTests/mathml/out-of-flow-in-token-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
Source/WebCore/rendering/mathml/RenderMathMLBlock.h
Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
Source/WebCore/rendering/mathml/RenderMathMLMenclose.cpp
Source/WebCore/rendering/mathml/RenderMathMLPadded.cpp
Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
Source/WebCore/rendering/mathml/RenderMathMLRow.cpp
Source/WebCore/rendering/mathml/RenderMathMLScripts.cpp
Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp