fast/block/inline-children-root-linebox-crash.html asserts after r118567
authorsimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 27 May 2012 00:43:12 +0000 (00:43 +0000)
committersimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sun, 27 May 2012 00:43:12 +0000 (00:43 +0000)
https://bugs.webkit.org/show_bug.cgi?id=87544

Source/WebCore:

Reviewed by Darin Adler.

RenderInline::offsetFromContainer() set offsetDependsOnPoint to true based
on the container's flipped writing mode. However, offsetFromContainer() would
then overwrite that, since it only checked for columns.

Fix by having RenderInline::offsetFromContainer() check for flipping on
the container. This fixes the assertion.

The new testcase exercises fixes another issue; unlike mapLocalToAbsolute(),
RenderGeometryMap::absoluteRect() didn't pass the rect center point through
the mapping, which resulted in a different result in some flipping cases.

Test: compositing/geometry/flipped-blocks-inline-mapping.html

* rendering/RenderGeometryMap.cpp:
(WebCore::RenderGeometryMap::absoluteRect):
* rendering/RenderInline.cpp:
(WebCore::RenderInline::offsetFromContainer):
(WebCore::RenderInline::pushMappingToContainer):

LayoutTests:

Reviewed by Darin Adler.

Remove fast/block/inline-children-root-linebox-crash.html from the skipped
list.

New, more complex writing mode flipping test with compositing.

* compositing/geometry/flipped-blocks-inline-mapping-expected.txt: Added.
* compositing/geometry/flipped-blocks-inline-mapping.html: Added.
* platform/mac/Skipped:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@118617 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/compositing/geometry/flipped-blocks-inline-mapping-expected.txt [new file with mode: 0644]
LayoutTests/compositing/geometry/flipped-blocks-inline-mapping.html [new file with mode: 0644]
LayoutTests/platform/mac/Skipped
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderGeometryMap.cpp
Source/WebCore/rendering/RenderInline.cpp

index 723e415..da20902 100644 (file)
@@ -1,3 +1,19 @@
+2012-05-26  Simon Fraser  <simon.fraser@apple.com>
+
+        fast/block/inline-children-root-linebox-crash.html asserts after r118567
+        https://bugs.webkit.org/show_bug.cgi?id=87544
+
+        Reviewed by Darin Adler.
+        
+        Remove fast/block/inline-children-root-linebox-crash.html from the skipped
+        list.
+        
+        New, more complex writing mode flipping test with compositing.
+
+        * compositing/geometry/flipped-blocks-inline-mapping-expected.txt: Added.
+        * compositing/geometry/flipped-blocks-inline-mapping.html: Added.
+        * platform/mac/Skipped:
+
 2012-05-26  David Barton  <dbarton@mathscribe.com>
 
         My first commit - set svn:mime-type to image/png on one .png file.
diff --git a/LayoutTests/compositing/geometry/flipped-blocks-inline-mapping-expected.txt b/LayoutTests/compositing/geometry/flipped-blocks-inline-mapping-expected.txt
new file mode 100644 (file)
index 0000000..20bb1f6
--- /dev/null
@@ -0,0 +1 @@
+This test should not assert in debug builds
diff --git a/LayoutTests/compositing/geometry/flipped-blocks-inline-mapping.html b/LayoutTests/compositing/geometry/flipped-blocks-inline-mapping.html
new file mode 100644 (file)
index 0000000..4ad6c4f
--- /dev/null
@@ -0,0 +1,33 @@
+<style>
+    .container {
+      -webkit-writing-mode: horizontal-bt;
+      height: 100px;
+      border: 1px solid black;
+    }
+    div {
+      height: 20px;
+    }
+    .box {
+      width: 20px;
+      height: 20px;
+      background-color: blue;
+    }
+    
+    .transformed {
+      -webkit-transform: translateZ(0);
+    }
+    span {
+      opacity: 0.8;
+    }
+    
+</style>
+<div class="container">
+    <span>
+        <div class="transformed box"></div>
+        <div style="display: inline-block">This test should not assert in debug builds</div>
+    </span>
+</div>
+<script>
+if (window.layoutTestController)
+  layoutTestController.dumpAsText();
+</script>
index 3553d35..55ca97f 100644 (file)
@@ -867,7 +867,3 @@ fast/frames/flattening/iframe-tiny.html
 fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgb565.html
 fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgba4444.html
 fast/canvas/webgl/tex-image-and-sub-image-2d-with-video-rgba5551.html
-
-# https://bugs.webkit.org/show_bug.cgi?id=87544
-fast/block/inline-children-root-linebox-crash.html
-
index 7d3c621..4443b56 100644 (file)
@@ -1,3 +1,29 @@
+2012-05-26  Simon Fraser  <simon.fraser@apple.com>
+
+        fast/block/inline-children-root-linebox-crash.html asserts after r118567
+        https://bugs.webkit.org/show_bug.cgi?id=87544
+
+        Reviewed by Darin Adler.
+        
+        RenderInline::offsetFromContainer() set offsetDependsOnPoint to true based
+        on the container's flipped writing mode. However, offsetFromContainer() would
+        then overwrite that, since it only checked for columns.
+        
+        Fix by having RenderInline::offsetFromContainer() check for flipping on
+        the container. This fixes the assertion.
+        
+        The new testcase exercises fixes another issue; unlike mapLocalToAbsolute(),
+        RenderGeometryMap::absoluteRect() didn't pass the rect center point through
+        the mapping, which resulted in a different result in some flipping cases.
+
+        Test: compositing/geometry/flipped-blocks-inline-mapping.html
+
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore::RenderGeometryMap::absoluteRect):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer):
+        (WebCore::RenderInline::pushMappingToContainer):
+
 2012-05-26  Geoffrey Garen  <ggaren@apple.com>
 
         WebKit should be lazy-finalization-safe (esp. the DOM) v2
index 11b58be..65f189b 100644 (file)
@@ -114,7 +114,7 @@ FloatRect RenderGeometryMap::absoluteRect(const FloatRect& rect) const
         result = rect;
         result.move(m_accumulatedOffset);
     } else {
-        TransformState transformState(TransformState::ApplyTransformDirection, rect);
+        TransformState transformState(TransformState::ApplyTransformDirection, rect.center(), rect);
         mapToAbsolute(transformState);
         result = transformState.lastPlanarQuad().boundingBox();
     }
index 8e6558b..b892816 100644 (file)
@@ -1080,7 +1080,7 @@ LayoutSize RenderInline::offsetFromContainer(RenderObject* container, const Layo
         offset -= toRenderBox(container)->scrolledContentOffset();
 
     if (offsetDependsOnPoint)
-        *offsetDependsOnPoint = container->hasColumns();
+        *offsetDependsOnPoint = container->hasColumns() || (container->isBox() && container->style()->isFlippedBlocksWritingMode());
 
     return offset;
 }
@@ -1142,11 +1142,6 @@ const RenderObject* RenderInline::pushMappingToContainer(const RenderBoxModelObj
     if (!container)
         return 0;
 
-    bool offsetDependsOnPoint = false;
-
-    if (container->isBox() && container->style()->isFlippedBlocksWritingMode())
-        offsetDependsOnPoint = true;
-
     LayoutSize adjustmentForSkippedAncestor;
     if (ancestorSkipped) {
         // There can't be a transform between repaintContainer and o, because transforms create containers, so it should be safe
@@ -1154,6 +1149,7 @@ const RenderObject* RenderInline::pushMappingToContainer(const RenderBoxModelObj
         adjustmentForSkippedAncestor = -ancestorToStopAt->offsetFromAncestorContainer(container);
     }
 
+    bool offsetDependsOnPoint = false;
     LayoutSize containerOffset = offsetFromContainer(container, LayoutPoint(), &offsetDependsOnPoint);
 
     bool preserve3D = container->style()->preserves3D() || style()->preserves3D();