With async scrolling enabled, this MathML test asserts
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 24 Apr 2019 17:19:18 +0000 (17:19 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 24 Apr 2019 17:19:18 +0000 (17:19 +0000)
https://bugs.webkit.org/show_bug.cgi?id=196123

Source/WebCore:

This patch ensures that updateScrollInfoAfterLayout() is called during MathML layout. This
fixes assertions when async scrolling is enabled and MathML elements have non-visible overflow.

Patch by Frederic Wang <fwang@igalia.com> on 2019-04-24
Reviewed by Rob Buis.

Test: mathml/mathml-overflow-crash.html

* rendering/mathml/RenderMathMLBlock.cpp:
(WebCore::RenderMathMLBlock::layoutBlock):
(WebCore::RenderMathMLBlock::layoutInvalidMarkup):
* rendering/mathml/RenderMathMLFraction.cpp:
(WebCore::RenderMathMLFraction::layoutBlock):
* rendering/mathml/RenderMathMLMath.cpp:
(WebCore::RenderMathMLMath::layoutBlock):
* rendering/mathml/RenderMathMLMenclose.cpp:
(WebCore::RenderMathMLMenclose::layoutBlock):
* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::layoutBlock):
* rendering/mathml/RenderMathMLPadded.cpp:
(WebCore::RenderMathMLPadded::layoutBlock):
* rendering/mathml/RenderMathMLRoot.cpp:
(WebCore::RenderMathMLRoot::layoutBlock):
* rendering/mathml/RenderMathMLRow.cpp:
(WebCore::RenderMathMLRow::layoutBlock):
* rendering/mathml/RenderMathMLScripts.cpp:
(WebCore::RenderMathMLScripts::layoutBlock):
* rendering/mathml/RenderMathMLSpace.cpp:
(WebCore::RenderMathMLSpace::layoutBlock):
* rendering/mathml/RenderMathMLToken.cpp:
(WebCore::RenderMathMLToken::layoutBlock):
* rendering/mathml/RenderMathMLUnderOver.cpp:
(WebCore::RenderMathMLUnderOver::layoutBlock):

LayoutTests:

Patch by Frederic Wang <fwang@igalia.com> on 2019-04-24
Reviewed by Rob Buis.

Add a test for each MathML layoutBlock functions/classes.

* mathml/mathml-overflow-crash-expected.txt: Added.
* mathml/mathml-overflow-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244595 268f45cc-cd09-0410-ab3c-d52691b4dbfc

16 files changed:
LayoutTests/ChangeLog
LayoutTests/mathml/mathml-overflow-crash-expected.txt [new file with mode: 0644]
LayoutTests/mathml/mathml-overflow-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp
Source/WebCore/rendering/mathml/RenderMathMLFraction.cpp
Source/WebCore/rendering/mathml/RenderMathMLMath.cpp
Source/WebCore/rendering/mathml/RenderMathMLMenclose.cpp
Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
Source/WebCore/rendering/mathml/RenderMathMLPadded.cpp
Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
Source/WebCore/rendering/mathml/RenderMathMLRow.cpp
Source/WebCore/rendering/mathml/RenderMathMLScripts.cpp
Source/WebCore/rendering/mathml/RenderMathMLSpace.cpp
Source/WebCore/rendering/mathml/RenderMathMLToken.cpp
Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp

index e2e4e8a..c4d9ace 100644 (file)
@@ -1,3 +1,15 @@
+2019-04-24  Frederic Wang  <fwang@igalia.com>
+
+        With async scrolling enabled, this MathML test asserts
+        https://bugs.webkit.org/show_bug.cgi?id=196123
+
+        Reviewed by Rob Buis.
+
+        Add a test for each MathML layoutBlock functions/classes.
+
+        * mathml/mathml-overflow-crash-expected.txt: Added.
+        * mathml/mathml-overflow-crash.html: Added.
+
 2019-04-24  Cathie Chen  <cathiechen@igalia.com>
 
         [Mac Debug] Layout Test resize-observer/observe-element-from-other-frame.html is a flaky failure
diff --git a/LayoutTests/mathml/mathml-overflow-crash-expected.txt b/LayoutTests/mathml/mathml-overflow-crash-expected.txt
new file mode 100644 (file)
index 0000000..a069f8e
--- /dev/null
@@ -0,0 +1,29 @@
+This test passes if it does not crash
+
+RenderMathMLFenced
+
+RenderMathMLFraction
+
+RenderMathMLMath
+
+RenderMathMLMenclose
+
+|
+RenderMathMLOperator
+
+RenderMathMLPadded
+
+RenderMathMLRoot
+
+RenderMathMLRow
+
+RenderMathMLScripts
+
+RenderMathMLSpace
+
+A
+RenderMathMLToken
+
+RenderMathMLUnderOver
+
+
diff --git a/LayoutTests/mathml/mathml-overflow-crash.html b/LayoutTests/mathml/mathml-overflow-crash.html
new file mode 100644 (file)
index 0000000..a14ce4d
--- /dev/null
@@ -0,0 +1,121 @@
+<!DOCTYPE html> <!-- webkit-test-runner [ internal:AsyncOverflowScrollingEnabled=true ] -->
+<html>
+  <head>
+    <title>ASSERTION with MathML elements with overflow</title>
+    <meta charset="utf-8"/>
+    <script>
+      if (window.testRunner)
+          testRunner.dumpAsText();
+    </script>
+  </head>
+  <body>
+
+    <p>This test passes if it does not crash</p>
+
+    <p>
+      <math>
+        <mfenced style="overflow: auto">
+          <mtext>RenderMathMLFenced</mtext>
+        </mfenced>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <mfrac style="overflow: auto">
+          <mtext>RenderMathMLFraction</mtext>
+          <mspace></mspace>
+        </mfrac>
+      </math>
+    </p>
+
+    <p>
+      <math style="overflow: auto">
+        <mtext>RenderMathMLMath</mtext>
+      </math>
+    </p>
+
+   <p>
+     <math>
+       <menclose style="overflow: auto">
+         <mtext>RenderMathMLMenclose</mtext>
+       </menclose>
+     </math>
+   </p>
+
+    <p>
+      <math>
+        <mo style="overflow: auto">|</mo>
+        <mo style="overflow: auto">RenderMathMLOperator</mo>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <mpadded style="overflow: auto">
+          <mtext>RenderMathMLPadded</mtext>
+        </mpadded>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <mroot style="overflow: auto">
+          <mtext>RenderMathMLRoot</mtext>
+          <mspace></mspace>
+        </mroot>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <mrow style="overflow: auto">
+          <mtext>RenderMathMLRow</mtext>
+        </mrow>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <msubsup style="overflow: auto">
+          <mtext>RenderMathMLScripts</mtext>
+          <mspace></mspace>
+          <mspace></mspace>
+        </msubsup>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <mspace style="overflow: auto"></mspace>
+        <mtext>RenderMathMLSpace</mtext>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <mtext style="overflow: auto" mathvariant="double-struck">A</mtext>
+        <mtext style="overflow: auto">RenderMathMLToken</mtext>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <munderover style="overflow: auto">
+          <mtext>RenderMathMLUnderOver</mtext>
+          <mspace></mspace>
+          <mspace></mspace>
+        </munderover>
+      </math>
+    </p>
+
+    <p>
+      <math>
+        <mfrac style="overflow: auto">
+          <mtext>RenderMathMLBlock (invalid markup)</mtext>
+        </mfrac>
+      </math>
+    </p>
+
+  </body>
+</html>
index 6b199ee..4ea8179 100644 (file)
@@ -1,3 +1,41 @@
+2019-04-24  Frederic Wang  <fwang@igalia.com>
+
+        With async scrolling enabled, this MathML test asserts
+        https://bugs.webkit.org/show_bug.cgi?id=196123
+
+        This patch ensures that updateScrollInfoAfterLayout() is called during MathML layout. This
+        fixes assertions when async scrolling is enabled and MathML elements have non-visible overflow.
+
+        Reviewed by Rob Buis.
+
+        Test: mathml/mathml-overflow-crash.html
+
+        * rendering/mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::layoutBlock):
+        (WebCore::RenderMathMLBlock::layoutInvalidMarkup):
+        * rendering/mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::layoutBlock):
+        * rendering/mathml/RenderMathMLMath.cpp:
+        (WebCore::RenderMathMLMath::layoutBlock):
+        * rendering/mathml/RenderMathMLMenclose.cpp:
+        (WebCore::RenderMathMLMenclose::layoutBlock):
+        * rendering/mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::layoutBlock):
+        * rendering/mathml/RenderMathMLPadded.cpp:
+        (WebCore::RenderMathMLPadded::layoutBlock):
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::layoutBlock):
+        * rendering/mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::layoutBlock):
+        * rendering/mathml/RenderMathMLScripts.cpp:
+        (WebCore::RenderMathMLScripts::layoutBlock):
+        * rendering/mathml/RenderMathMLSpace.cpp:
+        (WebCore::RenderMathMLSpace::layoutBlock):
+        * rendering/mathml/RenderMathMLToken.cpp:
+        (WebCore::RenderMathMLToken::layoutBlock):
+        * rendering/mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::layoutBlock):
+
 2019-04-24  Greg V  <greg@unrelenting.technology>
 
         Fix -Wc++11-narrowing on unsigned char platforms like FreeBSD/aarch64
index 8e356b6..7185a73 100644 (file)
@@ -252,6 +252,8 @@ void RenderMathMLBlock::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     repainter.repaintAfterLayout();
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
@@ -265,6 +267,7 @@ void RenderMathMLBlock::layoutInvalidMarkup(bool relayoutChildren)
     setLogicalWidth(0);
     setLogicalHeight(0);
     layoutPositionedObjects(relayoutChildren);
+    updateScrollInfoAfterLayout();
     clearNeedsLayout();
 }
 
index 9a1047f..8ed6f70 100644 (file)
@@ -248,6 +248,8 @@ void RenderMathMLFraction::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     layoutPositionedObjects(relayoutChildren);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index 1736811..7796503 100644 (file)
@@ -87,6 +87,8 @@ void RenderMathMLMath::layoutBlock(bool relayoutChildren, LayoutUnit pageLogical
 
     layoutPositionedObjects(relayoutChildren);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index 6a675ae..5e7b212 100644 (file)
@@ -190,6 +190,8 @@ void RenderMathMLMenclose::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     layoutPositionedObjects(relayoutChildren);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index 7a7113a..16901ed 100644 (file)
@@ -243,6 +243,8 @@ void RenderMathMLOperator::layoutBlock(bool relayoutChildren, LayoutUnit pageLog
             child->setLocation(child->location() + horizontalShift);
     }
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index 9cdd5c9..d13c8b4 100644 (file)
@@ -111,6 +111,8 @@ void RenderMathMLPadded::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     layoutPositionedObjects(relayoutChildren);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index 6bc6ec5..923ad8e 100644 (file)
@@ -261,6 +261,8 @@ void RenderMathMLRoot::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     layoutPositionedObjects(relayoutChildren);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index d072fed..9b3eb08 100644 (file)
@@ -178,6 +178,8 @@ void RenderMathMLRow::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     layoutPositionedObjects(relayoutChildren);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index bff9a06..658399c 100644 (file)
@@ -461,6 +461,8 @@ void RenderMathMLScripts::layoutBlock(bool relayoutChildren, LayoutUnit)
 
     layoutPositionedObjects(relayoutChildren);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index 099fe68..313693a 100644 (file)
@@ -81,6 +81,8 @@ void RenderMathMLSpace::layoutBlock(bool relayoutChildren, LayoutUnit)
     getSpaceHeightAndDepth(height, depth);
     setLogicalHeight(height + depth);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index 967280b..c9c59b8 100644 (file)
@@ -586,6 +586,8 @@ void RenderMathMLToken::layoutBlock(bool relayoutChildren, LayoutUnit pageLogica
     setLogicalWidth(mathVariantGlyph.font->widthForGlyph(mathVariantGlyph.glyph));
     setLogicalHeight(mathVariantGlyph.font->boundsForGlyph(mathVariantGlyph.glyph).height());
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }
 
index 6a6ddca..345dd3d 100644 (file)
@@ -353,6 +353,8 @@ void RenderMathMLUnderOver::layoutBlock(bool relayoutChildren, LayoutUnit pageLo
 
     layoutPositionedObjects(relayoutChildren);
 
+    updateScrollInfoAfterLayout();
+
     clearNeedsLayout();
 }