Do not cache definite height against perpendicular flex items.
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 14 Apr 2020 02:40:03 +0000 (02:40 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 14 Apr 2020 02:40:03 +0000 (02:40 +0000)
https://bugs.webkit.org/show_bug.cgi?id=207603
<rdar://problem/59135373>

Reviewed by Simon Fraser.

Source/WebCore:

RenderFlexibleBox::m_hasDefiniteHeight should not be set when the child we check against is a perpendicular item
because a perpendicular box's height is resolved against the containing block's width.

Test: fast/flexbox/unresolved-height-percentage-crash.html

* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::computeInnerFlexBaseSizeForChild):

LayoutTests:

* fast/flexbox/unresolved-height-percentage-crash-expected.txt: Added.
* fast/flexbox/unresolved-height-percentage-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@260055 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/flexbox/unresolved-height-percentage-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/flexbox/unresolved-height-percentage-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderFlexibleBox.cpp

index 3d35ae1..95aeb03 100644 (file)
@@ -1,3 +1,14 @@
+2020-04-13  Zalan Bujtas  <zalan@apple.com>
+
+        Do not cache definite height against perpendicular flex items.
+        https://bugs.webkit.org/show_bug.cgi?id=207603
+        <rdar://problem/59135373>
+
+        Reviewed by Simon Fraser.
+
+        * fast/flexbox/unresolved-height-percentage-crash-expected.txt: Added.
+        * fast/flexbox/unresolved-height-percentage-crash.html: Added.
+
 2020-04-13  Diego Pino Garcia  <dpino@igalia.com>
 
         [GTK][WPE] Gardening, update expectations after r260016
diff --git a/LayoutTests/fast/flexbox/unresolved-height-percentage-crash-expected.txt b/LayoutTests/fast/flexbox/unresolved-height-percentage-crash-expected.txt
new file mode 100644 (file)
index 0000000..4057c39
--- /dev/null
@@ -0,0 +1,3 @@
+Pass if no crash or assert.
+
+
diff --git a/LayoutTests/fast/flexbox/unresolved-height-percentage-crash.html b/LayoutTests/fast/flexbox/unresolved-height-percentage-crash.html
new file mode 100644 (file)
index 0000000..22774d2
--- /dev/null
@@ -0,0 +1,18 @@
+<style>
+.flexBox {
+    display: -webkit-flex;
+    width: min-content;
+    writing-mode: vertical-lr;
+    -webkit-flex-direction: column-reverse;    
+}
+.flexItem {
+    flex: 0 0 50%;
+    text-anchor: middle; 
+}
+</style>
+Pass if no crash or assert.
+<div class=flexBox><input class=flexItem><div class=flexItem></div></div>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
index f2220aa..9925a65 100644 (file)
@@ -1,3 +1,19 @@
+2020-04-13  Zalan Bujtas  <zalan@apple.com>
+
+        Do not cache definite height against perpendicular flex items.
+        https://bugs.webkit.org/show_bug.cgi?id=207603
+        <rdar://problem/59135373>
+
+        Reviewed by Simon Fraser.
+
+        RenderFlexibleBox::m_hasDefiniteHeight should not be set when the child we check against is a perpendicular item
+        because a perpendicular box's height is resolved against the containing block's width.
+
+        Test: fast/flexbox/unresolved-height-percentage-crash.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computeInnerFlexBaseSizeForChild):
+
 2020-04-13  David Kilzer  <ddkilzer@apple.com>
 
         Replace use of Checked<size_t, RecordOverflow> with CheckedSize
index 43aacad..6e07b25 100644 (file)
@@ -767,6 +767,10 @@ bool RenderFlexibleBox::mainAxisLengthIsDefinite(const RenderBox& child, const L
             return true;
         if (m_hasDefiniteHeight == SizeDefiniteness::Indefinite)
             return false;
+        // Do not cache the definite height state when the child is perpendicular.
+        // The height of a perpendicular child is resolved against the containing block's width which is not the main axis.
+        if (child.isHorizontalWritingMode() != isHorizontalWritingMode())
+            return false;
         bool definite = child.computePercentageLogicalHeight(flexBasis) != WTF::nullopt;
         if (m_inLayout) {
             // We can reach this code even while we're not laying ourselves out, such