git://git.webkit.org / WebKit-https.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 3de2a50)
Should never be reached failure in WebCore::backgroundRectForBox
authorzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 28 Oct 2015 18:07:09 +0000 (18:07 +0000)
committerzalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 28 Oct 2015 18:07:09 +0000 (18:07 +0000)
https://bugs.webkit.org/show_bug.cgi?id=150232

Reviewed by Simon Fraser.

We should never end up with simple container for composited layer when background-clip: text is present.
(not even when the box has no decoration to paint)

Source/WebCore:

Test: fast/backgrounds/background-clip-text-with-simple-container.html

* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::paintsBoxDecorations):
(WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
(WebCore::backgroundRectForBox):

LayoutTests:

* fast/backgrounds/background-clip-text-with-simple-container-expected.txt: Added.
* fast/backgrounds/background-clip-text-with-simple-container.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@191680 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog patch | blob | history
LayoutTests/fast/backgrounds/background-clip-text-with-simple-container-expected.txt [new file with mode: 0644] patch | blob
LayoutTests/fast/backgrounds/background-clip-text-with-simple-container.html [new file with mode: 0644] patch | blob
Source/WebCore/ChangeLog patch | blob | history
Source/WebCore/rendering/RenderLayerBacking.cpp patch | blob | history
Source/WebCore/rendering/RenderLayerBacking.h patch | blob | history

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index b7d1563d73606b46e0f6d6076dca77c36d86d7e7..f0eacce9bb7c33a8f38ef53a37025accf282951d 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2015-10-28  Zalan Bujtas  <zalan@apple.com>
+
+        Should never be reached failure in WebCore::backgroundRectForBox
+        https://bugs.webkit.org/show_bug.cgi?id=150232
+
+        Reviewed by Simon Fraser.
+
+        We should never end up with simple container for composited layer when background-clip: text is present.
+        (not even when the box has no decoration to paint)
+
+        * fast/backgrounds/background-clip-text-with-simple-container-expected.txt: Added.
+        * fast/backgrounds/background-clip-text-with-simple-container.html: Added.
+
 2015-10-28  Ryan Haddad  <ryanhaddad@apple.com>
 
         Adding imported/w3c/web-platform-tests/XMLHttpRequest/response-method.htm to the list of flaky tests on win
diff --git a/LayoutTests/fast/backgrounds/background-clip-text-with-simple-container-expected.txt b/LayoutTests/fast/backgrounds/background-clip-text-with-simple-container-expected.txt
new file mode 100644 (file)
index 0000000..5953adc
--- /dev/null
+++ b/LayoutTests/fast/backgrounds/background-clip-text-with-simple-container-expected.txt
@@ -0,0 +1,2 @@
+This should not crash or assert in Debug.
+
diff --git a/LayoutTests/fast/backgrounds/background-clip-text-with-simple-container.html b/LayoutTests/fast/backgrounds/background-clip-text-with-simple-container.html
new file mode 100644 (file)
index 0000000..8c1953d
--- /dev/null
+++ b/LayoutTests/fast/backgrounds/background-clip-text-with-simple-container.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<style>
+    div {
+        -webkit-transform: translateZ(0);
+        -webkit-background-clip: text;
+    }
+</style>
+
+This should not crash or assert in Debug.
+<div></div>
+<script>
+    if (window.testRunner)
+        testRunner.dumpAsText();
+</script>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index efbcd4bf9b40d4d0bc8860a001e022832e627389..00e348fd3396e7d10c3c5bfccd0c37e1b9b88579 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,20 @@
+2015-10-28  Zalan Bujtas  <zalan@apple.com>
+
+        Should never be reached failure in WebCore::backgroundRectForBox
+        https://bugs.webkit.org/show_bug.cgi?id=150232
+
+        Reviewed by Simon Fraser.
+
+        We should never end up with simple container for composited layer when background-clip: text is present.
+        (not even when the box has no decoration to paint)
+
+        Test: fast/backgrounds/background-clip-text-with-simple-container.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintsBoxDecorations):
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+        (WebCore::backgroundRectForBox):
+
 2015-10-28  Chris Dumez  <cdumez@apple.com>
 
         Use RunLoopTimer in DataURLDecoder to avoid issues related to runloops
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index 214c0599de462e5053c31986e2721cca7b62fe52..ffd6db1e425e3e5e4c74e2531b4efb880dba35a5 100644 (file)
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -1718,7 +1718,7 @@ void RenderLayerBacking::updateDirectlyCompositedBackgroundColor(bool isSimpleCo
 
     // An unset (invalid) color will remove the solid color.
     m_graphicsLayer->setContentsToSolidColor(backgroundColor);
-    FloatRect contentsRect = backgroundBoxForPainting();
+    FloatRect contentsRect = backgroundBoxForSimpleContainerPainting();
     m_graphicsLayer->setContentsRect(contentsRect);
     m_graphicsLayer->setContentsClippingRect(FloatRoundedRect(contentsRect));
     didUpdateContentsRect = true;
@@ -1739,7 +1739,7 @@ void RenderLayerBacking::updateDirectlyCompositedBackgroundImage(bool isSimpleCo
         return;
     }
 
-    FloatRect destRect = backgroundBoxForPainting();
+    FloatRect destRect = backgroundBoxForSimpleContainerPainting();
     FloatSize phase;
     FloatSize tileSize;
 
@@ -1798,21 +1798,15 @@ static bool supportsDirectBoxDecorationsComposition(const RenderLayerModelObject
     if (style.backgroundComposite() != CompositeSourceOver)
         return false;
 
-    if (style.backgroundClip() == TextFillBox)
-        return false;
-
     return true;
 }
 
-bool RenderLayerBacking::paintsBoxDecorations() const
+bool RenderLayerBacking::paintsNonDirectCompositedBoxDecoration() const
 {
     if (!m_owningLayer.hasVisibleBoxDecorations())
         return false;
 
-    if (!supportsDirectBoxDecorationsComposition(renderer()))
-        return true;
-
-    return false;
+    return !supportsDirectBoxDecorationsComposition(renderer());
 }
 
 bool RenderLayerBacking::paintsChildren() const
@@ -1854,9 +1848,12 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
     if (renderer().isTextControl())
         return false;
 
-    if (paintsBoxDecorations() || paintsChildren())
+    if (paintsNonDirectCompositedBoxDecoration() || paintsChildren())
         return false;
 
+    if (renderer().style().backgroundClip() == TextFillBox)
+        return false;
+    
     if (renderer().isRenderNamedFlowFragmentContainer())
         return false;
 
@@ -2104,7 +2101,7 @@ static LayoutRect backgroundRectForBox(const RenderBox& box)
         return box.paddingBoxRect();
     case ContentFillBox:
         return box.contentBoxRect();
-    case TextFillBox:
+    default:
         break;
     }
 
@@ -2112,7 +2109,7 @@ static LayoutRect backgroundRectForBox(const RenderBox& box)
     return LayoutRect();
 }
 
-FloatRect RenderLayerBacking::backgroundBoxForPainting() const
+FloatRect RenderLayerBacking::backgroundBoxForSimpleContainerPainting() const
 {
     if (!is<RenderBox>(renderer()))
         return FloatRect();
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index 4dc48215e02ca63fbc6f66285bf563c46712dc41..60c1ca830dfe0683bee94f1ca8ba54771f5781aa 100644 (file)
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -244,7 +244,7 @@ public:
     LayoutSize devicePixelFractionFromRenderer() const { return m_devicePixelFractionFromRenderer; }
 
 private:
-    FloatRect backgroundBoxForPainting() const;
+    FloatRect backgroundBoxForSimpleContainerPainting() const;
 
     void createPrimaryGraphicsLayer();
     void destroyGraphicsLayers();
@@ -302,7 +302,7 @@ private:
     
     bool isMainFrameRenderViewLayer() const;
     
-    bool paintsBoxDecorations() const;
+    bool paintsNonDirectCompositedBoxDecoration() const;
     bool paintsChildren() const;
 
     // Returns true if this compositing layer has no visible content.
Mirror of the WebKit open source project from svn.webkit.org.