- Revision
- 182560
- Author
- [email protected]
- Date
- 2015-04-08 12:40:43 -0700 (Wed, 08 Apr 2015)
Log Message
[CSS Shapes] Properly handle negative reference box widths and center coordinates
https://bugs.webkit.org/show_bug.cgi?id=142610
Reviewed by Rob Buis.
Source/WebCore:
Fix a few cases where values that should not be negative end up that
way.
This patch is based on a couple of Blink patches by Rob Buis.
Tests: fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash.html
fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash.html
* rendering/shapes/ShapeOutsideInfo.cpp:
(WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine): A
negative margin box width means that the shape has no extent, so
clamp to zero.
* rendering/style/BasicShapes.cpp:
(WebCore::BasicShapeCircle::floatValueForRadiusInBox): When computing
the radii, take the absolute value, since the radii is based on
the distance, which is always positive.
(WebCore::BasicShapeEllipse::floatValueForRadiusInBox): Ditto.
LayoutTests:
Tests for the cases that trigger asserts.
* fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash-expected.txt: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash.html: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash-expected.txt: Added.
* fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (182559 => 182560)
--- trunk/LayoutTests/ChangeLog 2015-04-08 19:28:34 UTC (rev 182559)
+++ trunk/LayoutTests/ChangeLog 2015-04-08 19:40:43 UTC (rev 182560)
@@ -1,3 +1,17 @@
+2015-04-08 Bem Jones-Bey <[email protected]>
+
+ [CSS Shapes] Properly handle negative reference box widths and center coordinates
+ https://bugs.webkit.org/show_bug.cgi?id=142610
+
+ Reviewed by Rob Buis.
+
+ Tests for the cases that trigger asserts.
+
+ * fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash-expected.txt: Added.
+ * fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash.html: Added.
+ * fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash-expected.txt: Added.
+ * fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash.html: Added.
+
2015-04-08 ChangSeok Oh <[email protected]>
Fill list style background with same color with that of list background.
Added: trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash-expected.txt (0 => 182560)
--- trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash-expected.txt 2015-04-08 19:40:43 UTC (rev 182560)
@@ -0,0 +1 @@
+a This test passes if it doesn't crash.
Added: trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash.html (0 => 182560)
--- trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash.html (rev 0)
+++ trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash.html 2015-04-08 19:40:43 UTC (rev 182560)
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<style>
+div {
+ -webkit-shape-outside: padding-box circle(closest-side at 75px 80px);
+ float: right;
+}
+</style>
+<div>a</div>
+This test passes if it doesn't crash.
+<script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ }
+</script>
Added: trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash-expected.txt (0 => 182560)
--- trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash-expected.txt 2015-04-08 19:40:43 UTC (rev 182560)
@@ -0,0 +1 @@
+a This test passes if it doesn't crash.
Added: trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash.html (0 => 182560)
--- trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash.html (rev 0)
+++ trunk/LayoutTests/fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash.html 2015-04-08 19:40:43 UTC (rev 182560)
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<style>
+div {
+ float: right;
+ -webkit-shape-outside: ellipse(2257% 6317vmax);
+ margin-right:-3553%;
+}
+</style>
+<div>a</div>
+This test passes if it doesn't crash.
+<script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ }
+</script>
Modified: trunk/Source/WebCore/ChangeLog (182559 => 182560)
--- trunk/Source/WebCore/ChangeLog 2015-04-08 19:28:34 UTC (rev 182559)
+++ trunk/Source/WebCore/ChangeLog 2015-04-08 19:40:43 UTC (rev 182560)
@@ -1,3 +1,28 @@
+2015-04-08 Bem Jones-Bey <[email protected]>
+
+ [CSS Shapes] Properly handle negative reference box widths and center coordinates
+ https://bugs.webkit.org/show_bug.cgi?id=142610
+
+ Reviewed by Rob Buis.
+
+ Fix a few cases where values that should not be negative end up that
+ way.
+
+ This patch is based on a couple of Blink patches by Rob Buis.
+
+ Tests: fast/shapes/shape-outside-floats/shape-outside-floats-circle-negative-radius-crash.html
+ fast/shapes/shape-outside-floats/shape-outside-floats-ellipse-negative-width-crash.html
+
+ * rendering/shapes/ShapeOutsideInfo.cpp:
+ (WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine): A
+ negative margin box width means that the shape has no extent, so
+ clamp to zero.
+ * rendering/style/BasicShapes.cpp:
+ (WebCore::BasicShapeCircle::floatValueForRadiusInBox): When computing
+ the radii, take the absolute value, since the radii is based on
+ the distance, which is always positive.
+ (WebCore::BasicShapeEllipse::floatValueForRadiusInBox): Ditto.
+
2015-04-08 Commit Queue <[email protected]>
Unreviewed, rolling out r182522.
Modified: trunk/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp (182559 => 182560)
--- trunk/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp 2015-04-08 19:28:34 UTC (rev 182559)
+++ trunk/Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp 2015-04-08 19:40:43 UTC (rev 182560)
@@ -313,7 +313,7 @@
if (isShapeDirty() || !m_shapeOutsideDeltas.isForLine(borderBoxLineTop, lineHeight)) {
LayoutUnit referenceBoxLineTop = borderBoxLineTop - logicalTopOffset();
- LayoutUnit floatMarginBoxWidth = containingBlock.logicalWidthForFloat(&floatingObject);
+ LayoutUnit floatMarginBoxWidth = std::max<LayoutUnit>(LayoutUnit(), containingBlock.logicalWidthForFloat(&floatingObject));
if (computedShape().lineOverlapsShapeMarginBounds(referenceBoxLineTop, lineHeight)) {
LineSegment segment = computedShape().getExcludedInterval((borderBoxLineTop - logicalTopOffset()), std::min(lineHeight, shapeLogicalBottom() - borderBoxLineTop));
Modified: trunk/Source/WebCore/rendering/style/BasicShapes.cpp (182559 => 182560)
--- trunk/Source/WebCore/rendering/style/BasicShapes.cpp 2015-04-08 19:28:34 UTC (rev 182559)
+++ trunk/Source/WebCore/rendering/style/BasicShapes.cpp 2015-04-08 19:40:43 UTC (rev 182560)
@@ -96,11 +96,13 @@
float centerX = floatValueForCenterCoordinate(m_centerX, boxWidth);
float centerY = floatValueForCenterCoordinate(m_centerY, boxHeight);
+ float widthDelta = std::abs(boxWidth - centerX);
+ float heightDelta = std::abs(boxHeight - centerY);
if (m_radius.type() == BasicShapeRadius::ClosestSide)
- return std::min(std::min(centerX, boxWidth - centerX), std::min(centerY, boxHeight - centerY));
+ return std::min(std::min(std::abs(centerX), widthDelta), std::min(std::abs(centerY), heightDelta));
// If radius.type() == BasicShapeRadius::FarthestSide.
- return std::max(std::max(centerX, boxWidth - centerX), std::max(centerY, boxHeight - centerY));
+ return std::max(std::max(std::abs(centerX), widthDelta), std::max(std::abs(centerY), heightDelta));
}
void BasicShapeCircle::path(Path& path, const FloatRect& boundingBox)
@@ -133,13 +135,14 @@
float BasicShapeEllipse::floatValueForRadiusInBox(const BasicShapeRadius& radius, float center, float boxWidthOrHeight) const
{
if (radius.type() == BasicShapeRadius::Value)
- return floatValueForLength(radius.value(), boxWidthOrHeight);
+ return floatValueForLength(radius.value(), std::abs(boxWidthOrHeight));
+ float widthOrHeightDelta = std::abs(boxWidthOrHeight - center);
if (radius.type() == BasicShapeRadius::ClosestSide)
- return std::min(center, boxWidthOrHeight - center);
+ return std::min(std::abs(center), widthOrHeightDelta);
ASSERT(radius.type() == BasicShapeRadius::FarthestSide);
- return std::max(center, boxWidthOrHeight - center);
+ return std::max(std::abs(center), widthOrHeightDelta);
}
void BasicShapeEllipse::path(Path& path, const FloatRect& boundingBox)
