tree e2543c78198845164c584d4b72ba8afde75aac2d
parent 46f41e9fb96f0ecda22591deedea42a83ad6f0ed
author zalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1557959649 +0000
committer zalan@apple.com <zalan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1557959649 +0000

Do not create a shape object outside of the layout context
https://bugs.webkit.org/show_bug.cgi?id=197926
<rdar://problem/50627858>

Reviewed by Simon Fraser.

Source/WebCore:

ShapeOutside objects are used to compute line constrains during layout (in a strict sense, they are part of the layout context and should only be mutated during layout).
If we don't create one during layout, we probably don't need to know its geometry during paint (or any other non-layout activity) either.

Test: fast/block/float/float-with-shape-outside-crash.html

* rendering/FloatingObjects.cpp:
(WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
(WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
* rendering/shapes/ShapeOutsideInfo.cpp:
(WebCore::ShapeOutsideInfo::computeDeltasForContainingBlockLine):

LayoutTests:

* fast/block/float/float-with-shape-outside-crash-expected.txt: Added.
* fast/block/float/float-with-shape-outside-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@245361 268f45cc-cd09-0410-ab3c-d52691b4dbfc