Clear sibling floats while splitting inline flow.

Clear sibling floats while splitting inline flow.

During RenderInline::splitFlow(), floats are cleared on an anonymous containingBlock() for
the inline being split. This is a problem if siblings of the block contain references to
the same floats, since the float removal code in markSiblingsWithFloatsForLayout() will not
later find them.

R=inferno@chromium.org
BUG=245727
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=169658

[kenrb, 2014-03-18 17:39:13]

inferno: PTAL?

The try servers aren't being very helpful today but things tested okay locally.

[aarya, 2014-03-18 17:45:44]

Good catch, lgtm!

https://codereview.chromium.org/203483002/diff/1/LayoutTests/fast/block/float...
File LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html
(right):

https://codereview.chromium.org/203483002/diff/1/LayoutTests/fast/block/float...
LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html:17:
setTimeout("CFcrash()", 1);
Is this timeout really required ? can you try with offsettop to force layout ?
that way we get rid of the notifydones and waituntildones :)

[inferno, 2014-03-18 17:46:49]

i meant to lgtm from inferno@ acc, not my google acc.

[kenrb, 2014-03-18 18:00:20]

https://codereview.chromium.org/203483002/diff/1/LayoutTests/fast/block/float...
File LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html
(right):

https://codereview.chromium.org/203483002/diff/1/LayoutTests/fast/block/float...
LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html:17:
setTimeout("CFcrash()", 1);
On 2014/03/18 17:45:44, aarya wrote:
> Is this timeout really required ? can you try with offsettop to force layout ?
> that way we get rid of the notifydones and waituntildones :)

I tried that, but the UAF no longer reproduced, and I couldn't figure out why.
The timeout value is irrelevant, but pulling the code into a single function and
replacing setTimeout() with document.body.offsetTop for some reason broke the
test case. In general the test was hard to simplify, I think mostly because you
have to get the float overhangs right.

[kenrb, 2014-03-18 18:35:53]

The CQ bit was checked by kenrb@chromium.org

[commit-bot: I haz the power, 2014-03-18 18:35:57]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/kenrb@chromium.org/203483002/1

[commit-bot: I haz the power, 2014-03-18 23:20:56]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-03-18 23:20:57]

Commit queue rejected this change because the description was changed
between the time the change entered the commit queue and the time it
was ready to commit. You can safely check the commit box again.

[kenrb, 2014-03-19 14:05:13]

The CQ bit was checked by kenrb@chromium.org

[commit-bot: I haz the power, 2014-03-19 14:05:22]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/kenrb@chromium.org/203483002/1

[kenrb, 2014-03-20 14:26:35]

The CQ bit was checked by kenrb@chromium.org

[commit-bot: I haz the power, 2014-03-20 14:26:43]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/kenrb@chromium.org/203483002/20001

[commit-bot: I haz the power, 2014-03-20 15:27:46]

Change committed as 169658