[webkit-changes] [WebKit/WebKit] 9d3c89: [IFC][Float] Incorrectly placed float boxes may ge...

[Alan Baradlay]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 9d3c89bfe30cee221fa647c3599cc8b0d033fbd5
      https://github.com/WebKit/WebKit/commit/9d3c89bfe30cee221fa647c3599cc8b0d033fbd5
  Author: Alan Baradlay <zalan at apple.com>
  Date:   2023-05-26 (Fri, 26 May 2023)

  Changed paths:
    M Source/WebCore/layout/formattingContexts/inline/InlineFormattingGeometry.cpp

  Log Message:
  -----------
  [IFC][Float] Incorrectly placed float boxes may generate series of empty lines
https://bugs.webkit.org/show_bug.cgi?id=257261
<rdar://108742128>

Reviewed by Antti Koivisto.

When intrusive floats prevent us from placing any content at the current vertical position,
the candidate position for the next line is computed by looking at such intrusive floats.
e.g.

  Two float boxes with the inline content of "foobar".

  _______    _______
 |       |  |       |
 | left  |  | right |
 |_______|  |       |
            |_______|

 1. "foobar" does not fit at y: 0 (overlaps "left").
 2. we find 2 intrusive floats at y: 0
 3. vertical position for next line is at the bottom of "left1"

This is rather simple, but if float placement bugs produce some vertical gaps between floats
e.g.

  _______    _______
 |       |  |       |
 | left1 |  | right |
 |_______|  |       |
            |_______|

  _______
 |       |
 | left2 |
 |_______|

 (note that left2 is supposed to be vertically adjacent to left1)

 Now if we run line layout:

 1. "foobar" does not fit at y: 0 -> vertical position for next line is at the bottom of "left1"
 2. "foobar" still does not fit (assume it overlaps "right") -> position for next line is at the bottom of "right"
 3. now assume that "foobar" is tall and it does not fit between the bottom of the "right" and the top of this incorrectly placed "left2"

  _______    _______
 |       |  |       |
 | left1 |  | right |
 |_______|  |       |
            |_______|
    ____
   |
   |___
  _|_____
 | |     |
 | |     |
 |_______|

 running "let's find the position for next line by avoiding intrusive floats" logic in InlineFormattingGeometry::logicalTopForNextLine()
 finds no intrusive float at the bottom of the "right" float (that's what #2 computed as candidate position).
 This is an unexpected state (we assert) and in order not to get stuck on the same vertical position we advance by 1px for the next line hoping we would be able to place "foobar" there.
 While it helps to avoid forever looping, if the gap between the bottom of the "right" and the top of the "left2" is
 wide we may end up producing thousands of empty lines until we reach the top of the "left2" float box and finally get out of this unexpected state.

In this patch, instead of advancing by 1px, we jump right to the bottom of the "left2" float box (bottom of all the floats in this floating context) and continue from there.

* Source/WebCore/layout/formattingContexts/inline/InlineFormattingGeometry.cpp:
(WebCore::Layout::InlineFormattingGeometry::logicalTopForNextLine const): move float handling to a helper (intrusiveFloatBottom) and return
the max of floatingContext.bottom() and lineLogicalRect.bottom().

Canonical link: https://commits.webkit.org/264579@main