The linked page essentially hangs WebKit (and thus Safari 4 beta and Chromium) indefinitely. Profiling reveals that WebCore::RenderBlock::layout() and children are taking an extremely long time. The dom looks like this: <body> <ol> <li> <div style="float:left"> <img height='64' width='64' /> </div> <div style="clear:both;" /> </li> </ol> </body> Replicate the <li> to see the growth in time. Here's the layout time against # of <li>s on my machine: # of <li>s | layout time (ms) -----------+----------------- 4 | 4 6 | 11 8 | 42 10 | 171 12 | 678 14 | 2712 16 | 176319
Created attachment 28018 [details] reduction (takes ~2000ms to layout) This testcase has 16 <li> nodes and takes about 2000ms to lay out on my machine. It renders ~instantly on FF3.0
Created attachment 28239 [details] reduction (takes ~15s to layout) The dom structure is: <div style="float:left"> <img height='64' width='64'> </div> <div style="clear:both;"> <div style="float:left"> <img height='64' width='64'> </div> <div style="clear:both;"> ... repeat Nesting more deeply triggers exponential behavior.
Created attachment 28241 [details] Patch to fix bug This patch changes our yPosEstimate when doing block layout to factor in clear. It also gets rid of the early adjustment of the y-position of the child prior to clearing, thus saving a redundant layout delta application (and a redundant layout when a clear is just going to happen anyway later).
This patch fails 3 layout tests, so I will need to study those.
The following tests fail: fast/block/float/t0905-c414-flt-fit-01-d-g.html fast/block/float/t0905-c5525-fltblck-00-d-ag.html fast/block/float/t0905-c5526-flthw-00-c-g.html
Looks like these test cases are failing on the buildbot, so this patch actually works.
Created attachment 28244 [details] Patch to fix bug
Note, the bug reporter will probably want to file a followup about the fact that the page renders incorrectly (because of </li> not closing up the inner divs).
Comment on attachment 28244 [details] Patch to fix bug Wow. You're leaving me no choice but to pick nits: > + if (child->shrinkToAvoidFloats()) > + // The child's width depends on the line width. > + // When the child shifts to clear an item, its width can > + // change (because it has more available line width). > + // So go ahead and mark the item as dirty. > + child->setChildNeedsLayout(true, false); Need braces around this multi-line if block. > + Test case for https://bugs.webkit.org/attachment.cgi?id=28239 Should link to the bug, not to the attachment. r=me!
(In reply to comment #8) > Note, the bug reporter will probably want to file a followup about the fact > that the page renders incorrectly (because of </li> not closing up the inner > divs). I think that's bug 14939. And I think bug 21469 may be a duplicate of this bug.
(In reply to comment #10) > (In reply to comment #8) > > Note, the bug reporter will probably want to file a followup about the fact > > that the page renders incorrectly (because of </li> not closing up the inner > > divs). > > I think that's bug 14939. And I think bug 21469 may be a duplicate of this bug. > I filed 24338 for the </li> not closing inner divs issue along with </dd> and </dt>. Bug 14939 is a less-specific duplicate. Bug 21469 is a duplicate of this bug.
Fixed in r41422.
*** Bug 21469 has been marked as a duplicate of this bug. ***
*** Bug 23013 has been marked as a duplicate of this bug. ***