[webkit-changes] [WebKit/WebKit] ca4898: REGRESSION(254755 at main): Release assert in LayoutI...
Antti Koivisto
noreply at github.com
Thu Oct 6 14:19:23 PDT 2022
Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ca4898717f9ef1d797d2ae43e057050a973469bf
https://github.com/WebKit/WebKit/commit/ca4898717f9ef1d797d2ae43e057050a973469bf
Author: Antti Koivisto <antti at apple.com>
Date: 2022-10-06 (Thu, 06 Oct 2022)
Changed paths:
A LayoutTests/fast/inline/fieldset-inline-crash-expected.txt
A LayoutTests/fast/inline/fieldset-inline-crash.html
M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp
M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h
Log Message:
-----------
REGRESSION(254755 at main): Release assert in LayoutIntegration::BoxTree::rendererForLayoutBox with <fieldset>
https://bugs.webkit.org/show_bug.cgi?id=246139
rdar://100493284
Reviewed by Alan Bujtas.
<fieldset style="display:inline"> creates a RenderBlockFlow with display:inline. We need to treat it as inline-block
to avoid breaking assumptions.
* Source/LayoutTests/fast/inline/fieldset-inline-crash-expected.txt: Added.
* Source/LayoutTests/fast/inline/fieldset-inline-crash.html: Added.
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp:
(WebCore::LayoutIntegration::BoxTree::BoxTree):
(WebCore::LayoutIntegration::BoxTree::adjustStyleIfNeeded):
(WebCore::LayoutIntegration::BoxTree::createLayoutBox):
Fix by refactoring layout box construction into a function and using it consistently also for the formatting context root box.
(WebCore::LayoutIntegration::BoxTree::buildTreeForInlineContent):
(WebCore::LayoutIntegration::BoxTree::updateStyle):
(WebCore::LayoutIntegration::rootBoxStyle): Deleted.
(WebCore::LayoutIntegration::adjustStyleIfNeeded): Deleted.
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h:
Canonical link: https://commits.webkit.org/255240@main
More information about the webkit-changes
mailing list