[webkit-changes] [WebKit/WebKit] ca4898: REGRESSION(254755 at main): Release assert in LayoutI...

Antti Koivisto noreply at github.com
Thu Oct 6 14:19:23 PDT 2022


  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ca4898717f9ef1d797d2ae43e057050a973469bf
      https://github.com/WebKit/WebKit/commit/ca4898717f9ef1d797d2ae43e057050a973469bf
  Author: Antti Koivisto <antti at apple.com>
  Date:   2022-10-06 (Thu, 06 Oct 2022)

  Changed paths:
    A LayoutTests/fast/inline/fieldset-inline-crash-expected.txt
    A LayoutTests/fast/inline/fieldset-inline-crash.html
    M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp
    M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h

  Log Message:
  -----------
  REGRESSION(254755 at main): Release assert in LayoutIntegration::BoxTree::rendererForLayoutBox with <fieldset>
https://bugs.webkit.org/show_bug.cgi?id=246139
rdar://100493284

Reviewed by Alan Bujtas.

<fieldset style="display:inline"> creates a RenderBlockFlow with display:inline. We need to treat it as inline-block
to avoid breaking assumptions.

* Source/LayoutTests/fast/inline/fieldset-inline-crash-expected.txt: Added.
* Source/LayoutTests/fast/inline/fieldset-inline-crash.html: Added.
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp:
(WebCore::LayoutIntegration::BoxTree::BoxTree):
(WebCore::LayoutIntegration::BoxTree::adjustStyleIfNeeded):
(WebCore::LayoutIntegration::BoxTree::createLayoutBox):

Fix by refactoring layout box construction into a function and using it consistently also for the formatting context root box.

(WebCore::LayoutIntegration::BoxTree::buildTreeForInlineContent):
(WebCore::LayoutIntegration::BoxTree::updateStyle):
(WebCore::LayoutIntegration::rootBoxStyle): Deleted.
(WebCore::LayoutIntegration::adjustStyleIfNeeded): Deleted.
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h:

Canonical link: https://commits.webkit.org/255240@main




More information about the webkit-changes mailing list