[webkit-changes] [WebKit/WebKit] f9f41e: Safari crashes on knowyourmeme.com/memes/oh-the-hu...

[Alan Baradlay]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: f9f41e5b4d58c395055ee560636fd9dfd801d50b
      https://github.com/WebKit/WebKit/commit/f9f41e5b4d58c395055ee560636fd9dfd801d50b
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2022-10-14 (Fri, 14 Oct 2022)

  Changed paths:
    A LayoutTests/fast/block/out-of-flow-becomes-float-crash-expected.txt
    A LayoutTests/fast/block/out-of-flow-becomes-float-crash.html
    M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp

  Log Message:
  -----------
  Safari crashes on knowyourmeme.com/memes/oh-the-huge-manatee
https://bugs.webkit.org/show_bug.cgi?id=246481
<rdar://100914598>

Reviewed by Antti Koivisto.

This patch enables style update on the layout boxes when the renderer is floating/out-of-flow.
It ensures that the layout box and the associated render stay in sync.
(out of sync style could lead to an unexpected state where IFC integration layer (incorrectly)
assumes that the renderer tree has certain properties (e.g. layer)).

* LayoutTests/fast/block/out-of-flow-becomes-float-crash-expected.txt: Added.
* LayoutTests/fast/block/out-of-flow-becomes-float-crash.html: Added.
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:
(WebCore::LayoutIntegration::LineLayout::containing):

Canonical link: https://commits.webkit.org/255531@main