[webkit-changes] [WebKit/WebKit] 02bb8a: Make sure child is a RenderElement before trying t...

[Sammy Gill]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 02bb8ae9d5735cb1a73164b46be85937d254dde0
      https://github.com/WebKit/WebKit/commit/02bb8ae9d5735cb1a73164b46be85937d254dde0
  Author: Sammy Gill <sammy.gill at apple.com>
  Date:   2023-03-02 (Thu, 02 Mar 2023)

  Changed paths:
    M LayoutTests/TestExpectations
    A LayoutTests/fast/editing/ruby-with-edited-text-crash-expected.txt
    A LayoutTests/fast/editing/ruby-with-edited-text-crash.html
    M Source/WebCore/rendering/RenderBlock.cpp

  Log Message:
  -----------
  Make sure child is a RenderElement before trying to pass it into shouldChildInlineMarginContributeToContainerIntrinsicSize in RenderBlock::computeBlockPreferredLogicalWidths
https://bugs.webkit.org/show_bug.cgi?id=253165
rdar://105848359

Reviewed by Alan Baradlay.

We should not be assuming that child is always doing to be a
RenderElement in this method. It can sometimes be a RenderText (like
in the attached test case), which will cause a nullptr dereference.
Instead, we should check the result of the dynamicDowncast before
passing it into shouldChildInlineMarginContributeToContainerIntrinsicSize.

The only other change is that we use the default constructor for
startMarginLength and endMarginLength. This should be ok even if we do
not enter the code guarded by the if statement because the isFixed()
call will return false and not impact the margins.

* LayoutTests/TestExpectations:
* LayoutTests/fast/editing/ruby-with-edited-text-crash-expected.txt: Added.
* LayoutTests/fast/editing/ruby-with-edited-text-crash.html: Added.
* Source/WebCore/rendering/RenderBlock.cpp:
(WebCore::RenderBlock::computeBlockPreferredLogicalWidths const):

Canonical link: https://commits.webkit.org/261063@main