[webkit-changes] [WebKit/WebKit] f20a3c: ASSERTION FAILED: foundContainer on media/modern-m...

[mattwoodrow]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: f20a3ce20e867a081396437e684de72bf8d52320
      https://github.com/WebKit/WebKit/commit/f20a3ce20e867a081396437e684de72bf8d52320
  Author: Matt Woodrow <mattwoodrow at apple.com>
  Date:   2023-09-22 (Fri, 22 Sep 2023)

  Changed paths:
    A LayoutTests/compositing/geometry/geometry-map-compositing-layer-without-containing-block-expected.html
    A LayoutTests/compositing/geometry/geometry-map-compositing-layer-without-containing-block.html
    M LayoutTests/platform/mac-wk2/TestExpectations
    M Source/WebCore/rendering/RenderGeometryMap.cpp

  Log Message:
  -----------
  ASSERTION FAILED: foundContainer on media/modern-media-controls/pip-support/pip-support-click.html.
https://bugs.webkit.org/show_bug.cgi?id=258325
<rdar://111065468>

Reviewed by Simon Fraser.

Running layout for a subtree calls RenderGeometryMap::pushMappingsToAncestor with a nullptr ancestor layer to push
all the mappings up to the RenderView. Since we don't have an ancestor layer, we instead walk up the render tree.

The render tree container walk can jump over repaint containers (see containerForElement in RenderObject.cpp) to
the nearest containing block ancestor.

The expected behaviour for pushMappingsToAncestor is that the ancestor layer provided is the nearest repaint container,
so that any render tree walk with be bounded by that. In this case we don't have one, so we fail to push mappings for
repaint containers in some cases and then crash when trying to find them later.

This adds code for the nullptr case, and breaks the render tree walk down into per-layer-ancestor chunks to prevent
this.

Also adds a test that crashes without the fix.

* LayoutTests/compositing/geometry/geometry-map-compositing-layer-without-containing-block-expected.html: Added.
* LayoutTests/compositing/geometry/geometry-map-compositing-layer-without-containing-block.html: Added.
* LayoutTests/platform/mac-wk2/TestExpectations:
* Source/WebCore/rendering/RenderGeometryMap.cpp:
(WebCore::RenderGeometryMap::pushMappingsToAncestor):

Canonical link: https://commits.webkit.org/268304@main