[webkit-changes] [WebKit/WebKit] 1bfbaa: [IFC][Integration] Unexpected render tree state ma...

[Alan Baradlay]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 1bfbaa14e8a8c98aa764032dd6fe10c1fa982e82
      https://github.com/WebKit/WebKit/commit/1bfbaa14e8a8c98aa764032dd6fe10c1fa982e82
  Author: Alan Baradlay <zalan at apple.com>
  Date:   2024-02-08 (Thu, 08 Feb 2024)

  Changed paths:
    M LayoutTests/TestExpectations
    A LayoutTests/fast/misc/out-of-flow-position-inside-mathml-crash-expected.txt
    A LayoutTests/fast/misc/out-of-flow-position-inside-mathml-crash.html
    M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp
    M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h
    M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp
    M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h
    M Source/WebCore/rendering/RenderInline.cpp

  Log Message:
  -----------
  [IFC][Integration] Unexpected render tree state may lead to querying nonexistent box geometry
https://bugs.webkit.org/show_bug.cgi?id=269009
<rdar://122491690>

Reviewed by Antti Koivisto.

This patch handles the case when the render tree gets into an unexpected state (dirty subtree after layout) and
DOM queries for geometry of a renderer in this dirty subtree.

* LayoutTests/TestExpectations:
* LayoutTests/fast/misc/out-of-flow-position-inside-mathml-crash-expected.txt: Added.
* LayoutTests/fast/misc/out-of-flow-position-inside-mathml-crash.html: Added.
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp:
(WebCore::LayoutIntegration::BoxTree::contains const):
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h:
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:
(WebCore::LayoutIntegration::LineLayout::contains const):
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h:
* Source/WebCore/rendering/RenderInline.cpp:
(WebCore::RenderInline::linesBoundingBox const):

Canonical link: https://commits.webkit.org/274318@main