[webkit-changes] [WebKit/WebKit] bfb351: MathML does not always handle positioned objects c...

[Rob Buis]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: bfb351d566adfd5ce86790787dc63a31c70ed041
      https://github.com/WebKit/WebKit/commit/bfb351d566adfd5ce86790787dc63a31c70ed041
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2024-01-26 (Fri, 26 Jan 2024)

  Changed paths:
    A LayoutTests/mathml/operator-append-fixed-container-svg-crash-expected.txt
    A LayoutTests/mathml/operator-append-fixed-container-svg-crash.html
    A LayoutTests/mathml/token-append-fixed-container-svg-crash-expected.txt
    A LayoutTests/mathml/token-append-fixed-container-svg-crash.html
    M Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp
    M Source/WebCore/rendering/mathml/RenderMathMLToken.cpp

  Log Message:
  -----------
  MathML does not always handle positioned objects correctly
https://bugs.webkit.org/show_bug.cgi?id=264636
rdar://116448289

Reviewed by Alan Baradlay.

For mo/mi elements positioned objects are not laid out at all so in this
case after layout the tree is still dirty. Fix this by calling layoutPositionedObjects
for tokens and operators.

* LayoutTests/mathml/operator-append-fixed-container-svg-crash-expected.txt: Added.
* LayoutTests/mathml/operator-append-fixed-container-svg-crash.html: Added.
* LayoutTests/mathml/token-append-fixed-container-svg-crash-expected.txt: Added.
* LayoutTests/mathml/token-append-fixed-container-svg-crash.html: Added.
* Source/WTF/wtf/Assertions.cpp:
* Source/WebCore/rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::layoutBlock):
* Source/WebCore/rendering/mathml/RenderMathMLToken.cpp:
(WebCore::RenderMathMLToken::layoutBlock):

Originally-landed-as: 270734.4 at webkit-2023.11-embargoed (f765915efb81). rdar://121480773
Canonical link: https://commits.webkit.org/273555@main