[webkit-changes] [WebKit/WebKit] 364ff5: RenderListMarker may incorrectly turn into a float...

[Alan Baradlay]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 364ff5daa35f17b902967c8340c4e9b8f4cb0065
      https://github.com/WebKit/WebKit/commit/364ff5daa35f17b902967c8340c4e9b8f4cb0065
  Author: Alan Baradlay <zalan at apple.com>
  Date:   2025-02-08 (Sat, 08 Feb 2025)

  Changed paths:
    M LayoutTests/TestExpectations
    A LayoutTests/fast/inline/list-marker-float-crash-expected.txt
    A LayoutTests/fast/inline/list-marker-float-crash.html
    M Source/WebCore/layout/integration/LayoutIntegrationCoverage.cpp

  Log Message:
  -----------
  RenderListMarker may incorrectly turn into a float box
https://bugs.webkit.org/show_bug.cgi?id=287312

Reviewed by Antti Koivisto.

RenderListMarker is supposed to always be in-flow but let's make this code more robust by
not just relying on the type of the renderer.

* LayoutTests/fast/inline/list-marker-float-crash-expected.txt: Added.
* LayoutTests/fast/inline/list-marker-float-crash.html: Added.
* Source/WebCore/layout/integration/LayoutIntegrationCoverage.cpp:
(WebCore::LayoutIntegration::canUseForPreferredWidthComputation): IFC's intrinsic width
computation supports in-flow content only (e.g. no floats).

Canonical link: https://commits.webkit.org/290087@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications