[Webkit-unassigned] [Bug 178865] ASSERTION FAILED: !renderer->needsLayout() in WebCore::RenderBlock::checkPositionedObjectsNeedLayout with MathML

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=178865

--- Comment #2 from Frédéric Wang (:fredw) <fred.wang at free.fr> ---
Created attachment 326976

  --> https://bugs.webkit.org/attachment.cgi?id=326976&action=review

Patch (WIP)

I discussed that a bit with rego, and the absolutely-positioned HTML element is not a child of the MathML element so the crash is actually not due to how RenderMathMLRow::layoutRowItems performs

        if (child->isOutOfFlowPositioned()) {
            child->containingBlock()->insertPositionedObject(*child);
            continue;
        }

However, a similar insertPositionedObject call should happen inside the HTML renderers. And because of the CSS transform on it, the <math> element becomes the containing block of the absolutely-positioned HTML element and hence must call layoutPositionedObjects(). The attached patch does that and addresses the case reported here.

This is still WIP, we need to:

1) Call layoutPositionedObjects() in other MathML layout functions. For example the ASSERT will also happen with

      <math>
        <mtext style="position: relative">
          <span>
            <span style="position: absolute">X</span>
          </span>
        </mtext>
      </math>

2) Maybe call insertPositionedObject in other MathML layout functions too (probably a edge cases and not really important, for example Firefox does not handle that correctly either). For example compare the position of A and B in

      <math>
        <mtext style="position: absolute; left: 100px; top: 100px;">A</mtext>
        <mfrac>
          <mtext style="position: absolute; left: 100px; top: 100px;">B</mtext>
          <mtext></mtext>
        </mfrac>
      </math>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171115/5f079b1e/attachment-0001.html>