[Webkit-unassigned] [Bug 259243] New: ASSERTION FAILED: formattingContextRoot.hasChild() when flex item contains certain inline child

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=259243

            Bug ID: 259243
           Summary: ASSERTION FAILED: formattingContextRoot.hasChild()
                    when flex item contains certain inline child
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: bunnnywong at gmail.com
                CC: bfulgham at webkit.org, simon.fraser at apple.com,
                    zalan at apple.com

Created attachment 467050

  --> https://bugs.webkit.org/attachment.cgi?id=467050&action=review

A case to reproduce this assertion

When both IFC and FFC enabled, `ASSERT(formattingContextRoot.hasChild())` at `FormattingContext::FormattingContext(const ElementBox&, FormattingState&)` triggers when the flex item contains certain inline child.

One of my pages triggers this assertion while debugging, which could be simplified into the attached reproducible case.

I believe this issue is different from [the previous bug](https://bugs.webkit.org/show_bug.cgi?id=257802).

For the attached case, `LayoutIntegration::LineLayout` was first created from `RenderBlockFlow::tryComputePreferredWidthsUsingModernPath`. Then comes to laying out the flexbox, which creates `LayoutIntegration::FlexLayout` and replaces the inline renderer's layout box while building the new tree. When it comes to `RenderBlockFlow::layoutModernLines`, the wrong box was used.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230715/2abf1ebe/attachment.htm>