Title: [270428] trunk
- Revision
- 270428
- Author
- [email protected]
- Date
- 2020-12-04 05:35:23 -0800 (Fri, 04 Dec 2020)
Log Message
Web process assert when loading slack
https://bugs.webkit.org/show_bug.cgi?id=219079
<rdar://problem/71814675>
Reviewed by Antti Koivisto.
Source/WebCore:
While some display types do not make too much sense on replaced elements, Box::isInlineLevelBox should
return true for all of them.
Test: fast/inline/inline-flex-on-replaced-crash.html
* layout/layouttree/LayoutBox.cpp:
(WebCore::Layout::Box::isInlineLevelBox const):
LayoutTests:
* fast/inline/inline-flex-on-replaced-crash-expected.txt: Added.
* fast/inline/inline-flex-on-replaced-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (270427 => 270428)
--- trunk/LayoutTests/ChangeLog 2020-12-04 12:26:38 UTC (rev 270427)
+++ trunk/LayoutTests/ChangeLog 2020-12-04 13:35:23 UTC (rev 270428)
@@ -1,3 +1,14 @@
+2020-12-04 Zalan Bujtas <[email protected]>
+
+ Web process assert when loading slack
+ https://bugs.webkit.org/show_bug.cgi?id=219079
+ <rdar://problem/71814675>
+
+ Reviewed by Antti Koivisto.
+
+ * fast/inline/inline-flex-on-replaced-crash-expected.txt: Added.
+ * fast/inline/inline-flex-on-replaced-crash.html: Added.
+
2020-12-04 Rob Buis <[email protected]>
WebGL2: Null pointer dereference in std::string implementation in gl::Shader::getTransformFeedbackVaryingMappedName
Added: trunk/LayoutTests/fast/inline/inline-flex-on-replaced-crash-expected.txt (0 => 270428)
--- trunk/LayoutTests/fast/inline/inline-flex-on-replaced-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/inline/inline-flex-on-replaced-crash-expected.txt 2020-12-04 13:35:23 UTC (rev 270428)
@@ -0,0 +1,2 @@
+PASS if no crash or ASSERT
+
Added: trunk/LayoutTests/fast/inline/inline-flex-on-replaced-crash.html (0 => 270428)
--- trunk/LayoutTests/fast/inline/inline-flex-on-replaced-crash.html (rev 0)
+++ trunk/LayoutTests/fast/inline/inline-flex-on-replaced-crash.html 2020-12-04 13:35:23 UTC (rev 270428)
@@ -0,0 +1,6 @@
+PASS if no crash or ASSERT
+<div><img style="width: 100px; height: 100px; display: inline-flex; background-color: green"></div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+</script>
\ No newline at end of file
Modified: trunk/Source/WebCore/ChangeLog (270427 => 270428)
--- trunk/Source/WebCore/ChangeLog 2020-12-04 12:26:38 UTC (rev 270427)
+++ trunk/Source/WebCore/ChangeLog 2020-12-04 13:35:23 UTC (rev 270428)
@@ -1,5 +1,21 @@
2020-12-04 Zalan Bujtas <[email protected]>
+ Web process assert when loading slack
+ https://bugs.webkit.org/show_bug.cgi?id=219079
+ <rdar://problem/71814675>
+
+ Reviewed by Antti Koivisto.
+
+ While some display types do not make too much sense on replaced elements, Box::isInlineLevelBox should
+ return true for all of them.
+
+ Test: fast/inline/inline-flex-on-replaced-crash.html
+
+ * layout/layouttree/LayoutBox.cpp:
+ (WebCore::Layout::Box::isInlineLevelBox const):
+
+2020-12-04 Zalan Bujtas <[email protected]>
+
[LFC][IFC] Decouple inline content and float handling in LineBuilder
https://bugs.webkit.org/show_bug.cgi?id=219522
Modified: trunk/Source/WebCore/layout/layouttree/LayoutBox.cpp (270427 => 270428)
--- trunk/Source/WebCore/layout/layouttree/LayoutBox.cpp 2020-12-04 12:26:38 UTC (rev 270427)
+++ trunk/Source/WebCore/layout/layouttree/LayoutBox.cpp 2020-12-04 13:35:23 UTC (rev 270428)
@@ -308,7 +308,12 @@
{
// Inline level elements generate inline level boxes.
auto display = m_style.display();
- return display == DisplayType::Inline || isInlineBlockBox() || isInlineTableBox();
+ return display == DisplayType::Inline
+ || display == DisplayType::InlineFlex
+ || display == DisplayType::WebKitInlineFlex
+ || display == DisplayType::InlineGrid
+ || isInlineBlockBox()
+ || isInlineTableBox();
}
bool Box::isInlineBox() const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
