Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ca4898717f9ef1d797d2ae43e057050a973469bf
https://github.com/WebKit/WebKit/commit/ca4898717f9ef1d797d2ae43e057050a973469bf
Author: Antti Koivisto <[email protected]>
Date: 2022-10-06 (Thu, 06 Oct 2022)
Changed paths:
A LayoutTests/fast/inline/fieldset-inline-crash-expected.txt
A LayoutTests/fast/inline/fieldset-inline-crash.html
M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp
M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h
Log Message:
-----------
REGRESSION(254755@main): Release assert in
LayoutIntegration::BoxTree::rendererForLayoutBox with <fieldset>
https://bugs.webkit.org/show_bug.cgi?id=246139
rdar://100493284
Reviewed by Alan Bujtas.
<fieldset style="display:inline"> creates a RenderBlockFlow with
display:inline. We need to treat it as inline-block
to avoid breaking assumptions.
* Source/LayoutTests/fast/inline/fieldset-inline-crash-expected.txt: Added.
* Source/LayoutTests/fast/inline/fieldset-inline-crash.html: Added.
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp:
(WebCore::LayoutIntegration::BoxTree::BoxTree):
(WebCore::LayoutIntegration::BoxTree::adjustStyleIfNeeded):
(WebCore::LayoutIntegration::BoxTree::createLayoutBox):
Fix by refactoring layout box construction into a function and using it
consistently also for the formatting context root box.
(WebCore::LayoutIntegration::BoxTree::buildTreeForInlineContent):
(WebCore::LayoutIntegration::BoxTree::updateStyle):
(WebCore::LayoutIntegration::rootBoxStyle): Deleted.
(WebCore::LayoutIntegration::adjustStyleIfNeeded): Deleted.
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h:
Canonical link: https://commits.webkit.org/255240@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
