Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: f20a3ce20e867a081396437e684de72bf8d52320
      
https://github.com/WebKit/WebKit/commit/f20a3ce20e867a081396437e684de72bf8d52320
  Author: Matt Woodrow <[email protected]>
  Date:   2023-09-22 (Fri, 22 Sep 2023)

  Changed paths:
    A 
LayoutTests/compositing/geometry/geometry-map-compositing-layer-without-containing-block-expected.html
    A 
LayoutTests/compositing/geometry/geometry-map-compositing-layer-without-containing-block.html
    M LayoutTests/platform/mac-wk2/TestExpectations
    M Source/WebCore/rendering/RenderGeometryMap.cpp

  Log Message:
  -----------
  ASSERTION FAILED: foundContainer on 
media/modern-media-controls/pip-support/pip-support-click.html.
https://bugs.webkit.org/show_bug.cgi?id=258325
<rdar://111065468>

Reviewed by Simon Fraser.

Running layout for a subtree calls RenderGeometryMap::pushMappingsToAncestor 
with a nullptr ancestor layer to push
all the mappings up to the RenderView. Since we don't have an ancestor layer, 
we instead walk up the render tree.

The render tree container walk can jump over repaint containers (see 
containerForElement in RenderObject.cpp) to
the nearest containing block ancestor.

The expected behaviour for pushMappingsToAncestor is that the ancestor layer 
provided is the nearest repaint container,
so that any render tree walk with be bounded by that. In this case we don't 
have one, so we fail to push mappings for
repaint containers in some cases and then crash when trying to find them later.

This adds code for the nullptr case, and breaks the render tree walk down into 
per-layer-ancestor chunks to prevent
this.

Also adds a test that crashes without the fix.

* 
LayoutTests/compositing/geometry/geometry-map-compositing-layer-without-containing-block-expected.html:
 Added.
* 
LayoutTests/compositing/geometry/geometry-map-compositing-layer-without-containing-block.html:
 Added.
* LayoutTests/platform/mac-wk2/TestExpectations:
* Source/WebCore/rendering/RenderGeometryMap.cpp:
(WebCore::RenderGeometryMap::pushMappingsToAncestor):

Canonical link: https://commits.webkit.org/268304@main


_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to