Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5001e0ea367f78e2978504689fcf4dbe578c101a
https://github.com/WebKit/WebKit/commit/5001e0ea367f78e2978504689fcf4dbe578c101a
Author: Alan Baradlay <[email protected]>
Date: 2024-04-03 (Wed, 03 Apr 2024)
Changed paths:
M LayoutTests/TestExpectations
A LayoutTests/fast/text/remove-renderer-and-select-crash-expected.txt
A LayoutTests/fast/text/remove-renderer-and-select-crash.html
M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp
M Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h
M Source/WebCore/layout/integration/inline/InlineIteratorBox.cpp
M Source/WebCore/layout/integration/inline/InlineIteratorBox.h
M Source/WebCore/layout/integration/inline/InlineIteratorBoxLegacyPath.h
M Source/WebCore/layout/integration/inline/InlineIteratorBoxModernPath.h
M
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.cpp
M Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.h
M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp
M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h
Log Message:
-----------
[IFC][Integration] RELEASE_ASSERT() under
LayoutIntegration::BoxTree::rendererForLayoutBox
https://bugs.webkit.org/show_bug.cgi?id=271908
<rdar://125580307>
Reviewed by Antti Koivisto.
1. IFC produces display boxes. BoxTree contains all the layout boxes as well as
a map to find associated renders.
2. Content mutation destroys a renderer
- IFC invalidates the relevant lines and detaches the layout box
However we keep the layout box around until after the next layout when the
associated display boxes get invalidated as well.
3. While display box should be self contained, we consult the renderer for
selection state (not on the display box).
-> RELEASE_ASSERT.
This is a temporary fix until after we either keep the associated renderer
alive (like we do with the layout box) or transfer all states to display box
so that we don't need to talk to the renderer anymore).
* LayoutTests/TestExpectations:
* LayoutTests/fast/text/remove-renderer-and-select-crash-expected.txt: Added.
* LayoutTests/fast/text/remove-renderer-and-select-crash.html: Added.
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.cpp:
(WebCore::LayoutIntegration::BoxTree::hasRendererForLayoutBox const):
* Source/WebCore/layout/integration/LayoutIntegrationBoxTree.h:
* Source/WebCore/layout/integration/inline/InlineIteratorBox.cpp:
(WebCore::InlineIterator::Box::selectionState const):
* Source/WebCore/layout/integration/inline/InlineIteratorBox.h:
(WebCore::InlineIterator::Box::hasRenderer const):
* Source/WebCore/layout/integration/inline/InlineIteratorBoxLegacyPath.h:
(WebCore::InlineIterator::BoxLegacyPath::hasRenderer const):
* Source/WebCore/layout/integration/inline/InlineIteratorBoxModernPath.h:
(WebCore::InlineIterator::BoxModernPath::hasRenderer const):
* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.cpp:
(WebCore::LayoutIntegration::InlineContent::hasRendererForLayoutBox const):
* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.h:
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:
(WebCore::LayoutIntegration::LineLayout::hasRendererForLayoutBox const):
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h:
Canonical link: https://commits.webkit.org/277009@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
