Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: cf49d7e6190dbdb3c18feb908115a7b60b4a7540
https://github.com/WebKit/WebKit/commit/cf49d7e6190dbdb3c18feb908115a7b60b4a7540
Author: Alan Baradlay <[email protected]>
Date: 2026-01-16 (Fri, 16 Jan 2026)
Changed paths:
A
LayoutTests/fast/inline/trimmable-whitespace-after-block-inside-inline-box-crash-expected.txt
A
LayoutTests/fast/inline/trimmable-whitespace-after-block-inside-inline-box-crash.html
A
LayoutTests/platform/ios/fast/inline/trimmable-whitespace-after-block-inside-inline-box-crash-expected.txt
M Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp
Log Message:
-----------
Crash in Layout::Line::appendInlineBoxEnd;
Layout::LineBuilder::placeInlineAndFloatContent
https://bugs.webkit.org/show_bug.cgi?id=305619
<rdar://167370800>
Reviewed by Antti Koivisto.
After placing some contentful inline runs, we may discover that the current
line box needs to be adjusted
in the block direction due to margin collapsing (see blocks-in-inline).
When this happens, we:
1. Reset the line, removing all previously placed runs (which are all
non-contentful).
2, Adjust the line box in the block direction by the collapsed margin.
3. Commit the previous non-contentful content on the line.
4. Commit the current set of contentful runs, which may or may not fit anymore
due to floats.
e.g.
<div>
<span><div margin></div></span><span id=non-contentful> </span> content.
</div>
The previously placed (non-contentful) runs in step 3 should always fit on the
line, even after adjusting the line box rectangle in the block direction
To ensure this, call commitCandidateContent() instead of
applyLineBreakingOnCandidateInlineContent() so these runs always end up on the
line.
Test: fast/inline/trimmable-whitespace-after-block-inside-inline-box-crash.html
*
LayoutTests/fast/inline/trimmable-whitespace-after-block-inside-inline-box-crash-expected.txt:
Added.
*
LayoutTests/fast/inline/trimmable-whitespace-after-block-inside-inline-box-crash.html:
Added.
*
LayoutTests/platform/ios/fast/inline/trimmable-whitespace-after-block-inside-inline-box-crash-expected.txt:
Added.
* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:
(WebCore::Layout::LineBuilder::handleInlineContent): since
applyLineBreakingOnCandidateInlineContent() runs an available width check,
it may or may not commit the candidate content. In this case (incorrectly
computed) word-spacing prevents us from fitting the content on the
line.
Canonical link: https://commits.webkit.org/305713@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
