Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 93c83d4ce552e5c0cc78642badc2b95129d19be8
https://github.com/WebKit/WebKit/commit/93c83d4ce552e5c0cc78642badc2b95129d19be8
Author: Claudio Saavedra <[email protected]>
Date: 2026-08-31 (Mon, 31 Aug 2026)
Changed paths:
M Source/WebCore/rendering/RenderBlockFlow.cpp
Log Message:
-----------
REGRESSION(320127@main): ASSERTION FAILED:
!m_previousInlineLayoutContentTopAndBottomIncludingInkOverflow in
RenderBlockFlow::invalidateLineLayout
https://bugs.webkit.org/show_bug.cgi?id=322982
Reviewed by Alan Baradlay.
Since 320127@main the marker text and margin update runs from the render
tree update commit rather than from layout. Updating the margins reads the
marker's min-content width contribution, and computing that instantiates a
fresh, content-free inline layout on the marker's content container
(tryComputeIntrinsicLogicalWidthsUsingInlinePath). The block may still hold
the content extent snapshot recorded when an earlier invalidation destroyed
its line layout, since only the next inline layout consumes it, so a
subsequent invalidateLineLayout() finds both an inline layout and a pending
snapshot and fails the assertion.
Keep the earliest snapshot instead of asserting there is none: it is the
extent the next layout needs to repaint, and it is what release builds
already did, as inlineContentTopAndBottomIncludingInkOverflow() returns the
stored value when one is set.
Covered by imported/w3c/web-platform-tests/css/css-pseudo/parsing/
marker-supported-properties.html and
marker-supported-properties-in-animation.html,
which crash without this.
* Source/WebCore/rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::invalidateLineLayout):
Canonical link: https://commits.webkit.org/320161@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
