Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3e5ba1ef9b3e82a97859b55d6caf8a029a3b4fe2
https://github.com/WebKit/WebKit/commit/3e5ba1ef9b3e82a97859b55d6caf8a029a3b4fe2
Author: Antti Koivisto <[email protected]>
Date: 2026-10-05 (Mon, 05 Oct 2026)
Changed paths:
M Source/WebCore/layout/integration/inline/InlineIteratorSVGTextBox.cpp
M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp
M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h
M Source/WebCore/rendering/svg/RenderSVGInline.cpp
M Source/WebCore/rendering/svg/RenderSVGText.cpp
Log Message:
-----------
[IFC][SVG text] Fix crashes and bounds
https://bugs.webkit.org/show_bug.cgi?id=326335
rdar://189180530
Reviewed by Alan Baradlay.
With UseIFCForSVGText enabled, SVG hit testing crashed and SVG text was left
out of the bounds of its ancestors.
Also tspan getClientRects() returned nothing.
* Source/WebCore/layout/integration/inline/InlineIteratorSVGTextBox.cpp:
(WebCore::InlineIterator::lastBoxFor):
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:
(WebCore::LayoutIntegration::LineLayout::lastBox const):
(WebCore::LayoutIntegration::LineLayout::lastRootInlineBox const): Deleted.
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h:
lastRootInlineBox() wrapped the last display box, usually a text box, in an
InlineBoxIterator.
Reverse hit testing only needs the last box.
* Source/WebCore/rendering/svg/RenderSVGInline.cpp:
(WebCore::RenderSVGInline::absoluteQuads const):
Use InlineIterator instead of legacy line boxes.
* Source/WebCore/rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::isObjectBoundingBoxValid const):
This only tested for a legacy root box so the bounding box was always invalid
with IFC.
Canonical link: https://commits.webkit.org/322706@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
