Cherry-pick 259548.835@safari-7615-branch (b63d456). https://bugs.webkit.org/show_bug.cgi?id=257509

    Crash in GridBaselineAlignment::baselineGroupForChild
    https://bugs.webkit.org/show_bug.cgi?id=257509
    rdar://110027455

    Reviewed by Alan Baradlay.

    Certain baseline properties are not properly handled in CSS Masonry.
    We will just disable these calculations for now and then remove this in the future.

    * LayoutTests/fast/css-grid-layout/baseline-masonry-crash-expected.html: Added.
    * LayoutTests/fast/css-grid-layout/baseline-masonry-crash.html: Added.
    * Source/WebCore/rendering/RenderGrid.cpp:
    (WebCore::RenderGrid::columnAxisBaselineOffsetForChild const):
    (WebCore::RenderGrid::rowAxisBaselineOffsetForChild const):

    Canonical link: https://commits.webkit.org/259548.835@safari-7615-branch

Author: stwrt

LayoutTests/fast/css-grid-layout/baseline-masonry-crash-expected.html

@@ -0,0 +1,15 @@
+<style>
+grid {
+  display: inline-grid;
+  grid-template-columns: auto;
+  grid-template-rows: repeat(4,auto);
+}
+</style>
+
+<p>This test passes if it does not crash.</p>
+
+<grid>
+  <<item>3</item>/item>
+  <item>4</item>
+  <item style="-webkit-align-self: baseline;">
+</grid>

LayoutTests/fast/css-grid-layout/baseline-masonry-crash.html

@@ -0,0 +1,15 @@
+<style>
+grid {
+  display: inline-grid;
+  grid-template-columns: masonry;
+  grid-template-rows: repeat(4,auto);
+}
+</style>
+
+<p>This test passes if it does not crash.</p>
+
+<grid>
+  <<item>3</item>/item>
+  <item>4</item>
+  <item style="-webkit-align-self: baseline;">
+</grid>

Source/WebCore/rendering/RenderGrid.cpp

@@ -1817,6 +1817,11 @@ std::optional<LayoutUnit> RenderGrid::inlineBlockBaseline(LineDirectionMode) con
 
 LayoutUnit RenderGrid::columnAxisBaselineOffsetForChild(const RenderBox& child) const
 {
+    // FIXME : CSS Masonry does not properly handle baseline calculations currently.
+    // We will just skip this running this step if we detect the RenderGrid is Masonry for now.
+    if (isMasonry())
+        return LayoutUnit { };
+
     if (isSubgridRows()) {
         RenderGrid* outer = downcast<RenderGrid>(parent());
         if (GridLayoutFunctions::isOrthogonalChild(*outer, *this))
@@ -1828,6 +1833,11 @@ LayoutUnit RenderGrid::columnAxisBaselineOffsetForChild(const RenderBox& child)
 
 LayoutUnit RenderGrid::rowAxisBaselineOffsetForChild(const RenderBox& child) const
 {
+    // FIXME : CSS Masonry does not properly handle baseline calculations currently.
+    // We will just skip this running this step if we detect the RenderGrid is Masonry for now.
+    if (isMasonry())
+        return LayoutUnit { };
+
     if (isSubgridColumns()) {
         RenderGrid* outer = downcast<RenderGrid>(parent());
         if (GridLayoutFunctions::isOrthogonalChild(*outer, *this))