[IFC][Invalidation] Content inside SVG should not be considered part …

…of IFC content https://bugs.webkit.org/show_bug.cgi?id=261278 <rdar://114700736> Reviewed by Antti Koivisto. The containing block logic skips (inline) SVG root and comes back for content _inside_ SVG with a renderer that's also an IFC root. * LayoutTests/fast/inline/invalidation-crash-when-svg-is-present-expected.txt: Added. * LayoutTests/fast/inline/invalidation-crash-when-svg-is-present.html: Added. * Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp: (WebCore::LayoutIntegration::LineLayout::containing): Canonical link: https://commits.webkit.org/267737@main
WebKit · Sep 7, 2023 · 2f33925 · 2f33925
1 parent 3628406
commit 2f33925
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 1 deletion.
diff --git a/LayoutTests/fast/inline/invalidation-crash-when-svg-is-present-expected.txt b/LayoutTests/fast/inline/invalidation-crash-when-svg-is-present-expected.txt
@@ -0,0 +1 @@
+PASS if no crash or assert.
diff --git a/LayoutTests/fast/inline/invalidation-crash-when-svg-is-present.html b/LayoutTests/fast/inline/invalidation-crash-when-svg-is-present.html
@@ -0,0 +1,23 @@
+<style>
+text {
+  float: left;
+}
+
+:first-child {
+  color: red;
+}
+</style>
+<body>PASS if no crash or assert.</body>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+
+let svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+document.body.append(svg);
+let div = document.createElement('div');
+svg.append(div);
+svg.append(document.createElementNS('http://www.w3.org/2000/svg', 'text'));
+document.body.offsetTop;
+div.remove();
+</script>
+
diff --git a/Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp b/Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp
@@ -122,8 +122,13 @@ LineLayout* LineLayout::containing(RenderObject& renderer)
         return nullptr;
 
     if (!renderer.isInline()) {
-        // IFC may contain block level boxes (floats and out-of-flow boxes).
 
+        if (renderer.isRenderSVGBlock()) {
+            // SVG content inside svg root shows up as block (see RenderSVGBlock). We only support inline root svg as "atomic content".
+            return nullptr;
+        }
+
+        // IFC may contain block level boxes (floats and out-of-flow boxes).
         auto adjustedContainingBlock = [&] {
             RenderElement* containingBlock = nullptr;
             if (renderer.isOutOfFlowPositioned()) {