Input element with inherited display:ruby hits assert

https://bugs.webkit.org/show_bug.cgi?id=267130 rdar://120496475 Reviewed by Alan Baradlay. We only support ruby display types with ruby elements for now. They can be inherited to other elements though, leading to unexpected state. * LayoutTests/fast/ruby/input-with-inherited-ruby-display-expected.txt: Added. * LayoutTests/fast/ruby/input-with-inherited-ruby-display.html: Added. * Source/WebCore/style/StyleAdjuster.cpp: (WebCore::Style::hasUnsupportedRubyDisplay): (WebCore::Style::Adjuster::adjust const): Adjust the style to disallow non-ruby elements from having ruby display types. Canonical link: https://commits.webkit.org/272693@main
WebKit · Jan 5, 2024 · 4992ead · 4992ead
1 parent f089c38
commit 4992ead
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 0 deletions.
diff --git a/LayoutTests/fast/ruby/input-with-inherited-ruby-display-expected.txt b/LayoutTests/fast/ruby/input-with-inherited-ruby-display-expected.txt
@@ -0,0 +1 @@
+  This test passes if it doesn't crash.
diff --git a/LayoutTests/fast/ruby/input-with-inherited-ruby-display.html b/LayoutTests/fast/ruby/input-with-inherited-ruby-display.html
@@ -0,0 +1,10 @@
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>
+<style>
+input { display: inherit; }
+</style>
+<ruby>
+<input>
+This test passes if it doesn't crash.
diff --git a/Source/WebCore/style/StyleAdjuster.cpp b/Source/WebCore/style/StyleAdjuster.cpp
@@ -379,6 +379,23 @@ static bool isRubyContainerOrInternalRubyBox(const RenderStyle& style)
         || display == DisplayType::RubyBase;
 }
 
+static bool hasUnsupportedRubyDisplay(DisplayType display, const Element* element)
+{
+    // Only allow ruby elements to have ruby display types for now.
+    switch (display) {
+    case DisplayType::Ruby:
+    case DisplayType::RubyBlock:
+        return !element || !element->hasTagName(rubyTag);
+    case DisplayType::RubyAnnotation:
+        return !element || !element->hasTagName(rtTag);
+    case DisplayType::RubyBase:
+        ASSERT_NOT_REACHED();
+        return false;
+    default:
+        return false;
+    }
+}
+
 // https://drafts.csswg.org/css-ruby-1/#bidi
 static UnicodeBidi forceBidiIsolationForRuby(UnicodeBidi unicodeBidi)
 {
@@ -425,6 +442,9 @@ void Adjuster::adjust(RenderStyle& style, const RenderStyle* userAgentAppearance
                 style.setEffectiveDisplay(equivalentBlockDisplay(style));
         }
 
+        if (hasUnsupportedRubyDisplay(style.display(), m_element))
+            style.setEffectiveDisplay(style.display() == DisplayType::RubyBlock ? DisplayType::Block : DisplayType::Inline);
+
         // Top layer elements are always position: absolute; unless the position is set to fixed.
         // https://fullscreen.spec.whatwg.org/#new-stacking-layer
         if (m_element != m_document.documentElement() && style.position() != PositionType::Absolute && style.position() != PositionType::Fixed && isInTopLayerOrBackdrop(style, m_element))