Cherry-pick 274097.12@webkit-2024.2-embargoed (5bd3a1c2b0ac). https:/…

…/bugs.webkit.org/show_bug.cgi?id=264631 Special case treatment of out-of-flow RenderLineBreak https://bugs.webkit.org/show_bug.cgi?id=264631 rdar://114719845 Reviewed by Alan Baradlay. Out-of-flow RenderLineBreaks have problems when relying on default out-of-flow support of the render tree, see https://bugs.webkit.org/show_bug.cgi?id=270977. To fix the problem we change containerForElement and containingBlock to treat RenderLineBreak that are out-of-flow as if they have position: static. * LayoutTests/fast/css/line-break-fixed-position-container-expected.txt: Added. * LayoutTests/fast/css/line-break-fixed-position-container.html: Added. * Source/WebCore/rendering/RenderObject.cpp: (WebCore::RenderObject::containingBlock const): (WebCore::containerForElement): Canonical link: https://commits.webkit.org/274097.12@webkit-2024.2-embargoed Canonical link: https://commits.webkit.org/272448.783@safari-7618-branch Canonical link: https://commits.webkit.org/274313.238@webkitglib/2.44
WebKit · May 13, 2024 · 9aa9b70 · 9aa9b70
1 parent ad27029
commit 9aa9b70
Show file tree

Hide file tree

Showing 3 changed files with 47 additions and 2 deletions.
diff --git a/LayoutTests/fast/css/line-break-fixed-position-container-expected.txt b/LayoutTests/fast/css/line-break-fixed-position-container-expected.txt
@@ -0,0 +1,2 @@
+This test passes if it doesn't crash.
+
diff --git a/LayoutTests/fast/css/line-break-fixed-position-container.html b/LayoutTests/fast/css/line-break-fixed-position-container.html
@@ -0,0 +1,36 @@
+<html>
+<head>
+<style>
+/* Fixed position for the line break should be ignored. */
+br { position: fixed; }
+
+/* Only function of this styling is forcing style invalidation
+ * on the line break renderer. */
+br::first-line { color: blue; }
+</style>
+<script>
+function test() {
+    if (window.testRunner) {
+        window.testRunner.dumpAsText();
+        window.testRunner.waitUntilDone();
+    }
+
+    setTimeout(function() {
+        // Only function of this event listener is invalidating event regions
+        // for the Document and subsequently triggering a complete style rebuild
+        // which is necessary to exhibit the problem.
+        window.addEventListener('wheel', function() { });
+
+        setTimeout(function() {
+            if (window.testRunner)
+                window.testRunner.notifyDone();
+        });
+    });
+}
+</script>
+</head>
+<body onload="test()">
+This test passes if it doesn't crash.
+<br/>
+</body>
+</html>
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
@@ -739,7 +739,8 @@ RenderBlock* RenderObject::containingBlockForPositionType(PositionType positionT
 
 RenderBlock* RenderObject::containingBlock() const
 {
-    if (is<RenderText>(*this))
+    // FIXME: See https://bugs.webkit.org/show_bug.cgi?id=270977 for RenderLineBreak special treatment.
+    if (is<RenderText>(*this) || is<RenderLineBreak>(*this))
         return containingBlockForPositionType(PositionType::Static, *this);
 
     auto containingBlockForRenderer = [](const auto& renderer) -> RenderBlock* {
@@ -1707,9 +1708,15 @@ static inline RenderElement* containerForElement(const RenderObject& renderer, c
     // (2) For absolute positioned elements, it will return a relative positioned inline, while
     // containingBlock() skips to the non-anonymous containing block.
     // This does mean that computePositionedLogicalWidth and computePositionedLogicalHeight have to use container().
+    // FIXME: See https://bugs.webkit.org/show_bug.cgi?id=270977 for RenderLineBreak special treatment.
+    if (!is<RenderElement>(renderer) || is<RenderText>(renderer) || is<RenderLineBreak>(renderer))
+        return renderer.parent();
+
     auto* renderElement = dynamicDowncast<RenderElement>(renderer);
-    if (!renderElement)
+    if (!renderElement) {
+        ASSERT_NOT_REACHED();
         return renderer.parent();
+    }
     auto updateRepaintContainerSkippedFlagIfApplicable = [&] {
         if (!repaintContainerSkipped)
             return;