Cherry-pick 259548.74@safari-7615-branch (25cddfa). rdar://107499427

Fix layout for positioned children for RenderMathMLUnderOver rdar://105071050 Reviewed by Alan Baradlay. Before this change, the layout method in RenderMathMLUnderOver (<mover>) never added positioned elements to the map for their container, which meant if the positioned children are dirty, their layout will never be triggered. This change fixes that by looking at direct children of RenderMathMLUnderOver and adding them to their container's positioned elements map, so that their layout happens as expected. * LayoutTests/mathml/mathml-mover-layout-crash-expected.txt: Added. * LayoutTests/mathml/mathml-mover-layout-crash.html: Added. * Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp: (WebCore::RenderMathMLUnderOver::layoutBlock): * LayoutTests/platform/glib/imported/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt: * LayoutTests/platform/mac-wk2/TestExpectations: Canonical link: https://commits.webkit.org/259548.74@safari-7615-branch Canonical link: https://commits.webkit.org/262472@main
WebKit · Apr 1, 2023 · c839c78 · c839c78
1 parent 4b57654
commit c839c78
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 3 deletions.
diff --git a/LayoutTests/mathml/mathml-mover-layout-crash-expected.txt b/LayoutTests/mathml/mathml-mover-layout-crash-expected.txt
@@ -0,0 +1 @@
+PASS if no crash.
diff --git a/LayoutTests/mathml/mathml-mover-layout-crash.html b/LayoutTests/mathml/mathml-mover-layout-crash.html
@@ -0,0 +1,22 @@
+<style>
+.mtableStyleClass { list-style: url('foo') inside; position: absolute; }
+</style>
+<script>
+function test() {
+    if (window.testRunner)
+        testRunner.dumpAsText();
+    mtrID.replaceWith("foo");
+    document.body.offsetTop;
+    document.body.innerHTML = 'PASS if no crash.';
+}
+</script>
+
+<body onload=test()>
+    <math display="inline">
+        <mover>
+            <mtable class="mtableStyleClass">
+                <mtr id="mtrID"></mtr>
+            </mtable>
+        </mover>
+    </math>
+</body>
diff --git a/...ted/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt b/...ted/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt
@@ -12,16 +12,16 @@ PASS Appending and removing children to mpadded
 PASS Appending and removing children to mphantom
 FAIL Appending and removing children to mroot assert_approx_equals: inline position (child 0) expected 0 +/- 1 but got 4.4375
 PASS Appending and removing children to mrow
-FAIL Appending and removing children to ms assert_approx_equals: block position (child 0) expected -19705 +/- 1 but got -19723
+FAIL Appending and removing children to ms assert_approx_equals: block position (child 0) expected -39053 +/- 1 but got -39071
 PASS Appending and removing children to mspace
 FAIL Appending and removing children to msqrt assert_approx_equals: inline size expected 13 +/- 1 but got 16
 PASS Appending and removing children to mstyle
 FAIL Appending and removing children to msub assert_approx_equals: block position (child 0) expected 0 +/- 1 but got -5.5
 FAIL Appending and removing children to msubsup assert_approx_equals: block position (child 0) expected 0 +/- 1 but got 2.5
 FAIL Appending and removing children to msup assert_approx_equals: inline size expected 10.890625 +/- 1 but got 0
 PASS Appending and removing children to mtable
-FAIL Appending and removing children to mtext assert_approx_equals: block position (child 0) expected -5093074 +/- 1 but got -5093092
-FAIL Appending and removing children to munder assert_approx_equals: block position (child 0) expected 0 +/- 1 but got 2
+FAIL Appending and removing children to mtext assert_approx_equals: block position (child 0) expected -10046162 +/- 1 but got -10046180
+FAIL Appending and removing children to munder assert_approx_equals: block size expected 22 +/- 1 but got 24
 FAIL Appending and removing children to munderover assert_approx_equals: inline size expected 0 +/- 1 but got 10
 PASS Appending and removing children to semantics
 maction:

diff --git a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp
@@ -290,6 +290,11 @@ void RenderMathMLUnderOver::layoutBlock(bool relayoutChildren, LayoutUnit pageLo
 {
     ASSERT(needsLayout());
 
+    for (auto& box : childrenOfType<RenderBox>(*this)) {
+        if (box.isOutOfFlowPositioned())
+            box.containingBlock()->insertPositionedObject(box);
+    }
+
     if (!relayoutChildren && simplifiedLayout())
         return;