diff --git a/LayoutTests/mathml/mathml-mover-layout-crash-expected.txt b/LayoutTests/mathml/mathml-mover-layout-crash-expected.txt new file mode 100644 index 000000000000..c2541f4f3dd7 --- /dev/null +++ b/LayoutTests/mathml/mathml-mover-layout-crash-expected.txt @@ -0,0 +1 @@ +PASS if no crash. diff --git a/LayoutTests/mathml/mathml-mover-layout-crash.html b/LayoutTests/mathml/mathml-mover-layout-crash.html new file mode 100644 index 000000000000..4975557aa427 --- /dev/null +++ b/LayoutTests/mathml/mathml-mover-layout-crash.html @@ -0,0 +1,22 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/LayoutTests/platform/gtk/imported/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt b/LayoutTests/platform/gtk/imported/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt index df2125716c8e..baf5f9baf8fd 100644 --- a/LayoutTests/platform/gtk/imported/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt +++ b/LayoutTests/platform/gtk/imported/w3c/web-platform-tests/mathml/relations/html5-tree/dynamic-childlist-002-expected.txt @@ -12,7 +12,7 @@ PASS Appending and removing children to mpadded PASS Appending and removing children to mphantom FAIL Appending and removing children to mroot assert_approx_equals: inline position (child 0) expected 0 +/- 1 but got 4.4375 PASS Appending and removing children to mrow -FAIL Appending and removing children to ms assert_approx_equals: block position (child 0) expected -19705 +/- 1 but got -19723 +FAIL Appending and removing children to ms assert_approx_equals: block position (child 0) expected -39053 +/- 1 but got -39071 PASS Appending and removing children to mspace FAIL Appending and removing children to msqrt assert_approx_equals: inline size expected 13 +/- 1 but got 16 PASS Appending and removing children to mstyle @@ -20,8 +20,8 @@ FAIL Appending and removing children to msub assert_approx_equals: block positio FAIL Appending and removing children to msubsup assert_approx_equals: block position (child 0) expected 0 +/- 1 but got 2.5 FAIL Appending and removing children to msup assert_approx_equals: inline size expected 10.890625 +/- 1 but got 0 PASS Appending and removing children to mtable -FAIL Appending and removing children to mtext assert_approx_equals: block position (child 0) expected -5093074 +/- 1 but got -5093092 -FAIL Appending and removing children to munder assert_approx_equals: block position (child 0) expected 0 +/- 1 but got 2 +FAIL Appending and removing children to mtext assert_approx_equals: block position (child 0) expected -10046162 +/- 1 but got -10046180 +FAIL Appending and removing children to munder assert_approx_equals: block size expected 22 +/- 1 but got 24 FAIL Appending and removing children to munderover assert_approx_equals: inline size expected 0 +/- 1 but got 10 PASS Appending and removing children to semantics maction: diff --git a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp index da0e45e085f6..2424725c0da5 100644 --- a/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp +++ b/Source/WebCore/rendering/mathml/RenderMathMLUnderOver.cpp @@ -290,6 +290,11 @@ void RenderMathMLUnderOver::layoutBlock(bool relayoutChildren, LayoutUnit pageLo { ASSERT(needsLayout()); + for (auto& box : childrenOfType(*this)) { + if (box.isOutOfFlowPositioned()) + box.containingBlock()->insertPositionedObject(box); + } + if (!relayoutChildren && simplifiedLayout()) return;