Skip to content

Commit

Permalink
Inline box may not be present in the enclosing formatting context
Browse files Browse the repository at this point in the history
https://bugs.webkit.org/show_bug.cgi?id=268525
rdar://119921061

Reviewed by Antti Koivisto.

Speculative fix when the (potentially damaged) inline box is not present in the enclosing formatting context.
This may happen when RenderInline::linesBoundingBox is called on a dirty tree after moving an inline box (<span>)
from a block to an other (but before clearing the tree by running layout).

* Source/WebCore/rendering/RenderInline.cpp:
(WebCore::RenderInline::linesBoundingBox const):

Originally-landed-as: 272448.456@safari-7618-branch (66b364d). rdar://124553574
Canonical link: https://commits.webkit.org/276674@main
  • Loading branch information
alanbaradlay authored and JonWBedard committed Mar 26, 2024
1 parent 7792511 commit fe11bca
Showing 1 changed file with 5 additions and 8 deletions.
13 changes: 5 additions & 8 deletions Source/WebCore/rendering/RenderInline.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -505,16 +505,12 @@ LayoutUnit RenderInline::innerPaddingBoxHeight() const

IntRect RenderInline::linesBoundingBox() const
{
IntRect result;

if (auto* layout = LayoutIntegration::LineLayout::containing(*this)) {
if (!layout->contains(*this))
return result;

if (!layoutBox()) {
// Repaint may be issued on subtrees during content mutation with newly inserted renderers.
if (!layoutBox() || !layout->contains(*this)) {
// Repaint may be issued on subtrees during content mutation with newly inserted renderers
// (or we just forgot to initiate layout before querying geometry on stale content after moving inline boxes between blocks).
ASSERT(needsLayout());
return result;
return { };
}
return enclosingIntRect(layout->enclosingBorderBoxRectFor(*this));
}
Expand All @@ -523,6 +519,7 @@ IntRect RenderInline::linesBoundingBox() const
// unable to reproduce this at all (and consequently unable to figure ot why this is happening). The assert will hopefully catch the problem in debug
// builds and help us someday figure out why. We also put in a redundant check of lastLineBox() to avoid the crash for now.
ASSERT(!firstLineBox() == !lastLineBox()); // Either both are null or both exist.
IntRect result;
if (firstLineBox() && lastLineBox()) {
// Return the width of the minimal left side and the maximal right side.
float logicalLeftSide = 0;
Expand Down

0 comments on commit fe11bca

Please sign in to comment.