Bug 259243

Summary:

ASSERTION FAILED: formattingContextRoot.hasChild() when flex item contains certain inline child

Product:

WebKit

Reporter:

Ethan Wong <bunnnywong>

Component:

Layout and Rendering

Assignee:

Nobody <webkit-unassigned>

Status:

NEW

Severity:

Normal

CC:

bfulgham, simon.fraser, webkit-bug-importer, zalan

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

All

OS:

All

Attachments:

Description	Flags
A case to reproduce this assertion	none

Ethan Wong

Reported 2023-07-15 08:25:42 PDT

Created attachment 467050 [details] A case to reproduce this assertion When both IFC and FFC enabled, `ASSERT(formattingContextRoot.hasChild())` at `FormattingContext::FormattingContext(const ElementBox&, FormattingState&)` triggers when the flex item contains certain inline child. One of my pages triggers this assertion while debugging, which could be simplified into the attached reproducible case. I believe this issue is different from [the previous bug](https://bugs.webkit.org/show_bug.cgi?id=257802). For the attached case, `LayoutIntegration::LineLayout` was first created from `RenderBlockFlow::tryComputePreferredWidthsUsingModernPath`. Then comes to laying out the flexbox, which creates `LayoutIntegration::FlexLayout` and replaces the inline renderer's layout box while building the new tree. When it comes to `RenderBlockFlow::layoutModernLines`, the wrong box was used.

Attachments
A case to reproduce this assertion (375 bytes, text/html) 2023-07-15 08:25 PDT, Ethan Wong	no flags	Details
View All Add attachment proposed patch, testcase, etc.

alan

Comment 1 2023-07-15 12:11:13 PDT

Thanks! At this point FFC is highly experimental (and I don't believe there's a WebKit based browser with such shipping configuration) so assertions like this are expected.

Radar WebKit Bug Importer

Comment 2 2023-07-22 08:26:17 PDT

<rdar://problem/112709809>

Note You need to log in before you can comment on or make changes to this bug.