This is just a leftover.
<rdar://problem/59498829>
Created attachment 390895 [details] Patch
Comment on attachment 390895 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=390895&action=review > Source/WebCore/layout/layouttree/LayoutReplacedBox.h:-63 > - WeakPtr<const Box> m_layoutBox; I don’t see where this was initialized to anything. Seems like it was always null. Not sure why the code wasn’t just crashing all the time. Don’t understand why the new test covers this code.
> I don’t see where this was initialized to anything. Seems like it was always > null. Not sure why the code wasn’t just crashing all the time. Don’t > understand why the new test covers this code. I think the new test covers it because it explicitly enables full-tree LFC. There was no previous test coverage.
(In reply to Darin Adler from comment #3) > Comment on attachment 390895 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=390895&action=review > > > Source/WebCore/layout/layouttree/LayoutReplacedBox.h:-63 > > - WeakPtr<const Box> m_layoutBox; > > I don’t see where this was initialized to anything. Seems like it was always > null. Not sure why the code wasn’t just crashing all the time. Don’t > understand why the new test covers this code. Yes. As Antti said this code is behind a runtime flag and wasn't regression tested.
Comment on attachment 390895 [details] Patch Clearing flags on attachment: 390895 Committed r256733: <https://trac.webkit.org/changeset/256733>
All reviewed patches have been landed. Closing bug.
Comment on attachment 390895 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=390895&action=review >>> Source/WebCore/layout/layouttree/LayoutReplacedBox.h:-63 >>> - WeakPtr<const Box> m_layoutBox; >> >> I don’t see where this was initialized to anything. Seems like it was always null. Not sure why the code wasn’t just crashing all the time. Don’t understand why the new test covers this code. > > Yes. As Antti said this code is behind a runtime flag and wasn't regression tested. Ah, I see, the new test says "LayoutFormattingContextEnabled=true". That’s what I missed!
(In reply to Darin Adler from comment #8) > Comment on attachment 390895 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=390895&action=review > > >>> Source/WebCore/layout/layouttree/LayoutReplacedBox.h:-63 > >>> - WeakPtr<const Box> m_layoutBox; > >> > >> I don’t see where this was initialized to anything. Seems like it was always null. Not sure why the code wasn’t just crashing all the time. Don’t understand why the new test covers this code. > > > > Yes. As Antti said this code is behind a runtime flag and wasn't regression tested. > > Ah, I see, the new test says "LayoutFormattingContextEnabled=true". That’s > what I missed! And it is actually crashing here https://ews-build.webkit.org/results/iOS-13-Simulator-WK2-Tests-EWS/r390898-10935/results.html when a new test exercises this (not yet patched)code path.