Created attachment 425979 [details] selection-crash.html This issue occurs on the Debug building with LAYOUT_FORMATTING_CONTEXT enabled. The code is updated to commit 80e1bf3d759003a97b3e676d78fca630407fdd35. The test case contains inline-block box and text. The height of body is 35px, but others are 24px. It crashes when select the text. Debug a bit: - During layout, in RenderBlockFlow::layoutInlineChildren, it uses layoutModernLines() to layout lines. The logical height is 35. - During select, in RenderBlockFlow::ensureLineBoxes, it calls complexLineLayout.layoutLineBoxes. The logical height is 24. - Then it fails `ASSERT(didNeedLayout || ceilf(logicalHeight()) == ceilf(oldHeight));` in RenderBlockFlow::ensureLineBoxes.
Created attachment 425983 [details] (another)test case
Actually this is about the reserved space for always-on scrollbars (15px here in MiniBrowser -which explains the 11px diff (15px scrollbar - 4px descent))
<rdar://problem/76666402>
ok, so this is broken when the padding box can't accommodate the scrollbar. this fixes the vertical aspect of it: - auto verticalSpaceReservedForScrollbar = std::min(replacedOrInlineBlock.height() - replacedOrInlineBlock.paddingBoxHeight(), LayoutUnit(replacedOrInlineBlock.horizontalScrollbarHeight())); + auto paddingBoxHeight = replacedOrInlineBlock.paddingBoxHeight(); + auto horizontalScrollbarHeight = LayoutUnit { replacedOrInlineBlock.horizontalScrollbarHeight() }; + auto verticalSpaceReservedForScrollbar = horizontalScrollbarHeight > paddingBoxHeight ? paddingBoxHeight : std::min(replacedOrInlineBlock.height() - paddingBoxHeight, horizontalScrollbarHeight); will upload the patch tomorrow morning.
Created attachment 426095 [details] Patch
Created attachment 426110 [details] Patch
Committed r276135 (236629@main): <https://commits.webkit.org/236629@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 426110 [details].