<rdar://88491516>
Created attachment 451716 [details] Patch
Comment on attachment 451716 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=451716&action=review > Source/WebCore/rendering/LegacyLineLayout.cpp:571 > + for (auto* leafChild = rootBox.firstLeafDescendant(); leafChild && i < expansionOpportunities.size(); leafChild = leafChild->nextLeafOnLine()) { I think this is a band-aid fix. It's not harmful, but it doesn't solve the underlying problem that the invariant is being violated. (The invariant is expansionOpportunities.size() == number of leaves on line.)
The bidi runs are: 1. U+0600 2. U+2E80 3. A ruby run expansionOpportunities.size() is 2, however.
Whoops, that's wrong. The first time LegacyLineLayout::computeExpansionForJustifiedText() is called, the runs are: 1. U+0600 2. U+2E80 The second time it's called, the runs are: 1. \n 2. ruby run. Inside this run, the first root box has 2 leaves on the line.
Regarding the second time, both expansion opportunities appended to expansionOpportunities are regarding the insides of the ruby run. For some reason, the previous \n run didn't seem to append anything to expansionOpportunities.
Created attachment 451767 [details] Root cause fix
Created attachment 452073 [details] Patch
Comment on attachment 452073 [details] Patch r=me assuming there is a test somewhere
Committed r289859 (247300@main): <https://commits.webkit.org/247300@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 452073 [details].