Created attachment 467050 [details] A case to reproduce this assertion When both IFC and FFC enabled, `ASSERT(formattingContextRoot.hasChild())` at `FormattingContext::FormattingContext(const ElementBox&, FormattingState&)` triggers when the flex item contains certain inline child. One of my pages triggers this assertion while debugging, which could be simplified into the attached reproducible case. I believe this issue is different from [the previous bug](https://bugs.webkit.org/show_bug.cgi?id=257802). For the attached case, `LayoutIntegration::LineLayout` was first created from `RenderBlockFlow::tryComputePreferredWidthsUsingModernPath`. Then comes to laying out the flexbox, which creates `LayoutIntegration::FlexLayout` and replaces the inline renderer's layout box while building the new tree. When it comes to `RenderBlockFlow::layoutModernLines`, the wrong box was used.
Thanks! At this point FFC is highly experimental (and I don't believe there's a WebKit based browser with such shipping configuration) so assertions like this are expected.
<rdar://problem/112709809>