NEW 259243
ASSERTION FAILED: formattingContextRoot.hasChild() when flex item contains certain inline child 
https://bugs.webkit.org/show_bug.cgi?id=259243
Summary ASSERTION FAILED: formattingContextRoot.hasChild() when flex item contains ce...
Ethan Wong
Reported 2023-07-15 08:25:42 PDT
Created attachment 467050 [details] A case to reproduce this assertion When both IFC and FFC enabled, `ASSERT(formattingContextRoot.hasChild())` at `FormattingContext::FormattingContext(const ElementBox&, FormattingState&)` triggers when the flex item contains certain inline child. One of my pages triggers this assertion while debugging, which could be simplified into the attached reproducible case. I believe this issue is different from [the previous bug](https://bugs.webkit.org/show_bug.cgi?id=257802). For the attached case, `LayoutIntegration::LineLayout` was first created from `RenderBlockFlow::tryComputePreferredWidthsUsingModernPath`. Then comes to laying out the flexbox, which creates `LayoutIntegration::FlexLayout` and replaces the inline renderer's layout box while building the new tree. When it comes to `RenderBlockFlow::layoutModernLines`, the wrong box was used.
Attachments
A case to reproduce this assertion (375 bytes, text/html)
2023-07-15 08:25 PDT, Ethan Wong 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
zalan
Comment 1 2023-07-15 12:11:13 PDT
Thanks! At this point FFC is highly experimental (and I don't believe there's a WebKit based browser with such shipping configuration) so assertions like this are expected.
Radar WebKit Bug Importer
Comment 2 2023-07-22 08:26:17 PDT
<rdar://problem/112709809>
Note You need to log in before you can comment on or make changes to this bug.