RESOLVED FIXED 287778
RenderObject::isOutOfFlowPositioned can be read before it gets set. 
https://bugs.webkit.org/show_bug.cgi?id=287778
Summary RenderObject::isOutOfFlowPositioned can be read before it gets set.
Matt Woodrow
Reported 2025-02-16 16:55:07 PST
RenderBoxModelObject::updateFromStyle updates the cached position flags using the new RenderStyle object. RenderElement::styleDidChange (which happens earlier) can schedule layout, which depends on the state of these flags.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2025-02-16 16:55:36 PST
<rdar://problem/144956226>
Matt Woodrow
Comment 2 2025-02-16 16:58:36 PST
Pull request: https://github.com/WebKit/WebKit/pull/40693
Matt Woodrow
Comment 3 2025-02-20 15:46:33 PST
Pull request: https://github.com/WebKit/WebKit/pull/40776
EWS
Comment 4 2025-02-21 15:23:42 PST
Committed 290831@main (055d5a97c962): <https://commits.webkit.org/290831@main> Reviewed commits have been landed. Closing PR #40693 and removing active labels.
Matt Woodrow
Comment 5 2025-03-02 15:28:52 PST
<rdar://problem/145713221>
Matt Woodrow
Comment 6 2025-03-02 15:29:17 PST
Re-opening for pull request https://github.com/WebKit/WebKit/pull/41747
Matt Woodrow
Comment 7 2025-03-02 15:29:46 PST
This got reverted by https://commits.webkit.org/291192@main
EWS
Comment 8 2025-03-03 18:02:43 PST
Committed 291542@main (e4e3b0bfe5eb): <https://commits.webkit.org/291542@main> Reviewed commits have been landed. Closing PR #41747 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.