WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
NEW
303414
Container query interleaving prevents StyleAdjuster from running on top layer elements
https://bugs.webkit.org/show_bug.cgi?id=303414
Summary
Container query interleaving prevents StyleAdjuster from running on top layer...
Ruthvik Konda
Reported
2025-12-02 12:57:34 PST
When an element enters the top layer via fullscreen and its parent has container-type set, TreeResolver's container query interleaving logic (StyleTreeResolver.cpp:1382-1403) returns LayoutInterleavingAction::SkipDescendants, which defers style resolution for all descendants. This prevents StyleAdjuster::adjust() (StyleAdjuster.cpp:546-549) from ever running on the top layer element, so it never receives the required position:absolute style. This creates a broken invariant where the element remains in the normal flow of its layout parent (making isGridItem() return true) while containingBlock() correctly returns RenderView per top layer rules (RenderObject.cpp:782-783), leading to type confusion crashes. The fundamental issue is that style resolution interleaving breaks the contract that all top layer elements must be position:absolute. As a result, this architectural problem caused a downcast crash in
rdar://163028025
. If the top layer element was correctly set to position:absolute, then it would have correctly been out of flow positioned and the crash would've been avoided. Instead isGridItem() returns true and containingBlock() returns a RenderView which is fundamentally wrong.
rdar://163028025
has a workaround fix in place. But this is a deeper rooted issue that needs to go to a fullscreen or style resolution expert to solve.
Attachments
Add attachment
proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1
2025-12-02 12:57:40 PST
<
rdar://problem/165714112
>
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug