haikuwebkit/LayoutTests/fast/block/fail-to-remove-float-from-i...

16 lines
312 B
HTML
Raw Permalink Normal View History

Floating object are not removed from the initial containing block https://bugs.webkit.org/show_bug.cgi?id=225198 <rdar://77236776> Reviewed by Antti Koivisto. Source/WebCore: outermostBlockContainingFloatingObject is supposed to find the top most ancestor for an intruding float. Now when the <html> is float positioned, the initial containing block (RenderView) is the outermost containing block that has reference to this float (see FloatingObject). removeFloatingOrPositionedChildFromBlockLists() calls outermostBlockContainingFloatingObject() to get the top most renderer where the float cleanup is supposed to be initiated at. We call this function during style and tree mutation. These float lists are getting invalidated during layout as well, with a simple call to m_floatingObjects->clear(). It unconditionally takes care of all the floats including the ones on the initial containing block. The bug only shows when we try to access the floating list between the style/tree mutation and the subsequent layout. Test: fast/block/fail-to-remove-float-from-initial-containing-block.html * rendering/RenderBox.cpp: (WebCore::outermostBlockContainingFloatingObject): LayoutTests: * fast/block/fail-to-remove-float-from-initial-containing-block-expected.txt: Added. * fast/block/fail-to-remove-float-from-initial-containing-block.html: Added. Canonical link: https://commits.webkit.org/237174@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@276816 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-04-29 22:43:08 +00:00
<style>
html {
float: right;
content: url();
}
</style>
<!-- Pass if no crash or assert. -->
<script>
if (window.testRunner)
testRunner.dumpAsText();
onload = () => {
document.body.offsetTop;
document.styleSheets[0].insertRule(`html { overflow-y: -webkit-paged-x; }`);
};
</script>