This website requires JavaScript.
Explore
Help
Sign In
nephele
/
haikuwebkit
Watch
1
Star
0
Fork
You've already forked haikuwebkit
0
Code
Issues
Releases
Activity
haiku
haikuwebkit
/
LayoutTests
/
fast
/
block
/
float-assert-when-anon-pare...
2 lines
1 B
Raw
Permalink
Normal View
History
Unescape
Escape
[RenderTreeBuilder] ASSERTION FAILED: m_renderer in FloatingObject::renderer() https://bugs.webkit.org/show_bug.cgi?id=227260 <rdar://77329323> Reviewed by Antti Koivisto. Source/WebCore: This is a very similar to webkit.org/b/224996, where moving subtrees around fails to invalidate floating object sets in sibling blocks. (see the Changelog entry for more details on how sibling invalidation works). In this case the anonymous parent block is destroyed as it is no longer needed (and we move all its descendants out first). However this block has an intruding float and this float is also registered in the sibling blocks. Test: fast/block/float-assert-when-anon-parent-is-destroyed.html * rendering/updating/RenderTreeBuilder.cpp: (WebCore::RenderTreeBuilder::moveChildren): (WebCore::RenderTreeBuilder::removeFloatingObjects): * rendering/updating/RenderTreeBuilder.h: * rendering/updating/RenderTreeBuilderBlock.cpp: (WebCore::RenderTreeBuilder::Block::removeLeftoverAnonymousBlock): LayoutTests: * fast/block/float-assert-when-anon-parent-is-destroyed-expected.txt: Added. * fast/block/float-assert-when-anon-parent-is-destroyed.html: Added. Canonical link: https://commits.webkit.org/239051@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279142 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-06-22 20:26:10 +00:00