[out-of-flow] ASSERT in LayoutIntegration::LineLayout::paint

alanbaradlay · alanbaradlay · commit 7b22cb535647 · 2025-08-21T11:20:40.000-07:00
https://bugs.webkit.org/show_bug.cgi?id=297724 rdar://157024791 Reviewed by Antti Koivisto. 1. out-of-flow boxes participate first in in-flow layout as if they were in-flow boxes where we compute their static position. This static position becomes their final position when inset (left, right, top, bottom) is auto. 2. as a second step, as we reach the out-of-flow box's containing block we run layout again and compute the final position (this might just be what we computed at #1 in case of auto inset) Now we mark the out-of-flow box dirty at #1 and expect #2 to clear the box by moving it to its final position. However in case of subtree layout where the layout root has an out-of-flow descendant while the containing block is an ancestor of the layout root, #2 will never happen (we bail out of layout before reaching the containing block). "setNeedsLayout" was added at 254969@main to mimic what legacy line layout did. However starting from 262470@main, we already move the box at #1 meaning that #2 does not need to happen if the box is statically positioned only. (If the out-of-flow box was not-statically positioned, subtree layout would not start "below" its containing block) * LayoutTests/TestExpectations: * Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp: (WebCore::LayoutIntegration::LineLayout::updateRenderTreePositions): Canonical link: https://commits.webkit.org/299021@main
diff --git a/LayoutTests/TestExpectations b/LayoutTests/TestExpectations
@@ -4591,9 +4591,6 @@ webkit.org/b/203451 imported/w3c/web-platform-tests/css/css-position/static-posi
 webkit.org/b/203451 imported/w3c/web-platform-tests/css/css-position/static-position/vrl-rtl-ltr.tentative.html [ ImageOnlyFailure ]
 webkit.org/b/203451 imported/w3c/web-platform-tests/css/css-position/static-position/vrl-rtl-rtl.html [ ImageOnlyFailure ]
 
-webkit.org/b/254666 [ Debug ] imported/w3c/web-platform-tests/css/css-position/position-absolute-crash-chrome-005.html [ Skip ]
-webkit.org/b/254666 [ Debug ] fast/block/positioning/static_out_of_flow_inside_layout_boundary.html [ Skip ]
-
 webkit.org/b/203606 imported/w3c/web-platform-tests/css/css-display/display-change-object-iframe.html [ ImageOnlyFailure ]
 webkit.org/b/203606 imported/w3c/web-platform-tests/css/css-display/display-flow-root-list-item-001.html [ ImageOnlyFailure ]
 webkit.org/b/203606 imported/w3c/web-platform-tests/css/css-display/select-4-option-optgroup-display-none.html [ ImageOnlyFailure ]
diff --git a/Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp b/Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp
@@ -672,9 +672,6 @@ void LineLayout::updateRenderTreePositions(const Vector<LineAdjustment>& lineAdj
 
             layer.setStaticBlockPosition(borderBoxLogicalTopLeft.y());
             layer.setStaticInlinePosition(borderBoxLogicalTopLeft.x());
-
-            if (!delta.isZero() && hasStaticInlinePositioning)
-                renderer.setChildNeedsLayout(MarkOnlyThis);
             continue;
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -672,9 +672,6 @@ void LineLayout::updateRenderTreePositions(const Vector<LineAdjustment>& lineAdj`
`672`	`672`
`673`	`673`	`layer.setStaticBlockPosition(borderBoxLogicalTopLeft.y());`
`674`	`674`	`layer.setStaticInlinePosition(borderBoxLogicalTopLeft.x());`
`675`		`-`
`676`		`- if (!delta.isZero() && hasStaticInlinePositioning)`
`677`		`- renderer.setChildNeedsLayout(MarkOnlyThis);`
`678`	`675`	`continue;`
`679`	`676`	`}`
`680`	`677`	`}`