Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 67c3e5ec34ea24955a4c9b6a8256b07125fad540
https://github.com/WebKit/WebKit/commit/67c3e5ec34ea24955a4c9b6a8256b07125fad540
Author: Sammy Gill <[email protected]>
Date: 2026-01-07 (Wed, 07 Jan 2026)
Changed paths:
A LayoutTests/fast/forms/search-selection-insert-crash-expected.txt
A LayoutTests/fast/forms/search-selection-insert-crash.html
M Source/WebCore/rendering/mac/RenderThemeMac.mm
Log Message:
-----------
ASSERTION FAILED: resolvedMainSize >= 0 in
RenderFlexibleBox::computeFlexItemMinMaxSizes.
https://bugs.webkit.org/show_bug.cgi?id=304266
rdar://167701366
Reviewed by Brent Fulgham.
It seems like it is possible to compute a width/height that is negative
inside of RenderThemeMac::adjustSearchFieldDecorationPartStyle. This
size is determined based off some sizes that we have precomputed for the
results button and the system font size. This value is also scaled by
zoom. After computing this value we subtract out the offset used for
empty results which is what can cause us to compute a negative value and
then set it on the associated RenderStyle.
When this happens, we end up triggering a debug assert inside of
RenderFlexibleBox::computeFlexItemMinMaxSizes that checks to see is the
main size we determined for the flex item is non-negative. In this case,
since the computed main size of the flex item is definite we end up
using it. To fix this, we can just make sure that we clamp to value to
be at least zero.
Note that this only seems like it can happen when Form Control Refresh
flag is not enabled. In the attached testcase this is forced when a new
Document is created within the ReplacementFragment constructor and we
end up performing layout via the call to insertFragmentForTestRendering.
* Source/WebCore/rendering/mac/RenderThemeMac.mm:
(WebCore::RenderThemeMac::adjustSearchFieldDecorationPartStyle const):
Canonical link: https://commits.webkit.org/305249@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
