Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e30f6fb87635988779e19e177fc2203c8ee334f8
https://github.com/WebKit/WebKit/commit/e30f6fb87635988779e19e177fc2203c8ee334f8
Author: Yulun Wu <[email protected]>
Date: 2026-04-14 (Tue, 14 Apr 2026)
Changed paths:
M LayoutTests/fast/lists/list-marker-before-content-table-expected.txt
A LayoutTests/fast/lists/list-marker-crash-1-expected.txt
A LayoutTests/fast/lists/list-marker-crash-1.html
A
LayoutTests/fast/lists/list-marker-outside-flex-collapse-anonymous-block-expected.html
A
LayoutTests/fast/lists/list-marker-outside-flex-collapse-anonymous-block.html
M
LayoutTests/platform/glib/fast/css-generated-content/table-row-group-with-before-expected.txt
M
LayoutTests/platform/glib/fast/css-generated-content/table-row-with-before-expected.txt
M
LayoutTests/platform/glib/fast/css-generated-content/table-with-before-expected.txt
M LayoutTests/platform/glib/fast/forms/form-hides-table-expected.txt
M
LayoutTests/platform/glib/fast/lists/ordered-list-with-no-ol-tag-expected.txt
M
LayoutTests/platform/ios/fast/css-generated-content/table-row-group-with-before-expected.txt
M
LayoutTests/platform/ios/fast/css-generated-content/table-row-with-before-expected.txt
M
LayoutTests/platform/ios/fast/css-generated-content/table-with-before-expected.txt
M LayoutTests/platform/ios/fast/forms/form-hides-table-expected.txt
M
LayoutTests/platform/ios/fast/lists/ordered-list-with-no-ol-tag-expected.txt
M
LayoutTests/platform/mac/fast/css-generated-content/table-row-group-with-before-expected.txt
M
LayoutTests/platform/mac/fast/css-generated-content/table-row-with-before-expected.txt
M
LayoutTests/platform/mac/fast/css-generated-content/table-with-before-expected.txt
M LayoutTests/platform/mac/fast/forms/form-hides-table-expected.txt
M
LayoutTests/platform/mac/fast/lists/ordered-list-with-no-ol-tag-expected.txt
M Source/WebCore/layout/formattingContexts/inline/InlineQuirks.cpp
M Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp
M Source/WebCore/layout/layouttree/LayoutElementBox.h
M Source/WebCore/rendering/RenderListMarker.h
M Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp
Log Message:
-----------
[Reland][List Marker] Collapse anonymous blocks created for outside marker
when block level elements prevents line-box parenting.
https://bugs.webkit.org/show_bug.cgi?id=311038
<rdar://173417560>
Reviewed by Alan Baradlay.
This PR relands 309272@main and 309466@main which were reverted in 309904@main
due to
a CheckedPtrDeleteCheckException.
[Bug Summary]
The crash was caused by the original PR switching raw pointers to checked
pointers.
This switch exposed a latent bug where:
m_builder.destroy(*currentParent);
destroyed the block searchResult.parent points to and causing a
CheckedPtrDeleteCheckException.
Note that the previous raw pointer was never dereferenced so we didn’t run into
any use-after-free issues.
[Bug Fix]
See RenderTreeBuilder::List::updateItemMarker, line 183:
We now explicitly clear searchResult.parent before calling m_builder.destroy.
A new test has been added in list-marker-crash-1.html
[Combined Commit Message]
findParentOfEmptyOrFirstLineBox fails to find a suitable line-box parent
when we run into a block item. In this case, we fall back to creating an
anonymous block to parent the list marker. However, the anonymous block
inherites
line height and pushed the visual content down and no longer next to the list
marker,
resulting in unintended behavior.
This PR fixes the issue by detecting parenting failure due to block items
and flagging the marker to collapse its parent block.
This PR fixes the behavior for explicitly ("display: block") and implicitly
("display: flex") blockified items.
* LayoutTests/fast/lists/list-marker-before-content-table-expected.txt:
* LayoutTests/fast/lists/list-marker-crash-1-expected.txt: Added.
* LayoutTests/fast/lists/list-marker-crash-1.html: Added.
*
LayoutTests/fast/lists/list-marker-outside-flex-collapse-anonymous-block-expected.html:
Added.
*
LayoutTests/fast/lists/list-marker-outside-flex-collapse-anonymous-block.html:
Added.
*
LayoutTests/platform/glib/fast/css-generated-content/table-row-group-with-before-expected.txt:
*
LayoutTests/platform/glib/fast/css-generated-content/table-row-with-before-expected.txt:
*
LayoutTests/platform/glib/fast/css-generated-content/table-with-before-expected.txt:
* LayoutTests/platform/glib/fast/forms/form-hides-table-expected.txt:
* LayoutTests/platform/glib/fast/lists/ordered-list-with-no-ol-tag-expected.txt:
*
LayoutTests/platform/ios/fast/css-generated-content/table-row-group-with-before-expected.txt:
*
LayoutTests/platform/ios/fast/css-generated-content/table-row-with-before-expected.txt:
*
LayoutTests/platform/ios/fast/css-generated-content/table-with-before-expected.txt:
* LayoutTests/platform/ios/fast/forms/form-hides-table-expected.txt:
* LayoutTests/platform/ios/fast/lists/ordered-list-with-no-ol-tag-expected.txt:
*
LayoutTests/platform/mac/fast/css-generated-content/table-row-group-with-before-expected.txt:
*
LayoutTests/platform/mac/fast/css-generated-content/table-row-with-before-expected.txt:
*
LayoutTests/platform/mac/fast/css-generated-content/table-with-before-expected.txt:
* LayoutTests/platform/mac/fast/forms/form-hides-table-expected.txt:
* LayoutTests/platform/mac/fast/lists/ordered-list-with-no-ol-tag-expected.txt:
* Source/WebCore/layout/formattingContexts/inline/InlineQuirks.cpp:
(WebCore::Layout::InlineQuirks::shouldCollapseLineBoxHeight const):
* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:
(WebCore::LayoutIntegration::updateListMarkerAttributes):
(WebCore::LayoutIntegration::BoxTreeUpdater::createLayoutBox):
* Source/WebCore/layout/layouttree/LayoutElementBox.h:
(WebCore::Layout::ElementBox::shouldCollapseAnonymousBlockParentForListMarker
const):
* Source/WebCore/rendering/RenderListMarker.h:
* Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::findParentOfEmptyOrFirstLineBox):
(WebCore::parentCandidateForMarker):
(WebCore::RenderTreeBuilder::List::updateItemMarker):
Canonical link: https://commits.webkit.org/311221@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
