Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 889513d41a3470acfe26cca1ec26d09828e236f0
https://github.com/WebKit/WebKit/commit/889513d41a3470acfe26cca1ec26d09828e236f0
Author: Sammy Gill <[email protected]>
Date: 2026-04-19 (Sun, 19 Apr 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-stale-layoutbox-crash.html
M Source/WebCore/layout/integration/grid/LayoutIntegrationGridLayout.cpp
M Source/WebCore/layout/integration/grid/LayoutIntegrationGridLayout.h
Log Message:
-----------
canva.com: web content crash when moving elements around.
(WebCore::LayoutIntegration::BoxGeometryUpdater::updateLayoutBoxDimensions)
https://bugs.webkit.org/show_bug.cgi?id=312602
rdar://174932208
Reviewed by Brent Fulgham, Alan Baradlay, and Vitor Roriz.
When a grid item is removed from underneath a grid box we fail to
properly clean up the tree. This is because we do not have any
integration logic that hooks into the layout tree for grid when a
RenderGrid loses a renderer. This may end up causing a crash in the grid
integration code when we try to access a renderer that was removed from
the render tree.
For now we can just tear down the subtree at the end of grid layout,
which is what we currently do for FFC as well. We will probably want to
revisit this later but it is a good start to at least avoid these types
of crashes.
Test:
imported/w3c/web-platform-tests/css/css-grid/grid-stale-layoutbox-crash.html
Canonical link: https://commits.webkit.org/311552@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
