Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d20ce080371f970c61327ee7b0b5eea43d11c0ce
https://github.com/WebKit/WebKit/commit/d20ce080371f970c61327ee7b0b5eea43d11c0ce
Author: Alan Baradlay <[email protected]>
Date: 2026-09-10 (Thu, 10 Sep 2026)
Changed paths:
A
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-character-positions-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-character-positions.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-display-changed-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-display-changed.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-removed-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-removed.html
A
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-text-inserted-expected.txt
A
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-text-inserted.html
M Source/WebCore/rendering/svg/RenderSVGInline.cpp
M Source/WebCore/rendering/svg/RenderSVGInline.h
M Source/WebCore/rendering/updating/RenderTreeUpdater.cpp
M Source/WebCore/svg/SVGTextPositioningElement.cpp
Log Message:
-----------
[SVG] Mutating a display: contents tspan inside SVG text crashes with
anonymous inline wrapper
https://bugs.webkit.org/show_bug.cgi?id=323710
<rdar://problem/186967160>
Reviewed by Antti Koivisto.
RenderTreeUpdater::createTextRenderer wraps a text renderer in an anonymous
RenderInline to carry a display: contents style.
Inside SVG text that wrapper has to be a RenderSVGInline, because everything
walking SVG text looks for one:
1. RenderSVGText::subtreeChildWasAdded/subtreeChildWillBeRemoved skip it, so
the layout attributes
cache goes stale and checkLayoutAttributesConsistency asserts on removal, on
text insertion and on a display change.
2. SVGTextLayoutAttributesBuilder and SVGTextMetricsBuilder do not descend into
it, so its text is never measured and getStartPositionOfChar() hangs.
Create it as an anonymous RenderSVGInline instead.
Tests:
imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-character-positions.html
imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-display-changed.html
imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-removed.html
imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-text-inserted.html
*
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-character-positions-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-character-positions.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-display-changed-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-display-changed.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-removed-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-removed.html:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-text-inserted-expected.txt:
Added.
*
LayoutTests/imported/w3c/web-platform-tests/css/css-display/display-contents-svg-tspan-child-text-inserted.html:
Added.
* Source/WebCore/rendering/svg/RenderSVGInline.cpp:
(WebCore::RenderSVGInline::RenderSVGInline):
(WebCore::RenderSVGInline::styleDidChange):
(WebCore::RenderSVGInline::needsHasSVGTransformFlags):
* Source/WebCore/rendering/svg/RenderSVGInline.h:
* Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::createTextRenderer):
* Source/WebCore/svg/SVGTextPositioningElement.cpp:
(WebCore::SVGTextPositioningElement::elementFromRenderer):
Canonical link: https://commits.webkit.org/320865@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
