Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 29bf4c712904a33ab247f5c131dedd86dea463cb
https://github.com/WebKit/WebKit/commit/29bf4c712904a33ab247f5c131dedd86dea463cb
Author: Antti Koivisto <[email protected]>
Date: 2026-10-14 (Wed, 14 Oct 2026)
Changed paths:
A
LayoutTests/fast/inline/remove-content-after-intrinsic-width-computation-outside-layout-expected.txt
A
LayoutTests/fast/inline/remove-content-after-intrinsic-width-computation-outside-layout.html
A
LayoutTests/fast/inline/remove-content-and-read-display-content-before-layout-expected.html
A
LayoutTests/fast/inline/remove-content-and-read-display-content-before-layout.html
A
LayoutTests/fast/inline/remove-text-and-line-break-partial-layout-expected.html
A LayoutTests/fast/inline/remove-text-and-line-break-partial-layout.html
A
LayoutTests/fast/lists/remove-nested-list-marker-after-intrinsic-width-computation-outside-layout-expected.txt
A
LayoutTests/fast/lists/remove-nested-list-marker-after-intrinsic-width-computation-outside-layout.html
A
LayoutTests/fast/repaint/remove-line-break-partial-layout-repaint-expected.txt
A LayoutTests/fast/repaint/remove-line-break-partial-layout-repaint.html
M Source/WebCore/layout/formattingContexts/inline/InlineContentCache.h
M
Source/WebCore/layout/formattingContexts/inline/invalidation/InlineDamage.h
M
Source/WebCore/layout/formattingContexts/inline/invalidation/InlineInvalidation.cpp
M
Source/WebCore/layout/formattingContexts/inline/invalidation/InlineInvalidation.h
M Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp
M Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.h
M Source/WebCore/layout/integration/inline/InlineIteratorBox.h
M
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp
M
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.h
M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp
M Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h
M Source/WebCore/page/LocalFrameViewLayoutContext.cpp
M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
Log Message:
-----------
[IFC] Don't keep removed layout boxes alive in InlineDamage
https://bugs.webkit.org/show_bug.cgi?id=327384
rdar://problem/189893908
Reviewed by Alan Baradlay.
We kept removed layout boxes alive in InlineDamage after partial invalidation
because they could
still be referenced by inline items, display boxes, caches and intrinsic width
state.
This patch changes the model so that we drop all those references instead and
the normal destruction
flow (which may still be delayed) is followed. Inline items and caches past the
damage point are
released and the display content is truncated at the damaged line. All of it
would be rebuilt by the
next layout anyway. The next layout appends its lines to what is left.
Removals no longer use the partial layout early exit. It doesn't currently
trigger anyway because of
an off-by-one in InlineDamage::trailingContentForLine. Insertions keep it.
The patch also fixes an issue where a partial invalidation attempt of
never-laid-out content could leave
stale references behind from intrinsic width computation. This is now limited
to text/<br> content only,
which was anyway the only path that worked. In other cases the layout is
invalidated.
*
LayoutTests/fast/inline/remove-content-after-intrinsic-width-computation-outside-layout-expected.txt:
Added.
*
LayoutTests/fast/inline/remove-content-after-intrinsic-width-computation-outside-layout.html:
Added.
Remove text that was never laid out but has inline items from intrinsic width
computation outside of
layout (marquee start). Also with immediate renderer destruction, where a stale
reference is a use
after free.
*
LayoutTests/fast/inline/remove-content-and-read-display-content-before-layout-expected.html:
Added.
*
LayoutTests/fast/inline/remove-content-and-read-display-content-before-layout.html:
Added.
A second removal before layout reads the truncated display content, here for a
text whose boxes
continue on the dropped lines, for never laid out text removed after a line
break and for SVG text.
*
LayoutTests/fast/inline/remove-text-and-line-break-partial-layout-expected.html:
Added.
* LayoutTests/fast/inline/remove-text-and-line-break-partial-layout.html: Added.
Partial layout after removing laid out text and line breaks matches a fresh
layout. SVG text has no
damaged line and drops all of its lines.
*
LayoutTests/fast/lists/remove-nested-list-marker-after-intrinsic-width-computation-outside-layout-expected.txt:
Added.
*
LayoutTests/fast/lists/remove-nested-list-marker-after-intrinsic-width-computation-outside-layout.html:
Added.
Remove a never laid out list marker that intrinsic width computation outside of
layout set up. Non text
content takes the full invalidation path.
*
LayoutTests/fast/repaint/remove-line-break-partial-layout-repaint-expected.txt:
Added.
* LayoutTests/fast/repaint/remove-line-break-partial-layout-repaint.html: Added.
Removing a line break repaints the dropped lines, including the old last line,
but not the lines before
the damage.
* Source/WebCore/layout/formattingContexts/inline/InlineContentCache.h:
(WebCore::Layout::InlineContentCache::InlineItems::removeItemsReplacedByRebuild):
* Source/WebCore/layout/formattingContexts/inline/invalidation/InlineDamage.h:
(WebCore::Layout::InlineDamage::setDisplayContentTruncated):
(WebCore::Layout::InlineDamage::hasTruncatedDisplayContent const):
(WebCore::Layout::InlineDamage::truncatedContentInkOverflow const):
(WebCore::Layout::InlineDamage::resetLayoutPosition):
(WebCore::Layout::InlineDamage::addDetachedBox): Deleted.
(WebCore::Layout::InlineDamage::hasDetachedContent const): Deleted.
(WebCore::Layout::InlineDamage::~InlineDamage): Deleted.
*
Source/WebCore/layout/formattingContexts/inline/invalidation/InlineInvalidation.cpp:
(WebCore::Layout::InlineInvalidation::inlineItemListWillChange):
(WebCore::Layout::InlineInvalidation::isSafeToRemoveWithoutFullInvalidation):
*
Source/WebCore/layout/formattingContexts/inline/invalidation/InlineInvalidation.h:
* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:
(WebCore::LayoutIntegration::BoxTreeUpdater::remove):
* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.h:
* Source/WebCore/layout/integration/inline/InlineIteratorBox.h:
(WebCore::InlineIterator::Box::traverseNextTextBox):
*
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:
(WebCore::LayoutIntegration::InlineContentBuilder::handlePartialDisplayContentUpdate
const):
(WebCore::LayoutIntegration::InlineContentBuilder::truncateDisplayContent
const):
(WebCore::LayoutIntegration::InlineContentBuilder::appendToTruncatedDisplayContent
const):
*
Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.h:
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:
(WebCore::LayoutIntegration::LineLayout::layout):
(WebCore::LayoutIntegration::LineLayout::isContentConsideredStale const):
(WebCore::LayoutIntegration::LineLayout::removedFromTree):
(WebCore::LayoutIntegration::LineLayout::removeLayoutBox):
(WebCore::LayoutIntegration::LineLayout::releaseContentRebuiltFromDamage):
* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.h:
(WebCore::LayoutIntegration::LineLayout::hasTruncatedDisplayContent const):
(WebCore::LayoutIntegration::LineLayout::hasDetachedContent const): Deleted.
* Source/WebCore/page/LocalFrameViewLayoutContext.cpp:
(WebCore::RenderTreeNeedsLayoutChecker::~RenderTreeNeedsLayoutChecker):
* Source/WebCore/rendering/updating/RenderTreeBuilder.cpp:
(WebCore::invalidateLineLayout):
Honor removedFromTree's result on the never laid out path too.
Canonical link: https://commits.webkit.org/323737@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
