Bug 259243

Summary: ASSERTION FAILED: formattingContextRoot.hasChild() when flex item contains certain inline child
Product: WebKit Reporter: Ethan Wong <bunnnywong>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: bfulgham, simon.fraser, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Attachments:
Description Flags
A case to reproduce this assertion none

Description Ethan Wong 2023-07-15 08:25:42 PDT 
Created attachment 467050 [details]
A case to reproduce this assertion

When both IFC and FFC enabled, `ASSERT(formattingContextRoot.hasChild())` at `FormattingContext::FormattingContext(const ElementBox&, FormattingState&)` triggers when the flex item contains certain inline child.

One of my pages triggers this assertion while debugging, which could be simplified into the attached reproducible case.

I believe this issue is different from [the previous bug](https://bugs.webkit.org/show_bug.cgi?id=257802).

For the attached case, `LayoutIntegration::LineLayout` was first created from `RenderBlockFlow::tryComputePreferredWidthsUsingModernPath`. Then comes to laying out the flexbox, which creates `LayoutIntegration::FlexLayout` and replaces the inline renderer's layout box while building the new tree. When it comes to `RenderBlockFlow::layoutModernLines`, the wrong box was used.
Comment 1 zalan 2023-07-15 12:11:13 PDT 
Thanks! At this point FFC is highly experimental (and I don't believe there's a WebKit based browser with such shipping configuration) so assertions like this are expected.
Comment 2 Radar WebKit Bug Importer 2023-07-22 08:26:17 PDT 
<rdar://problem/112709809>