Changeset 295081 in webkit

Timestamp:

May 31, 2022 10:27:39 PM (2 years ago)

Author:

Alan Bujtas

Message:

DOM order may not be sufficient when constructing the LogicalFlexItemList
​https://bugs.webkit.org/show_bug.cgi?id=241166

Reviewed by Antti Koivisto.

We need to hold on to a reference to the layout box in case logical order != DOM order.

• Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:

(WebCore::Layout::FlexFormattingContext::convertFlexItemsToLogicalSpace):

Canonical link: ​https://commits.webkit.org/251176@main

File:

• trunk/Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp (modified) (3 diffs)

trunk/Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp

@@ -153 +153 @@
         FlexRect marginRect;
         int logicalOrder { 0 };
+        CheckedPtr<const ContainerBox> layoutBox;
     };
 
@@ -202 +203 @@
             previousLogicalOrder = flexItemOrder;
 
-            flexItemList.append({ { logicalSize }, flexItemOrder });
+            flexItemList.append({ { logicalSize }, flexItemOrder, downcast<ContainerBox>(flexItem) });
         }
     };
@@ -218 +219 @@
 
     auto logicalFlexItemList = FlexLayout::LogicalFlexItems(flexItemList.size());
-    auto* layoutBox = root().firstInFlowChild();
-    for (size_t index = 0; index < flexItemList.size(); ++index) {
-        logicalFlexItemList[index] = { flexItemList[index].marginRect, downcast<ContainerBox>(layoutBox) };
-        layoutBox = layoutBox->nextInFlowSibling();
-    }
+    for (size_t index = 0; index < flexItemList.size(); ++index)
+        logicalFlexItemList[index] = { flexItemList[index].marginRect, flexItemList[index].layoutBox };
     return logicalFlexItemList;
 }