Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-26 03:35:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1570618 [wpt PR 18232] - Use To<Dynamic> for rebuild root to make sure we don't crash., a=testonly

Browse Source 
Automatic update from web-platform-tests
Use To<Dynamic> for rebuild root to make sure we don't crash.

We were able to SetNeedsReattachLayoutTree() on a Text node where none
of the ancestor elements had a LayoutObject and the Document had a <br>
as a documentElement. The reason is that LayoutView does not allow a
LayoutBr child which meant we recomputed styles for the whole subtree,
but no LayoutObjects were created. Setting the text data on the text
node would mark it for re-attachment (in case it didn't have a
LayoutText because it used to be a non-rendered white-space). If it was
in a display:none subtree we wouldn't have reached the text node during
recalc, but because of LayoutView rejecting the LayoutBr, we already had
ComputedStyle all the way.

Bug: 989827
Change-Id: I72ae371466e607baf4caffad9ed634beb2a66bf5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1731112
Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#683135}

--

wpt-commits: ec90c902eeb0612dbce30047ff51414c8b26d603
wpt-pr: 18232
This commit is contained in:
Rune Lillesveen 2019-08-06 17:23:42 +00:00 committed by moz-wptsync-bot
parent 76d3429127
commit b50a1dda79
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
testing/web-platform/tests/css/css-text/white-space/pre-line-br-with-whitespace-child-crash.html Normal file
View File

@ -0,0 +1,18 @@
<!DOCTYPE html>
<title>CSS Text Test: Chrome pre-line crash test</title>
<link rel="help" href="https://crbug.com/989827">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<style>
br { white-space: pre-line }
</style>
<script>
test(() => {
document.documentElement.remove();
const br = document.createElement("br");
br.appendChild(document.createTextNode(""));
document.appendChild(br);
br.offsetTop;
br.firstChild.data = " ";
}, "Modifying data of a text child of a root br element with pre-line should not crash.");
</script>