mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-26 03:35:33 +00:00
Bug 1570618 [wpt PR 18232] - Use To<Dynamic> for rebuild root to make sure we don't crash., a=testonly
Automatic update from web-platform-tests Use To<Dynamic> for rebuild root to make sure we don't crash. We were able to SetNeedsReattachLayoutTree() on a Text node where none of the ancestor elements had a LayoutObject and the Document had a <br> as a documentElement. The reason is that LayoutView does not allow a LayoutBr child which meant we recomputed styles for the whole subtree, but no LayoutObjects were created. Setting the text data on the text node would mark it for re-attachment (in case it didn't have a LayoutText because it used to be a non-rendered white-space). If it was in a display:none subtree we wouldn't have reached the text node during recalc, but because of LayoutView rejecting the LayoutBr, we already had ComputedStyle all the way. Bug: 989827 Change-Id: I72ae371466e607baf4caffad9ed634beb2a66bf5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1731112 Reviewed-by: Anders Hartvoll Ruud <andruud@chromium.org> Commit-Queue: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#683135} -- wpt-commits: ec90c902eeb0612dbce30047ff51414c8b26d603 wpt-pr: 18232
This commit is contained in:
parent
76d3429127
commit
b50a1dda79
@ -0,0 +1,18 @@
|
||||
<!DOCTYPE html>
|
||||
<title>CSS Text Test: Chrome pre-line crash test</title>
|
||||
<link rel="help" href="https://crbug.com/989827">
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<style>
|
||||
br { white-space: pre-line }
|
||||
</style>
|
||||
<script>
|
||||
test(() => {
|
||||
document.documentElement.remove();
|
||||
const br = document.createElement("br");
|
||||
br.appendChild(document.createTextNode(""));
|
||||
document.appendChild(br);
|
||||
br.offsetTop;
|
||||
br.firstChild.data = " ";
|
||||
}, "Modifying data of a text child of a root br element with pre-line should not crash.");
|
||||
</script>
|
Loading…
Reference in New Issue
Block a user