Bug 1650571 [wpt PR 24442] - [FragmentItem] Clear inline fragment for positioned objects, a=testonly

Automatic update from web-platform-tests [FragmentItem] Clear inline fragment for positioned objects This is a refix of r784685 <crrev.com/c/2275820>. When floating objects become positioned, |NGFragmentItems| can no longer track further changes or destructions. r784685 <crrev.com/c/1101277> fixed this in pre-layout, but it is possible that changes can occur before next layout cycle. This patch marks |NGFragmentItem| as moved and clears the index in |LayoutBox::StyleWillChange| instead. Logically speaking, this could happen to non-floating objects such as inline-block. Our current code reattaches when non- floating objects become positioned, so only floating objects can cause this after r784297 <crrev.com/c/2275373>. Bug: 1101818, 1101986, 1101277 Change-Id: I56e53aaf4e0b6b5b0ef78c3f75eaf3ffd3568596 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2279425 Reviewed-by: Morten Stenshorne <mstensho@chromium.org> Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/master@{#785453} -- wpt-commits: bc36542dc6e20d502f593295a989895e7cbc1960 wpt-pr: 24442
2020-07-09 14:13:55 +00:00 · 2020-07-09 14:13:55 +00:00 · 60a1a88e8c
--- a/testing/web-platform/tests/css/CSS2/positioning/detach-abspos-before-layout.html
+++ b/testing/web-platform/tests/css/CSS2/positioning/detach-abspos-before-layout.html
@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<title>Detaching positioned object before it is laid out should not crash</title>
+<link rel="author" href="mailto:kojii@chromium.org">
+<link rel="help" href="https://crbug.com/1101986">
+<meta name="assert" content="Detaching positioned object before it is laid out should not crash">
+<style>
+.float {
+  float: left;
+}
+.abs {
+  position: absolute;
+}
+</style>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+  <div id="container">text<span id="target" class="float"></span></div>
+</body>
+<script>
+test(() => {
+  document.body.offsetTop;
+  let target = document.getElementById('target');
+
+  // Change `#target` from floating object to positioned object.
+  target.classList.add('abs');
+
+  // Style recalc without layout, and detach.
+  getComputedStyle(target).display;
+  container.style.display = "none";
+}, 'No crash or DCHECK failure');
+</script>