mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1564666 [wpt PR 17542] - [LayoutNG] Fix for incorrect Legacy containing block oof removal, a=testonly 

Automatic update from web-platform-tests
[LayoutNG] Fix for incorrect Legacy containing block oof removal

When containing block changes from being an OOF container
to not being one, it needs to remove the positioned descendants
from its list of positioned objects.

If an OOF object remains in the positioned objects list,
it will cause NGOutOfLayoutPart::SweepLegacyDescendants
to go into an infinite loop and run out of memory. This
was fixed to just trigger a DCHECK in a recent CL.

LayoutInline::StyleDidChange did not perform OOF descendant
removal correctly. LayoutInline OOF descendants are stored in
first non-anonymous block on parent chain, (container's container)
which is not the same as ContainingBlock().

Added a method that computes container's container to
LayoutObject, and made LayoutInline call it.

This fix also works for fixed, because
fixed containers are always absolute containers.

Bug: 977930
Change-Id: I9f88fe676ec67d9d6751f3502507d773ed978dc8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1680123
Commit-Queue: Aleks Totic <atotic@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#673156}

--

wpt-commits: a8405825541d608fd26f28b0af36e6b5c42fd70a
wpt-pr: 17542
This commit is contained in:
Aleks Totic 2019-07-19 18:17:09 +00:00 коммит произвёл James Graham
Родитель 51eaa7c969
Коммит 9ef4ee35c5
1 изменённых файлов: 67 добавлений и 0 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

67
testing/web-platform/tests/css/css-position/position-absolute-crash-chrome-011.html Normal file
Просмотреть файл

@ -0,0 +1,67 @@
<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<link rel="help" href="https://crbug.com/977930">
<style>
body {
margin: 20px;
}
.container {
position: relative;
}
#inline-container-absolute {
position: relative;
background: rgba(0,255,0,0.3);
}
#inline-container-fixed {
filter: blur(2px);
background: rgba(0,255,0,0.3);
}
.outofflow {
position: absolute;
width: 20px;
height: 20px;
background: green;
top:0;
left:0;
}
.splitter {
width: 100px;
height: 20px;
background: gray;
}
</style>
<div class="container">
<div>
absolute
<span id="inline-container-absolute" >
container
<div class="outofflow" style="position:absolute">A</div>
container
<div class="splitter">splitter</div>
container
</span>
</div>
</div>
<div class="container">
<div>
fixed
<span id="inline-container-fixed" >
container
<div class="outofflow" style="position:fixed">F</div>
container
<div class="splitter">splitter</div>
container
</span>
</div>
</div>
<script>
test(_ => {
document.body.offsetTop;
document.querySelector("#inline-container-absolute").style.position = 'static';
}, 'test passes if changing abspos inline container to static does not crash');
test(_ => {
document.body.offsetTop;
document.querySelector("#inline-container-fixed").style.filter = 'none';
}, 'test passes if changing fixed inline container to static does not crash');
</script>