1550961 - [wpt-sync] Sync PR 16684 - Don't modify LayoutObjects about to be detached.

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P4)

Description

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 16684 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/16684
Details from upstream follow.

Rune Lillesveen <[e-mail]> wrote:

Don't modify LayoutObjects about to be detached.

After postponing DetachLayoutTree until the next lifecycle update for
cases where we synchronously detached from LazyReattachedIfAttached(),
there are DidRecalcStyle() callbacks accessing LayoutObjects which
previously did not have LayoutObjects. Check if they are about to be
detached/deleted before doing any updates on them.

In particular, this caused a crash for changing input type where there
was an inconsitency between the type attribute and the LayoutObject
type.

Bug: 958944
Change-Id: If00618b907fc627987bfcb88cc88199c98049314
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1594757
Commit-Queue: Rune Lillesveen \<[e-mail]>
Reviewed-by: Morten Stenshorne \<[e-mail]>
Cr-Commit-Position: refs/heads/master@{#656772}

Comment 1

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Pushed to try https://treeherder.mozilla.org/#/jobs?repo=try&revision=51d91c94444dc864f77cff600a257add78ea9b92

Comment 2

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=b63e1d6041a298bc6e6667411e7002d97fc5ba32

Comment 3

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Failed to get results from try push

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e0c0b56fdb68
[wpt PR 16684] - Don't modify LayoutObjects about to be detached., a=testonly

Comment 5

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/e0c0b56fdb68