Closed Bug 1594819 Opened 5 years ago Closed 5 years ago

[wpt-sync] Sync PR 20155 - [LayoutNG] Null-dereference in LayoutNGListItem::OrdinalValueChanged()

Categories

(Core :: Layout: Generated Content, Lists, and Counters, task, P4)

Product:
Core
Component:
Layout: Generated Content, Lists, and Counters
Type:
task

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla72
Tracking Flags:
Tracking Status
firefox72 --- fixed

People

(Reporter: mozilla.org, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 20155 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/20155
Details from upstream follow.

Alison Maher <almaher@microsoft.com> wrote:

[LayoutNG] Null-dereference in LayoutNGListItem::OrdinalValueChanged()

When LayoutNGListItem::OrdinalValueChanged() is called on an ":after"
list item element, |marker_| is a nullptr.

Similar to LayoutNGListItem::ListStyleTypeChanged(), we need to check
that |marker_| is not nullptr before invalidation to avoid
null-dereferences in this case.

Bug: 1020669
Change-Id: I66913cde0420a3612e881dab9e44a006c276ec64
Reviewed-on: https://chromium-review.googlesource.com/1902666
WPT-Export-Revision: 1cab11978ac7796971cea8d3dfa59c595b5c66dd

Component: web-platform-tests → Layout: Generated Content, Lists, and Counters
Product: Testing → Core

GitHub CI Results

wpt.fyi PR Results Base Results

Ran 1 tests

Firefox

PASS: 1

Chrome

CRASH: 1

Safari

PASS: 1

Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/752bae531463
[wpt PR 20155] - [LayoutNG] Null-dereference in LayoutNGListItem::OrdinalValueChanged(), a=testonly

https://hg.mozilla.org/mozilla-central/rev/752bae531463

Status: NEW → RESOLVED
Closed: 5 years ago
status-firefox72: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla72
You need to log in before you can comment on or make changes to this bug.