Closed Bug 1595202 Opened 2 years ago Closed 2 years ago

[wpt-sync] Sync PR 20185 - [LayoutNGFragmentPaint] Fix containing-block of OOF-positioned objects.

Categories

(Core :: Layout: Positioned, task, P4)

Product:
Core
Component:
Layout: Positioned
Type:
task

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla72
Tracking Flags:
Tracking Status
firefox72 --- fixed

People

(Reporter: mozilla.org, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 20185 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/20185
Details from upstream follow.

Ian Kilpatrick <ikilpatrick@chromium.org> wrote:

[LayoutNGFragmentPaint] Fix containing-block of OOF-positioned objects.

We had an issue in the existing invalidation code when an object could
contain an OOF-positioned node, but wasn't a LayoutBox.

This already happens when we have a LayoutInline being a
containing-block, but there are other cases where this is true.

Clusterfuzz found that LayoutTableSection falls into this category.
E.g.
The OOF-positioned node would be inserted into the nearest
containing-block (the anonymous LayoutTable in this case).

When it stopped being a containing-block, the OOF-positioned node was
never removed from the LayoutTable.

This caused a crash when the OOF's layout was invalidated.
The OOF marked itself, and the LayoutView (its new containing block)
for layout.

But the LayoutView didn't know it had this as an OOF-positioned child.

This patch moves the current logic within LayoutBlock into
LayoutBoxModelObject.

Bug: 1021491, 1021676, 1022545
Change-Id: I0f0b4c8aa655fc7edca5d79379205a8d445713d5

Reviewed-on: https://chromium-review.googlesource.com/1906708
WPT-Export-Revision: b5bf2f5995e60cfb7572e017d5f5c6fcbdd99526

Component: web-platform-tests → Layout: Positioned
Product: Testing → Core

GitHub CI Results

wpt.fyi PR Results Base Results

Ran 1 tests and 1 subtests

Firefox

OK : 1
PASS: 1

Chrome

CRASH : 1

Safari

OK : 1
PASS: 1

Gecko CI Results

Ran 1 tests and 1 subtests
OK : 1
PASS : 1

Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/66ea8382f1c2
[wpt PR 20185] - [LayoutNGFragmentPaint] Fix containing-block of OOF-positioned objects., a=testonly

https://hg.mozilla.org/mozilla-central/rev/66ea8382f1c2

Status: NEW → RESOLVED
Closed: 2 years ago
status-firefox72: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla72
You need to log in before you can comment on or make changes to this bug.