Open Bug 1629280 Opened 4 years ago Updated 4 years ago

Can end up with broken anchor chain when fragmentation is involved.

Categories

(Core :: Layout: Scrolling and Overflow, defect, P3)

Product:
Core
Component:
Layout: Scrolling and Overflow
Type:
defect

Tracking

()

People

(Reporter: emilio, Unassigned)

References

(Blocks 1 open bug)

Details

The code in ScrollAnchorContainer.cpp assumes that the parents of the scroll anchor node never change, but that doesn't hold in cases of inline and block fragmentation.

Right now the code doesn't rely on it to be safe (so it's not a security issue), but it's a sorta broken state.

Severity: -- → S3
You need to log in before you can comment on or make changes to this bug.