[wpt-sync] Sync PR 23279 - [FragmentItem] Prevent dangling LayoutObject ptrs in block fragmentation.
Categories
(Core :: Layout, task, P4)
Tracking
()
Tracking | Status | |
---|---|---|
firefox77 | --- | fixed |
People
(Reporter: wpt-sync, Unassigned)
References
()
Details
(Whiteboard: [wptsync downstream])
Sync web-platform-tests PR 23279 into mozilla-central (this bug is closed when the sync is complete).
PR: https://github.com/web-platform-tests/wpt/pull/23279
Details from upstream follow.
Morten Stenshorne <mstensho@chromium.org> wrote:
[FragmentItem] Prevent dangling LayoutObject ptrs in block fragmentation.
NGInlineCursor doesn't work with block fragmentation, so we'd end up
with NGFragmentItem objects with dangling pointers to LayoutObject. To
fix this, perform a full walk through all fragment items in all
fragments, if it's likely that we're in block fragmentation.CL:2152824 caused two tests to crash because of this, and it therefore
got reverted. Add another test now, which would also crash without the
aforementioned CL.Bug: 1075517
Change-Id: I97e2fae63d89031ea258ba146898e7fcfe56bd45Reviewed-on: https://chromium-review.googlesource.com/2165800
WPT-Export-Revision: c98e68503249ee38583f618028196177f4921496
Assignee | ||
Updated•5 years ago
|
Assignee | ||
Comment 1•5 years ago
|
||
Assignee | ||
Comment 2•5 years ago
|
||
CI Results
Ran 13 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI
Total 68 tests
Status Summary
Firefox
OK : 1
PASS: 1[GitHub] 68[Gecko-android-em-7.0-x86_64-debug-geckoview, Gecko-android-em-7.0-x86_64-opt-geckoview, Gecko-linux1804-64-asan-opt, Gecko-linux1804-64-debug, Gecko-linux1804-64-opt, Gecko-linux1804-64-qr-debug, Gecko-linux1804-64-qr-opt, Gecko-windows10-64-debug, Gecko-windows10-64-opt, Gecko-windows10-64-qr-debug, Gecko-windows10-64-qr-opt, Gecko-windows7-32-debug, Gecko-windows7-32-opt]
Chrome
OK : 1
PASS: 1
Safari
OK : 1
PASS: 1
Links
Comment 5•5 years ago
|
||
bugherder |
Description
•