Closed Bug 1635988 Opened 3 months ago Closed 3 months ago

[wpt-sync] Sync PR 23444 - [css-pseudo] Fix legacy ::marker originated by pseudo-element multicol

Categories

(Core :: Layout: Columns, task, P4)

task

Tracking

()

RESOLVED FIXED
mozilla78
Tracking Status
firefox78 --- fixed

People

(Reporter: mozilla.org, Unassigned)

References

(Depends on 1 open bug, )

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 23444 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/23444
Details from upstream follow.

Oriol Brufau <obrufau@igalia.com> wrote:

[css-pseudo] Fix legacy ::marker originated by pseudo-element multicol

This patch fixes a heap-use-after-free in legacy layout when having a
an inside ::marker originated by a ::before or ::after pseudo-element
which is dynamically converted into a multicol container.

The problem was caused by some code that was aiming to prevent the
::marker from being placed after the generated contents of the ::before
or ::after. To do so, it reinserted the ::marker as the first child of
the originating list item. The problem was that, in the multicol case,
the LayoutInsideListMarker is a descendant (not a child) of the
LayoutListItem, since there are a LayoutMultiColumnFlowThread and a
LayoutBlockFlow between them.

Therefore, this patch reinserts the ::marker as the first child of its
parent, instead of as the first child of the list item.

BUG=1078236

TEST=third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-list-item-002.html

Change-Id: I580e4730d6e8ec6d41e423d0d027f67de4d48fa5
Reviewed-on: https://chromium-review.googlesource.com/2185030
WPT-Export-Revision: adb34ae5f81734c4bfd033381fd46b7c55eb28a6

Component: web-platform-tests → Layout: Columns
Product: Testing → Core

CI Results

Ran 0 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests

Status Summary

Firefox

PASS: 1

Chrome

PASS: 1

Safari

FAIL: 1

Links

GitHub PR Head
GitHub PR Base

Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/42a3d86a2a35
[wpt PR 23444] - [css-pseudo] Fix legacy ::marker originated by pseudo-element multicol, a=testonly
Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/57955425cef9
[wpt PR 23444] - [css-pseudo] Fix legacy ::marker originated by pseudo-element multicol, a=testonly
Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla78
You need to log in before you can comment on or make changes to this bug.