1635988 - [wpt-sync] Sync PR 23444 - [css-pseudo] Fix legacy ::marker originated by pseudo-element multicol

Status: RESOLVED FIXED

(Core :: Layout: Columns, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 23444 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/23444
Details from upstream follow.

Oriol Brufau <[e-mail]> wrote:

[css-pseudo] Fix legacy ::marker originated by pseudo-element multicol

This patch fixes a heap-use-after-free in legacy layout when having a
an inside ::marker originated by a ::before or ::after pseudo-element
which is dynamically converted into a multicol container.

The problem was caused by some code that was aiming to prevent the
::marker from being placed after the generated contents of the ::before
or ::after. To do so, it reinserted the ::marker as the first child of
the originating list item. The problem was that, in the multicol case,
the LayoutInsideListMarker is a descendant (not a child) of the
LayoutListItem, since there are a LayoutMultiColumnFlowThread and a
LayoutBlockFlow between them.

Therefore, this patch reinserts the ::marker as the first child of its
parent, instead of as the first child of the list item.

BUG=1078236

TEST=third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-list-item-002.html

Change-Id: I580e4730d6e8ec6d41e423d0d027f67de4d48fa5
Reviewed-on: https://chromium-review.googlesource.com/2185030
WPT-Export-Revision: adb34ae5f81734c4bfd033381fd46b7c55eb28a6

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=4175d8c2d095a02633dc4ebb37bf9130c938ecd8

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 0 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests

Status Summary

Firefox

PASS: 1

Chrome

PASS: 1

Safari

FAIL: 1

Links

GitHub PR Head
GitHub PR Base

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/42a3d86a2a35
[wpt PR 23444] - [css-pseudo] Fix legacy ::marker originated by pseudo-element multicol, a=testonly

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/57955425cef9
[wpt PR 23444] - [css-pseudo] Fix legacy ::marker originated by pseudo-element multicol, a=testonly

Comment 5

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/57955425cef9