[wpt-sync] Sync PR 32560 - Fragmented OOF in inline crash
Categories
(Core :: Layout, task, P4)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox99 | --- | fixed |
People
(Reporter: wpt-sync, Unassigned)
References
(Depends on 1 open bug, )
Details
(Whiteboard: [wptsync downstream])
Sync web-platform-tests PR 32560 into mozilla-central (this bug is closed when the sync is complete).
PR: https://github.com/web-platform-tests/wpt/pull/32560
Details from upstream follow.
Alison Maher <almaher@microsoft.com> wrote:
Fragmented OOF in inline crash
When an OOF is fragmented, we wait to lay it out at the fragmentation
context root. If the OOF lives above a column spanner, though, we may
lay it out early to make sure the OOF contributes to the correct column
block-size (CL:3018723).However, if a re-attach is triggered, we may end up with old fragments
sticking around until a node has completed layout (as a result of
CL:3393649).This created an issue when an OOF is laid out early as a result of a
columns spanner break. The OOF algorithm would attempt to access
old fragments since they are no longer cleared out by default in
LayoutBox::AddLayoutResult(). To handle this, remove all old items
not only when the node has completed layout, but also if an item broke
as a result of a column spanner.Bug: 1290093
Change-Id: I9b47ea681534f59ad6d1ed0662238306fcc03381Reviewed-on: https://chromium-review.googlesource.com/3415692
WPT-Export-Revision: 5926cedab75cfacb0b8e15be51fe1405a5e4a9b0
|
Assignee | |
Updated•3 years ago
|
|
|
Assignee | |
Comment 1•3 years ago
|
||
|
|
Assignee | |
Comment 2•3 years ago
|
||
CI Results
Ran 11 Firefox configurations based on mozilla-central, and Firefox, and Chrome on GitHub CI
Total 1 tests
Status Summary
Firefox
PASS: 1
Chrome
PASS: 1
Links
|
||
Comment 5•3 years ago
|
||
| bugherder | ||
Description
•