[wpt-sync] Sync PR 32665 - Notify the flow thread about descendant removal in time.
Categories
(Core :: Layout: Columns, task, P4)
Tracking
()
Tracking | Status | |
---|---|---|
firefox99 | --- | fixed |
People
(Reporter: wpt-sync, Unassigned)
References
(Depends on 1 open bug, )
Details
(Whiteboard: [wptsync downstream])
Sync web-platform-tests PR 32665 into mozilla-central (this bug is closed when the sync is complete).
PR: https://github.com/web-platform-tests/wpt/pull/32665
Details from upstream follow.
Morten Stenshorne <mstensho@chromium.org> wrote:
Notify the flow thread about descendant removal in time.
With LayoutNGBlockInInline enabled, it's possible to have a spanner
block inside an inline. The flow thread keeps track of all the spanners,
and the column rows between them, by inserting anonymous spanner
placeholder and column set objects. When modifying the tree, the flow
thread may need to add or remove spanner placeholders, and merge and
split column sets. When removing elements from the tree, it was possible
for such two spanners to swap order (because two anonymous blocks were
merged into one), without the flow thread noticing, and the spanner
placeholder / column set structure wasn't updated. And we'd crash.Therefore, update the flow thread a bit earlier, before
LayoutBlockFlow::RemoveChild() gets to have too much fun with the tree
structure.Bug: 1292004
Change-Id: Ic4d76d2851fbc1bd9d2dbacc9f350dc21f24a11c
Reviewed-on: https://chromium-review.googlesource.com/3432406
WPT-Export-Revision: c6cae0ea4ed689e37d122caf148d619357c0969e
Assignee | ||
Updated•3 years ago
|
Assignee | ||
Comment 1•3 years ago
|
||
Assignee | ||
Comment 3•3 years ago
|
||
Assignee | ||
Comment 5•3 years ago
|
||
Comment 6•3 years ago
|
||
bugherder |
Description
•