Closed Bug 1790664 Opened 5 months ago Closed 4 months ago

[wpt-sync] Sync PR 35883 - Invalidate filter chain when detaching filter primitive LayoutObject

Categories

(Core :: Web Painting, task, P4)

task

Tracking

()

RESOLVED FIXED
107 Branch
Tracking Status
firefox107 --- fixed

People

(Reporter: mozilla.org, Unassigned)

References

()

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 35883 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/35883
Details from upstream follow.

Fredrik Söderquist <fs@opera.com> wrote:

Invalidate filter chain when detaching filter primitive LayoutObject

If the LayoutObject for a filter primitive was detached (by for example
setting 'display' to 'none' or 'contents'), and then said primitive was
mutated while still holding a, supposed valid, FilterEffect, the
mutation could cause a crash while accessing its ComputedStyle.

Invalidate the filter chain when a filter primitive is detached from the
layout tree to make sure the cached chain state is consistent.

Fixed: 1274176
Change-Id: Iad3b36afbd11397e7fa0c2297fb575b506c4486a
Reviewed-on: https://chromium-review.googlesource.com/3894111
WPT-Export-Revision: 11b737cf2a8bbfbe5a18dc3da309d7d16472aa14

Component: web-platform-tests → Web Painting
Product: Testing → Core

CI Results

Ran 0 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests

Status Summary

Firefox

PASS : 1

Chrome

CRASH: 1

Safari

PASS : 1

Links

GitHub PR Head
GitHub PR Base

Severity: -- → N/A
Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/90eb3b457c57
[wpt PR 35883] - Invalidate filter chain when detaching filter primitive LayoutObject, a=testonly
Status: NEW → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → 107 Branch
You need to log in before you can comment on or make changes to this bug.