1938113 - [wpt-sync] Sync PR 49762 - Don't hold dead layout objects in the anchor query machinery.

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 49762 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/49762
Details from upstream follow.

Morten Stenshorne <[e-mail]> wrote:

Don't hold dead layout objects in the anchor query machinery.

It's possible to enter the anchor machinery while layout is dirty (from
LocalFrame::UpdateScrollSnapshots()). That's bad in itself (see
crbug.com/384523570 ), but it's equally bad to keep destroyed layout
objects around. Therefore, store Element* instead of LayoutObject*.

Bug: 381362589
Change-Id: Ifdc3b5b8c7d30977136fd9a2572ffc3354ab472d
Reviewed-on: https://chromium-review.googlesource.com/6097987
WPT-Export-Revision: a71d95efcca70349310cab7b0ad56a45b3c6bee6

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=377eb259ce52c1b22083d28e2ce975fa2e88c152

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 9 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 1 tests and 1 subtests

Status Summary

Firefox

OK : 1
PASS : 1

Chrome

CRASH: 1

Safari

OK : 1
PASS : 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a1cdd4d37aaf
[wpt PR 49762] - Don't hold dead layout objects in the anchor query machinery., a=testonly

Comment 4

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/a1cdd4d37aaf