2024319 - [wpt-sync] Sync PR 58566 - Iterate on copy of layout subtree roots during LFV::PerformLayout()

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 58566 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/58566
Details from upstream follow.

Anders Hartvoll Ruud <[e-mail]> wrote:

Iterate on copy of layout subtree roots during LFV::PerformLayout()

During iteration of LocalFrameView::layout_subtree_root_list_
in PerformLayout(), we can do interleaved style and layout tree
building due to e.g. container queries. Such layout tree rebuilds
can destroy the LayoutObjects being subtree roots,
and call LocalFrameView::ClearLayoutSubtreeRoot() in the process,
modifying layout_subtree_root_list_ during the iteration.

To fix this, iterate on a copy of the layout subtree roots instead.
Note that even though we do clear layout_subtree_root_list_ immediately
after iteration, we can not just std::move the list to a local,
since we need to discover (and skip) the roots that were removed
during previous iterations.

Fixed: 491994185
Change-Id: I729e3df6e938533467ff4d45e66c666fe27a83c0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7669842
Commit-Queue: Anders Hartvoll Ruud \<[e-mail]>
Reviewed-by: Morten Stenshorne \<[e-mail]>
Cr-Commit-Position: refs/heads/main@{#1600948}

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=d13d2953817b30115e994d4bd0da9f53d458ae4f

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 11 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 59 tests

Status Summary

Firefox

PASS : 1[GitHub] 59[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2204-64-wayland-debug, Gecko-linux2204-64-wayland-opt, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-24h2-debug, Gecko-windows11-32-24h2-opt, Gecko-windows11-64-24h2-debug, Gecko-windows11-64-24h2-opt]

Chrome

CRASH: 1

Safari

PASS : 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/3d6f70acdc4f
https://hg.mozilla.org/integration/autoland/rev/a10ccb7f9fb6
[wpt PR 58566] - Iterate on copy of layout subtree roots during LFV::PerformLayout(), a=testonly

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/a10ccb7f9fb6