mirror of
https://github.com/mozilla/gecko-dev.git
synced 2025-11-12 22:28:59 +02:00
3b7784d1bd
Automatic update from web-platform-tests [FragmentItem] Prevent dangling LayoutObject ptrs in block fragmentation. NGInlineCursor doesn't work with block fragmentation, so we'd end up with NGFragmentItem objects with dangling pointers to LayoutObject. To fix this, perform a full walk through all fragment items in all fragments, if it's likely that we're in block fragmentation. CL:2152824 caused two tests to crash because of this, and it therefore got reverted. Add another test now, which would also crash without the aforementioned CL. Bug: 1075517 Change-Id: I97e2fae63d89031ea258ba146898e7fcfe56bd45 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2165800 Reviewed-by: Koji Ishii <kojii@chromium.org> Commit-Queue: Morten Stenshorne <mstensho@chromium.org> Cr-Commit-Position: refs/heads/master@{#763233} -- wpt-commits: e9ed833d0c9483012493d839434137de7e7ba00d wpt-pr: 23279
21 lines
611 B
HTML
21 lines
611 B
HTML
<!DOCTYPE html>
|
|
<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
|
|
<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1075517">
|
|
<div style="columns:2; column-fill:auto; line-height:20px; height:50px;">
|
|
<div>
|
|
<span id="removeme">
|
|
line1<br>
|
|
line2<br>
|
|
line3<br>
|
|
line4<br>
|
|
</span>
|
|
</div>
|
|
</div>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<script>
|
|
test(()=> {
|
|
document.body.offsetTop;
|
|
removeme.style.display = "none";
|
|
}, "no crash");
|
|
</script>
|