mirror of
https://github.com/mozilla/gecko-dev.git
synced 2025-11-11 13:48:23 +02:00
866f898fc8
Automatic update from web-platform-tests [LayoutNG] Fix invalid memory access after reallocations This patch fixes use-after-free when memory reallocation occurs by adding BoxData for bidi inline fragmentations. Bug: 925247, 961943 Change-Id: I5c2cd26546b45772fbff7d001d9e98e49ab19461 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1607719 Commit-Queue: Koji Ishii <kojii@chromium.org> Reviewed-by: Emil A Eklund <eae@chromium.org> Cr-Commit-Position: refs/heads/master@{#658976} -- wpt-commits: 1dbbc8d45e217ba1e0416da825c429d3e6336ad4 wpt-pr: 16793
29 lines
654 B
HTML
29 lines
654 B
HTML
<!DOCTYPE html>
|
|
<title>CSS Writing Modes Test: many levels of bidi inline fragmentations does not crash</title>
|
|
<link rel="help" href="http://crbug.com/925247">
|
|
<link rel="author" title="Koji Ishii" href="mailto:kojii@chromium.org">
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<style>
|
|
span {
|
|
border: blue solid 2px;
|
|
}
|
|
</style>
|
|
<body>
|
|
<div>
|
|
<span>
|
|
1‮2‭
|
|
<span>3‮4‭
|
|
<span>5‮6‭
|
|
<span>7‮8‭</span>
|
|
</span>
|
|
</span>
|
|
</span>
|
|
x
|
|
</div>
|
|
<script>
|
|
test(() => {
|
|
document.body.offsetTop;
|
|
});
|
|
</script>
|
|
</body>
|