fune/testing/web-platform/tests/css/css-layout-api/chrome-bug-1291449-crash.https.html
Morten Stenshorne c564522029 Bug 1755373 [wpt PR 32840] - Don't allow NG layout inside a forced legacy subtree., a=testonly
Automatic update from web-platform-tests
Don't allow NG layout inside a forced legacy subtree.

Display types like custom layout and MathML have no legacy
implementation, so we used to force LayoutNG on such subtrees, even if
we were already forced by the ancestry to do legacy layout. It turns out
that handling this is just too hard, at least for pre-paint. Even if we
forced NG layout in a legacy subtree, CanTraversePhysicalFragments() in
LayoutObject would still return false [1], and pre-paint would treat a
multicol container as a legacy multicol container, even if it was NG.
This won't work, because the code expects the flow thread to establish a
paint layer, which is only true if it's actually a legacy multicol
container. So we crashed.

Instead, for such display types, just create a LayoutBlockFlow if we're
inside legacy layout. These features (custom layout / MathML) will no
longer work inside a legacy subtree, but that shouldn't be much of a
problem, since we won't ship those until the legacy engine is gone
anyway.

This will break one MathML test, which has math inside an SVG
foreignObject (which is a legacy layout object). See crbug.com/989916

Remove the layout tree structure expectations from two unit tests that
assumed that we support NG inside of legacy. We'll now only check that
they don't crash.

[1] See crbug.com/1289999 - we need to prevent fragment traversal, or
the number of FragmentData objects and NGPhysicalFragment objects will
mismatch - pre-paint will slice tall monolithic content because it's in
legacy multicol (because legacy doesn't understand what monolithic
means), while NG layout has only created one NGPhysicalFragment, because
it's monolithic.

Bug: 1291449, 1296664
Change-Id: I3ebd38ccff578884678b3edeacdf482e57de7b1f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3461697
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Reviewed-by: Oriol Brufau <obrufau@igalia.com>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#970937}

--

wpt-commits: 2c6485bc2c46775f044b5c704d6ff61683b529d7
wpt-pr: 32840
2022-03-07 14:49:36 +00:00

11 lines
407 B
HTML

<!DOCTYPE html>
<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1291449">
<div style="columns:2;">
<div style="display:flex;"></div>
<div style="display:grid;"></div>
<div style="display:table;"></div>
<div style="display:layout(foo);">
<div style="columns:2;"></div>
</div>
</div>