forked from mirrors/gecko-dev
b630698a3d
Automatic update from web-platform-tests
[TablesNG] clusterfuzz stale CachedTableBorders
For table border caching, LayoutNGTable::TableGridStructureChanged must
be called whenever Table, Section, or Rows add or remove children.
I assumed that trapping AddChild and RemoveChild methods would
be sufficient to guarantee this.
Another method can add/remove children without calling Add/RemoveChild.
void MoveChildrenTo(LayoutBoxModelObject* to_box_model_object,
LayoutObject* start_child,
LayoutObject* end_child,
LayoutObject* before_child,
bool full_remove_insert = false) override;
this gets called from
LayoutBox::SplitAnonymousBoxesAroundChild
Also added a DCHECK.
Further DCHECK was found after initial crash was fixed.
ng_table_layout_algorithm.cc:466
DCHECK_EQ(table_inline_size, container_builder_.InlineSize());
This table had captions with 3689945px padding
Inside the DCHECK, table_inline_size had this line:
table_inline_size =
std::max(table_inline_size, caption_constraint.min_size);
I think this the relic from the way algorithm used to work.
Removing this line avoids the DCHECK, and all tests still pass.
InitialFragmentGeometry gets its width from calling
NGTableLayoutAlgorithm::ComputeTableInlineSize which
uses captions to compute the size, and gets its final
width from ComputeTableSizeFromColumns.
The DCHECK now gets the same size, without captions.
Thanks rr!
Bug: 1175425
Change-Id: I56ee78e2342a775c3ae21f6372cb463a90271d86
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2681426
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Commit-Queue: Aleks Totic <atotic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#851980}
--
wpt-commits: 83ca214ee3ca6b8d610c26cce75c2c06fde113e3
wpt-pr: 27531
16 lines
424 B
HTML
16 lines
424 B
HTML
<!DOCTYPE html>
|
|
<link rel="help" href="https://crbug.com/1175425">
|
|
|
|
<div id="container" style="border-collapse:collapse;">
|
|
<div id="insertBefore"></div>
|
|
<div style="display:table-row-group;"></div>
|
|
<div id="victim" style="border:solid; display:table-row-group;">
|
|
<div style="display:table-cell;"></div>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
document.body.offsetTop;
|
|
container.insertBefore(insertBefore, victim)
|
|
</script>
|
|
|