forked from mirrors/gecko-dev
4dbfe8db3f
Automatic update from web-platform-tests [TablesNG] clusterfuzz: Fix underinvalidation when rowspan changes Clusterfuzz found a bug where ComputeMinimumRowBlockSize was accessing out of bounds column_locations. Cause: Table had dimensions 1x2 One cell mutates rowspan to 22 Table layout does not get invalidated, which causes CachedTableColumnConstraints not to get invalidated. This is because CachedTableColumnConstraints are cleared on SetNeedsLayout for table. Somehow, table does get relayout. This only happens when running inside test runner. My guess is that the runner somehow causes relayout without calling SetNeedsLayout. During relayout, table dimensions are now 2x2. But we only have 1 column, so go out of bounds when traversing column array. The fix is to invalidate table layout when colspan/rowspan change. This can be done in 2 places 1) Invalidate table layout in LayoutNGTableCell::ColSpanOrRowSpanChanged 2) Invalidate table layout in LayoutNGTable::TableGridStructureChanged TableGridStructureChanged also gets called when table parts are added/removed. All the other callers so far also call SetNeedsLayout. I've opted for 2), because table will always need layout when its structure changes. This bug also caused table not to relayout when rowspan/colspan changed. wpt test tests this. Bug: 1172651 Change-Id: I85496864eb0da7ff1bdacb58483bc1295a00e9bd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2661207 Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org> Commit-Queue: Aleks Totic <atotic@chromium.org> Cr-Commit-Position: refs/heads/master@{#849799} -- wpt-commits: b2f1be13c32f94a95880525543a7a78153df5571 wpt-pr: 27413
45 lines
1.1 KiB
HTML
45 lines
1.1 KiB
HTML
<!doctype html>
|
|
<script src='/resources/testharness.js'></script>
|
|
<script src='/resources/testharnessreport.js'></script>
|
|
<script src='/resources/check-layout-th.js'></script>
|
|
<link rel="author" href="mailto:atotic@chromium.org">
|
|
<link rel="help" href="https://html.spec.whatwg.org/multipage/tables.html#the-td-element">
|
|
<meta name="assert" content="Dynamic changes to rowspan/colspan relayout the table" />
|
|
<style>
|
|
main table {
|
|
border-spacing:0;
|
|
}
|
|
main td {
|
|
background: green;
|
|
width:50px;
|
|
height:50px;
|
|
padding: 0;
|
|
}
|
|
</style>
|
|
|
|
<main>
|
|
<table data-expected-width="100">
|
|
<tr>
|
|
<td id="rowspan_target"></td>
|
|
</tr>
|
|
<tr>
|
|
<td></td>
|
|
</tr>
|
|
</table>
|
|
<br>
|
|
<table data-expected-width="150">
|
|
<col style="width:50px">
|
|
<col style="width:50px">
|
|
<tr>
|
|
<td id="colspan_target"></td>
|
|
<td></td>
|
|
</tr>
|
|
</table>
|
|
</main>
|
|
|
|
<script>
|
|
document.body.offsetTop;
|
|
document.querySelector("#rowspan_target").setAttribute("rowspan", "2");
|
|
document.querySelector("#colspan_target").setAttribute("colspan", "2");
|
|
checkLayout("main table");
|
|
</script>
|