Bug 1737024 [wpt PR 31340] - Don't expose a repeated table header to child iframes...
commite655f1641dc6b2f8fe939e428f4b779623fe23a8
authorMorten Stenshorne <mstensho@chromium.org>
Thu, 28 Oct 2021 10:24:16 +0000 (28 10:24 +0000)
committermoz-wptsync-bot <wptsync@mozilla.com>
Fri, 29 Oct 2021 10:24:29 +0000 (29 10:24 +0000)
treef767e6e78f67448c8e644be332936ad96890c9bc
parent4aeba1cb0070078d25e8f4f1c46d08a755b7357a
Bug 1737024 [wpt PR 31340] - Don't expose a repeated table header to child iframes., a=testonly

Automatic update from web-platform-tests
Don't expose a repeated table header to child iframes.

That was of course bad in the first place, but now with
LayoutNGFragmentTraversal enabled, the child iframe may be
fragment-traversable (because it's laid out with LayoutNG), while the
IFRAME element in the parent document may be inside legacy block
fragmentation. We'd end up creating multiple FragmentData objects for
the layout objects inside the IFRAME document, which is more harmful
with LayoutNGFragmentTraversal, since we expect that the number of
physical fragments be identical to the number of FragmentData objects.

Additionally reset the is_in_block_fragmentation flag when entering
frames. Leaving this unchanged didn't cause any known problems, but it's
wrong to let child frames inherit this state.

Bug: 1260855
Change-Id: Ic416f2213772d986da3597a86131e9d7956e21f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3234964
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#933975}

--

wpt-commits: fb1a123bb3dcc2389feacafc5961bd6fb7f01752
wpt-pr: 31340
testing/web-platform/tests/css/css-break/iframe-in-repeated-table-header-crash.html [new file with mode: 0644]