From 64119a7af7bb9082fefeb8a04242a6377f372012 Mon Sep 17 00:00:00 2001 From: Cathie Chen Date: Mon, 25 Nov 2019 16:23:36 +0000 Subject: [PATCH] Bug 1594499 [wpt PR 20132] - Fixed crash issue when list inside a contain element, a=testonly Automatic update from web-platform-tests Fixed crash issue when list inside a contain element ListItem will check the layout tree position of marker if the subtree of li is changed which sets lifecycle state to kInLayoutSubtreeChange. Marker might be reattached which will cause relayout. If it's inside a contain element, it will trigger ScheduleRelayoutOfSubtree which requires lifecycle state <= kStyleClean. So there's a DCHECK failure. To fix this, make sure don't change marker layout tree position unless li is NormalChildNeedsLayout which can stop marker triggering ScheduleRelayoutOfSubtree. And adding restriction to reattach marker. Bug: 1004764 Change-Id: Id7c8aedafb2deed21d48f726d54a51f4f346e7b0 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1901011 Commit-Queue: Koji Ishii Reviewed-by: Koji Ishii Cr-Commit-Position: refs/heads/master@{#713066} -- wpt-commits: c6b843402f1c2a68aeebe1f153107cb238f355cc wpt-pr: 20132 --- .../tests/css/css-lists/list-inside-contain.html | 30 ++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 testing/web-platform/tests/css/css-lists/list-inside-contain.html diff --git a/testing/web-platform/tests/css/css-lists/list-inside-contain.html b/testing/web-platform/tests/css/css-lists/list-inside-contain.html new file mode 100644 index 000000000000..dc06eab97ea6 --- /dev/null +++ b/testing/web-platform/tests/css/css-lists/list-inside-contain.html @@ -0,0 +1,30 @@ + + + + CSS Lists: list inside a contain ul + + + + + + + + + + + +

PASS if no crash or DCHECK failure.

+
    +
  • +
    • +
+ -- 2.11.4.GIT