Bug 1791660 [wpt PR 35983] - FrameSet NG: Fix a crash on re-showing a sub FRAMESET, a=testonly
authorKent Tamura <tkent@chromium.org>
Wed, 21 Sep 2022 19:59:13 +0000
changeset 636376 b94aa45bb89ee590a9190d1f934c7a3015c3a4ef
parent 636375 70c66fa2f9aa0ede4d7b3a63f71d706c81fb7ed7
child 636377 ebe88a8dd2eebb27681e1770d9d36aabd095f21c
push id40262
push usermlaza@mozilla.com
push dateSat, 24 Sep 2022 09:33:46 +0000
treeherdermozilla-central@50f72898d7b8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstestonly
bugs1791660, 35983, 1365048, 3904719, 1049471
milestone107.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1791660 [wpt PR 35983] - FrameSet NG: Fix a crash on re-showing a sub FRAMESET, a=testonly Automatic update from web-platform-tests FrameSet NG: Fix a crash on re-showing a sub FRAMESET We clear NeedsLayout flags of FRAMESET children which are not fit in the FRAMESET's grid. We should clear their NGPhysicalFragments too in order not to re-use stale fragment trees when a child fits in the grid again. Bug: 1365048 Change-Id: I638f68eba61d557b1aede9d4f686998f0c774d60 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3904719 Auto-Submit: Kent Tamura <tkent@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Reviewed-by: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1049471} -- wpt-commits: b4cafb54ac6b0835c8b09174d2b92cb123b2afbd wpt-pr: 35983
testing/web-platform/tests/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/exceed-then-not-exceed.html
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/html/rendering/non-replaced-elements/the-frameset-and-frame-elements/exceed-then-not-exceed.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(async () => {
+  await new Promise(resolve => document.addEventListener('DOMContentLoaded', resolve, {once:true}));
+  await new Promise(resolve => requestAnimationFrame(resolve));
+  await new Promise(resolve => requestAnimationFrame(resolve));
+  // #fs1, #container, and #child were laid out.
+
+  // Move #child.
+  // It makes #container dirty, and it exceeds from #fs1's 1x1 grid.
+  document.querySelector('#fs1').insertBefore(
+      document.querySelector('#child'), document.querySelector('#container'));
+  await new Promise(resolve => requestAnimationFrame(resolve));
+  await new Promise(resolve => requestAnimationFrame(resolve));
+
+  // Removing #child makes #container visible again.
+  document.querySelector('#child').remove();
+  await new Promise(resolve => requestAnimationFrame(resolve));
+  await new Promise(resolve => requestAnimationFrame(resolve));
+}, 'No crash when a dirty FRAMESET exceeds from the grid then fits in it again');
+</script>
+</head>
+<frameset id="fs1">
+<frameset id="container">
+<frameset id="child"></frameset>
+</frameset>
+</frameset>
+</html>