Bug 1541665 [wpt PR 16158] - [LayoutNG] Fix nested legacy oof descendants, a=testonly
authorAleks Totic <atotic@chromium.org>
Sun, 28 Apr 2019 08:36:17 +0000
changeset 531399 26073cb99912551ee558803060ad635a86a65447
parent 531398 95ccc600e5331d135fbf3b47fff23c9535c61dd2
child 531400 595f9f3aa36e9e4e5c8f120d7349c2965613814d
push id11265
push userffxbld-merge
push dateMon, 13 May 2019 10:53:39 +0000
treeherdermozilla-beta@77e0fe8dbdd3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstestonly
bugs1541665, 16158, 946986, 1546713, 646077
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1541665 [wpt PR 16158] - [LayoutNG] Fix nested legacy oof descendants, a=testonly Automatic update from web-platform-tests [LayoutNG] Fix nested legacy oof descendants Another fix for "Legacy OOF descendant did not get laid out" The cause here was: - if #container had a legacy descendant, and - legacy descendant had an oof descendant whose containing block was #container, that oof descendant would get added to #container's list of legacy oof, but would never get laid out. This bug was hidden, because it would not happen if layout happened twice, which we often do. Seen in the wild at https://www.humblebundle.com/ when scrolling down. Bug: 946986 Change-Id: I183f3d5dfe79b49c5c6aadad0ee2cfcb8bb6849f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1546713 Commit-Queue: Aleks Totic <atotic@chromium.org> Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org> Auto-Submit: Aleks Totic <atotic@chromium.org> Cr-Commit-Position: refs/heads/master@{#646077} -- wpt-commits: 94cd32e64d89b561b803355c299c9db5908e0cb1 wpt-pr: 16158
testing/web-platform/tests/css/css-position/position-absolute-crash-chrome-004.html
new file mode 100644
--- /dev/null
+++ b/testing/web-platform/tests/css/css-position/position-absolute-crash-chrome-004.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<title>CSS Position Absolute: Chrome crash</title>
+<link rel="author" href="mailto:atotic@chromium.org">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=946986">
+<meta name="assert" content="Nested abs/fixed/flex do not crash">
+<style>
+  body { overflow: scroll;}
+  .container {
+    position: relative;
+    contain: paint;
+  }
+  .flex {
+    display: flex;
+  }
+  .fixed {
+    position: fixed;
+  }
+  .abs {
+    position: absolute;
+  }
+</style>
+<!-- LayoutNG currently does not support display:flex.
+  Propagation of descendants across flex boundaries is error prone -->
+<div id="one" class="container" style="">
+  <div class="flex">
+    <div class="abs">
+      <div class="flex">
+        <div id="fixed1" class="fixed">
+          <div id="fixed2" class="fixed"></div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+<script>
+test(() => {
+}, 'test passes if it does not crash');
+</script>
+