Skip to content
This repository was archived by the owner on Mar 19, 2021. It is now read-only.

Commit 6c1b9ea

Browse files
Scott Violetchromium-wpt-export-bot
Scott Violet
authored and
chromium-wpt-export-bot
committed
css-flexbox: fixes for -webkit-box using LayoutFlexibleBox
This addresses two problems that triggered CHECKs/use-after-free: LayoutBlock, for -webkit-box, needs to add children to anonymous blocks in some cases. LayoutFlexibleBox should not merge anonymous flex items for -webkit-box. BUG=1010706 TEST=none Change-Id: Ic8cb22f4f031813c1e1447bc23f4bfb930b3caec Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1838754 Commit-Queue: Scott Violet <[email protected]> Reviewed-by: Christian Biesinger <[email protected]> Reviewed-by: Ian Kilpatrick <[email protected]> Cr-Commit-Position: refs/heads/master@{#703115}
1 parent 585aa49 commit 6c1b9ea

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

‎compat/webkit-box-removing-triggering-anonymous-merge.html

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<div style="display: -webkit-box">
5+
<span><div></div></span>
6+
<div id="target"></div>
7+
text
8+
</div>
9+
<script>
10+
// Force a layout before removing.
11+
document.body.offsetTop;
12+
document.getElementById('target').remove();
13+
done();
14+
</script>

0 commit comments

Comments
 (0)