commit 0bf2497c27beaab72abe4cbc5aa6ee4799c1ee50
parent 34df5009e5b91b86aad0c827f4583ec1333d34e1
Author: Minseong Kim <jja08111@gmail.com>
Date: Thu, 4 Dec 2025 16:55:12 +0000
Bug 2003732 [wpt PR 56446] - Don't call SetNeedsCollectInlines if it's atomic inline, a=testonly
Automatic update from web-platform-tests
Don't call SetNeedsCollectInlines if it's atomic inline
This CL fixes the CHECK failure which is caused from
`LineBreaker::HandleAtomicInline`. This is because the LayoutObject
instance is marked as `NeedsCollectInlines` during it's being destroyed
at `LayoutObject::MarkParentForSpannerOrOutOfFlowPositionedChange`.
Bug: 403617975
Change-Id: Ice69250dd47784945b894187276663f21493ffb8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7206586
Commit-Queue: Minseong Kim <jja08111@gmail.com>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1553261}
--
wpt-commits: c83e443ea340c4aa0b52370ec980565ec644baf9
wpt-pr: 56446
Diffstat:
1 file changed, 26 insertions(+), 0 deletions(-)
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/atomic-item-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/atomic-item-crash.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class=test-wait>
+<link rel=author href="mailto:jja08111@gmail.com">
+<link rel="help" href="https://crbug.com/403617975">
+<style>
+ #target { appearance: textarea; container-type: size; offset: auto url(); }
+</style>
+<table>
+ <th id="target">
+ <marquee>
+ <a>crash</a>
+ </marquee>
+ <dialog id="dialog" open="true">
+ <textarea id="textarea"></textarea>
+ </dialog>
+ </th>
+</table>
+<script>
+requestAnimationFrame(() => {
+ const callback = window.requestIdleCallback(() => {});
+ dialog.close();
+ textarea.cols = callback;
+ document.documentElement.classList.remove('test-wait');
+});
+</script>
+</html>
