commit 4d9b265629848769e8bcf47675ea377ddf36d9c1
parent cfee56ce882d0eb0acbe680458d726a6317240fe
Author: Peng Zhou <zhoupeng.1996@bytedance.com>
Date: Wed, 15 Oct 2025 08:59:32 +0000
Bug 1994168 [wpt PR 55409] - Return an empty InlineContents when the shadow host LayoutObject is null, a=testonly
Automatic update from web-platform-tests
Return an empty InlineContents when the shadow host LayoutObject is null
The commit (I40dbb7628ed6dd7ecebd5842ee740c28c7a5037d) added logic to
re-target `layout_object` to the shadow host in order to address the
crash in issue 380107555. However, the shadow host’s `LayoutObject`
can be null in some cases, such as when the host is a slot element
styled with `display: contents`.
Return an empty `InlineContents` when the shadow host’s `LayoutObject`
is nullptr to prevent potential crashes in such cases.
Bug: 447836118
Change-Id: I3b02a7087a6e000bb7389d996f365f7f24f5e730
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7031423
Commit-Queue: Peng Zhou <zhoupeng.1996@bytedance.com>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1529284}
--
wpt-commits: 5ed897e0540f9314ca61f1f56c2ddec866cdd27d
wpt-pr: 55409
Diffstat:
1 file changed, 22 insertions(+), 0 deletions(-)
diff --git a/testing/web-platform/tests/selection/crashtests/selection-modify-extend-forward-on-option.html b/testing/web-platform/tests/selection/crashtests/selection-modify-extend-forward-on-option.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<title>Extending selection forward on option should not crash</title>
+<style>
+* {
+ display: inherit;
+}
+</style>
+
+<!--
+This test passes if it does not crash.
+-->
+
+<select style="display: table-cell;" name="test" multiple>
+ <option style="display: contents;">Test</option>
+</select>
+
+<script>
+window.addEventListener('load', () => {
+ document.execCommand('selectall');
+ window.getSelection().modify('extend', 'forward', 'line');
+});
+</script>
