tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

commit 4eda36fbb95f550bbf9b6dd1de908afef9aaf4b6
parent aefb5876c351e1415fb03afce36d056bc3d878dd
Author: Steve Kobes <skobes@chromium.org>
Date:   Mon, 27 Oct 2025 10:05:47 +0000

Bug 1996030 [wpt PR 55623] - Fix detection of document transition in ScopedPauseRendering., a=testonly

Automatic update from web-platform-tests
Fix detection of document transition in ScopedPauseRendering.

If the <html> element is replaced, the ViewTransition::scope_ may still
refer to the old document element. Relying on IsDocumentElement() leads
to a crash as described in the bug.

Bug: 451293374
Change-Id: Id60e437c2626422ee3e18b0720c745e628606eb3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7077175
Commit-Queue: Steve Kobes <skobes@chromium.org>
Reviewed-by: Vladimir Levin <vmpstr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1534313}

--

wpt-commits: 60c83316e6cb88a21294862249e48043bc53090c
wpt-pr: 55623

Diffstat:
Atesting/web-platform/tests/css/css-view-transitions/scoped/crashtests/replace-html.html | 18++++++++++++++++++
1 file changed, 18 insertions(+), 0 deletions(-)

diff --git a/testing/web-platform/tests/css/css-view-transitions/scoped/crashtests/replace-html.html b/testing/web-platform/tests/css/css-view-transitions/scoped/crashtests/replace-html.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html class="test-wait"> +<script> + +onload = async () => { + const doc = document, + old_html = doc.documentElement, + new_html = doc.createElement("html"); + new_html.className = "test-wait"; + const transition = doc.startViewTransition(() => {}); + doc.replaceChild(new_html, old_html); + await transition.finished; + new_html.classList.remove('test-wait'); + old_html.classList.remove('test-wait'); +} + +</script> +</html>