commit 8cfff1700d01f57bd035022ffb1c1a0c9f81fc2e
parent b0063f621399135a410531e254e7228db4e679b9
Author: Anders Hartvoll Ruud <andruud@chromium.org>
Date: Fri, 31 Oct 2025 08:58:20 +0000
Bug 1997182 [wpt PR 55752] - Guard against invalid adjustment of writing-mode/direction for tables, a=testonly
Automatic update from web-platform-tests
Guard against invalid adjustment of writing-mode/direction for tables
StyleAdjuster overwrites the writing-mode and direction for elements
with table display types, which is either wrong because we don't
actually want to modify the computed value (Issue 40527196),
or it's wrong because it's *too late* to make adjustments to cascade-
affecting properties at that point.
This CL does not try to fix this (but see previous attempt by Ian,
CL:3938617), but instead guards against it in StyleCascade by ensuring
that the "writing-direction" we use during cascade expansion is
the same we use during the apply step, and (crucially) remains
the same during *subsequent* apply steps on the same StyleCascade
object.
This fixes a NOTREACHED that occurs due to the Apply step for the base
style and the Apply step for the animation style (with an adjustment
in between) having unexpectedly different writing-directions.
Fixed: 444818221
Bug: 40527196
Change-Id: I139f723bfd4c0bd6407b3aa1c44f6e9b66fed352
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7096301
Reviewed-by: Rune Lillesveen <futhark@chromium.org>
Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1537479}
--
wpt-commits: 074aa6374ef28f16daabefa5fec6820cbf7136bf
wpt-pr: 55752
Diffstat:
1 file changed, 26 insertions(+), 0 deletions(-)
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/transition-table-row-group-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/transition-table-row-group-crash.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<title>Crash when transitioning on a table-row-group element with pending substitution</title>
+<link rel="help" href="https://crbug.com/444818221">
+<style>
+ optgroup {
+ display: contents;
+ writing-mode: vertical-lr;
+ }
+ option {
+ display: table-row-group;
+ transition: color 1s;
+ --p: 2px;
+ padding-inline: var(--p);
+ }
+</style>
+<select>
+ <optgroup>
+ <option id="opt"></option>
+ </optgroup>
+</select>
+<script>
+ opt.offsetTop;
+ opt.style.setProperty("color", "red");
+ opt.offsetTop;
+</script>
+\ No newline at end of file
