From 0335d054e61c65fd864dfab3e47b4f64fa16cf55 Mon Sep 17 00:00:00 2001 From: Aleks Totic Date: Fri, 29 Mar 2019 21:53:27 -0700 Subject: [PATCH] [LayoutNG] Fix nested legacy oof descendants Another fix for "Legacy OOF descendant did not get laid out" The cause here was: - if #container had a legacy descendant, and - legacy descendant had an oof descendant whose containing block was #container, that oof descendant would get added to #container's list of legacy oof, but would never get laid out. This bug was hidden, because it would not happen if layout happened twice, which we often do. Seen in the wild at https://www.humblebundle.com/ when scrolling down. Bug: 946986 Change-Id: I183f3d5dfe79b49c5c6aadad0ee2cfcb8bb6849f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1546713 Commit-Queue: Aleks Totic Reviewed-by: Ian Kilpatrick Auto-Submit: Aleks Totic Cr-Commit-Position: refs/heads/master@{#646077} --- .../position-absolute-crash-chrome-004.html | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 css/css-position/position-absolute-crash-chrome-004.html diff --git a/css/css-position/position-absolute-crash-chrome-004.html b/css/css-position/position-absolute-crash-chrome-004.html new file mode 100644 index 000000000000000..cc6de63e0011a35 --- /dev/null +++ b/css/css-position/position-absolute-crash-chrome-004.html @@ -0,0 +1,41 @@ + +CSS Position Absolute: Chrome crash + + + + + + + +
+
+
+
+
+
+
+
+
+
+
+ +