Kent Tamura
f43aebac5f
Automatic update from web-platform-tests
Fix crash in text-fit and text-box-trim interaction
When text-fit is active, it runs a cloned BlockLayoutAlgorithm to
measure the scaling factor. If this measurement pass aborts due to
text-box-trim (kTextBoxTrimEndDidNotApply), the abort status was
propagated to the original algorithm, but the required state
(last_non_empty_inflow_child_) was not copied. This caused a crash
(DCHECK failure) when the original algorithm attempted to run
RelayoutForTextBoxTrimEnd.
This CL fixes the issue by:
1. Propagating the relayout state to the cloned algorithm.
2. Copying the text-box-trim state back to the original algorithm
when the cloned algorithm aborts.
Bug: 516356804
Change-Id: Ia9f7dd5763e68962f8bca8f2af3f9c3233fd3371
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7901924
Auto-Submit: Kent Tamura <tkent@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1642264}
--
wpt-commits: b9301a35185a40d30348d9b2f648f16da96d9256
wpt-pr: 60423
27 lines
586 B
HTML
27 lines
586 B
HTML
<!DOCTYPE html>
|
|
<html class="reftest-wait">
|
|
<meta charset="iso-8859-8">
|
|
<link rel="help" href="https://crbug.com/516356804">
|
|
<style>
|
|
.target {
|
|
text-fit: grow consistent;
|
|
text-box: trim-both cap text;
|
|
}
|
|
</style>
|
|
<body contenteditable=true>
|
|
<div class="target">a b</div>
|
|
<script>
|
|
requestAnimationFrame(() => {
|
|
requestAnimationFrame(() => {
|
|
document.body.focus();
|
|
document.execCommand("selectAll");
|
|
document.execCommand("InsertImage");
|
|
requestAnimationFrame(() => {
|
|
document.documentElement.removeAttribute('class');
|
|
});
|
|
});
|
|
});
|
|
</script>
|
|
</body>
|
|
</html>
|