Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(85)

Issue 1558433003: Revert of Re-land 'Fold out-of-flow objects into anonymous blocks when removing children' (Closed)

Created:
4 years, 11 months ago by inferno
Modified:
4 years, 11 months ago
CC:
blink-reviews, blink-reviews-layout_chromium.org, chromium-reviews, eae+blinkwatch, jchaffraix+rendering, leviw+renderwatch, pdr+renderingwatchlist_chromium.org, szager+layoutwatch_chromium.org, zoltan1
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Revert of Re-land 'Fold out-of-flow objects into anonymous blocks when removing children' (patchset #2 id:20001 of https://codereview.chromium.org/1543283002/ ) Reason for revert: Ton of use-after-free security regressions. BUG=573281 Original issue's description: > Re-land 'Fold out-of-flow objects into anonymous blocks when removing children' > > Another attempt at https://codereview.chromium.org/1406163003. > > Sometimes when we remove a child we end up with a float or out-of-flow object beside > an anonymous block. When that happens, fold the float/out-of-flow object into the > anonymous box as that is where it would have lived if they were siblings in the > first place. > > BUG=322039 > > Committed: https://crrev.com/c579aa1f40cf26e7fe3c21e5cd9e0bc7b81497a5 > Cr-Commit-Position: refs/heads/master@{#367074} TBR=mstensho@opera.com,robhogan@gmail.com NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=322039

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+12 lines, -147 lines) Patch
M third_party/WebKit/LayoutTests/TestExpectations View 1 chunk +0 lines, -2 lines 0 comments Download
D third_party/WebKit/LayoutTests/fast/block/float/add-float-after-anonymous-block-being-destroyed.html View 1 chunk +0 lines, -19 lines 0 comments Download
D third_party/WebKit/LayoutTests/fast/block/float/add-float-after-anonymous-block-being-destroyed-expected.txt View 1 chunk +0 lines, -3 lines 0 comments Download
D third_party/WebKit/LayoutTests/fast/block/float/add-inline-before-float-and-into-anonymous-block-container.html View 1 chunk +0 lines, -27 lines 0 comments Download
D third_party/WebKit/LayoutTests/fast/block/float/add-inline-before-float-and-into-anonymous-block-container-expected.html View 1 chunk +0 lines, -14 lines 0 comments Download
D third_party/WebKit/LayoutTests/fast/block/float/remove-div-after-float-and-before-anonymous-block-container.html View 1 chunk +0 lines, -28 lines 0 comments Download
D third_party/WebKit/LayoutTests/fast/block/float/remove-div-after-float-and-before-anonymous-block-container-expected.png View Binary file 0 comments Download
D third_party/WebKit/LayoutTests/fast/block/float/remove-div-after-float-and-before-anonymous-block-container-expected.txt View 1 chunk +0 lines, -19 lines 0 comments Download
M third_party/WebKit/Source/core/layout/LayoutBlock.cpp View 3 chunks +12 lines, -35 lines 0 comments Download

Messages

Total messages: 9 (2 generated)
inferno
Created Revert of Re-land 'Fold out-of-flow objects into anonymous blocks when removing children'
4 years, 11 months ago (2015-12-30 18:32:49 UTC) #1
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1558433003/1 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1558433003/1
4 years, 11 months ago (2015-12-30 18:33:35 UTC) #2
commit-bot: I haz the power
Failed to apply patch for third_party/WebKit/LayoutTests/TestExpectations: While running git apply --index -3 -p1; error: patch ...
4 years, 11 months ago (2015-12-30 18:34:02 UTC) #4
aarya
On 2015/12/30 18:34:02, commit-bot: I haz the power wrote: > Failed to apply patch for ...
4 years, 11 months ago (2015-12-30 22:41:08 UTC) #6
mstensho (USE GERRIT)
This is fixed, right?
4 years, 11 months ago (2016-01-11 20:26:56 UTC) #7
rhogan
On 2016/01/11 at 20:26:56, mstensho wrote: > This is fixed, right? YUp.
4 years, 11 months ago (2016-01-11 20:44:29 UTC) #8
mstensho (USE GERRIT)
4 years, 11 months ago (2016-01-11 20:51:27 UTC) #9
On 2016/01/11 20:44:29, rhogan wrote:
> On 2016/01/11 at 20:26:56, mstensho wrote:
> > This is fixed, right?
> 
> YUp.

Good. Closing.

Powered by Google App Engine
This is Rietveld 408576698