Chromium Code Reviews Chromium Code Reviews
Issue
2150933002:
Fix crash when removing contents from a document having multiple bodies (Closed)
DescriptionFix crash when removing contents from a document having multiple bodies
Removed the early return under condition 'isBody()' from
LayoutObjectChildList::invalidatePaintOnRemoval() to ensure the
painting layer and body object are invalidated.
BTW fixed issues of DisplayItemClient aliveness checking which made
it not actually work for subsequences. (If we didn't have the issues,
we should have caught this bug through aliveness-checking.)
Still not sure if we could have more reduced test. For the test, removing
anything from the test would make the test not reproducing the bug. A
normal removal of <body> couldn't reproduce the bug because we will
invalidate the painting layer in other paths (e.g. layout triggered
invalidation, etc.).
BUG=626182
Review-Url: https://codereview.chromium.org/2133603002
Cr-Commit-Position: refs/heads/master@{#404552}
Patch Set 1 #
Messages
Total messages: 1 (0 generated)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
