From d9d78543960a04ea8ad8f1aa3c7536b6a9a87d9a Mon Sep 17 00:00:00 2001 From: Morten Stenshorne Date: Mon, 2 Jan 2023 14:32:12 -0800 Subject: [PATCH] Only disable further fragmentation if fragmentation is on. With the new call to DisableFurtherFragmentation() in NGOutOfFlowLayoutPart::GenerateFragment(), we might attempt to disable fragmentation even if we weren't participating in block fragmentation (a monolithic OOF, for instance). This would lead to a crash if the constraint space didn't have a rare-data object. Bug: 1403467 Change-Id: Icd2e005440f93263511ff68949d40672d4030dd9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4127783 Reviewed-by: Ian Kilpatrick Commit-Queue: Morten Stenshorne Cr-Commit-Position: refs/heads/main@{#1088065} --- .../crashtests/monolithic-oof-in-clipped-container.html | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html diff --git a/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html b/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html new file mode 100644 index 00000000000000..7a3506290228a0 --- /dev/null +++ b/css/css-multicol/crashtests/monolithic-oof-in-clipped-container.html @@ -0,0 +1,8 @@ + + + +
+
+
+
+