Don't treat option/optgroup as display:contents.

We should reset last text node seen by the whitespace attacher when entering an option or optgroup element. We normally do that when we see a layout object, but these element do not have layout objects. We incorrectly treated them as display:contents during layout tree rebuild. This caused a fuzzer DCHECK failure in WhitespaceAttacher where we did not reset the WhitespaceAttacher for an optgroup which we thought were a display:contents but not registered as one in the WhitespaceAttacher. Bug: 855949 Change-Id: I5c341a3f47a4e76216db6f712ecacfc939b5f7fa Reviewed-on: https://chromium-review.googlesource.com/1113339Reviewed-by: Anders Ruud <andruud@chromium.org> Commit-Queue: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#570058}

Don't treat option/optgroup as display:contents.
We should reset last text node seen by the whitespace attacher when entering an option or optgroup element. We normally do that when we see a layout object, but these element do not have layout objects. We incorrectly treated them as display:contents during layout tree rebuild. This caused a fuzzer DCHECK failure in WhitespaceAttacher where we did not reset the WhitespaceAttacher for an optgroup which we thought were a display:contents but not registered as one in the WhitespaceAttacher. Bug: 855949 Change-Id: I5c341a3f47a4e76216db6f712ecacfc939b5f7fa Reviewed-on: https://chromium-review.googlesource.com/1113339Reviewed-by: Anders Ruud <andruud@chromium.org> Commit-Queue: Rune Lillesveen <futhark@chromium.org> Cr-Commit-Position: refs/heads/master@{#570058}
08888da0 · Rune Lillesveen · Commit Bot · fccbefea · 08888da0 · 08888da0
Commit 08888da0 authored Jun 25, 2018 by Rune Lillesveen Committed by Commit Bot Jun 25, 2018
2 changed files
--- a/third_party/WebKit/LayoutTests/fast/css/recalc-optgroup-as-iframe-child-crash.html
+++ b/third_party/WebKit/LayoutTests/fast/css/recalc-optgroup-as-iframe-child-crash.html
+<!DOCTYPE html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<body>
+<script>
+  test(() =>{
+    var iframe = document.body.appendChild(document.createElement("iframe"));
+    document.body.offsetTop;
+    iframe.appendChild(document.createElement("optgroup"));
+    iframe.appendChild(document.createTextNode(""));
+    document.body.offsetTop;
+    iframe.style.color = "pink";
+  }, "Check that style recalc of iframe with optgroup and text child does not crash.");
+</script>
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc
@@ -2369,7 +2369,7 @@ void Element::RebuildLayoutTree(WhitespaceAttacher& whitespace_attacher) {
    // layout tree siblings.
    WhitespaceAttacher local_attacher;
    WhitespaceAttacher* child_attacher;
-    if (GetLayoutObject()) {
+    if (GetLayoutObject() || !HasDisplayContentsStyle()) {
      whitespace_attacher.DidVisitElement(this);
      if (GetDocument().GetStyleEngine().NeedsWhitespaceReattachment(this))
        local_attacher.SetReattachAllWhitespaceNodes();