Skip to content

GitLab

T
tangled
Commit 2c785f32 authored by Alison Maher's avatar Alison Maher Committed by Commit Bot
Browse files
Options

[LayoutNG] Null-dereference in LayoutNGListItem::OrdinalValueChanged() 

When LayoutNGListItem::OrdinalValueChanged() is called on an ":after"
list item element, |marker_| is a nullptr.

Similar to LayoutNGListItem::ListStyleTypeChanged(), we need to check
that |marker_| is not nullptr before invalidation to avoid
null-dereferences in this case.

Bug: 1020669
Change-Id: I66913cde0420a3612e881dab9e44a006c276ec64
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1902666
Commit-Queue: Alison Maher <almaher@microsoft.com>
Reviewed-by: default avatarKoji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#713894}
parent cac5ea47
Hide whitespace changes
Inline Side-by-side
Showing with 59 additions and 3 deletions
third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.cc
View file @ 2c785f32
...@@ -76,9 +76,13 @@ void LayoutNGListItem::ListStyleTypeChanged() { ...@@ -76,9 +76,13 @@ void LayoutNGListItem::ListStyleTypeChanged() {
void LayoutNGListItem::OrdinalValueChanged() { void LayoutNGListItem::OrdinalValueChanged() {
if (marker_type_ == kOrdinalValue && is_marker_text_updated_) { if (marker_type_ == kOrdinalValue && is_marker_text_updated_) {
is_marker_text_updated_ = false; is_marker_text_updated_ = false;
DCHECK(marker_);
marker_->SetNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation( // |marker_| can be a nullptr, for example, in the case of :after list item
layout_invalidation_reason::kListValueChange); // elements.
if (marker_) {
marker_->SetNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation(
layout_invalidation_reason::kListValueChange);
}
} }
} }
......
third_party/blink/web_tests/external/wpt/css/css-lists/ol-change-display-type-ref.html 0 → 100644
View file @ 2c785f32
<!DOCTYPE html>
<meta charset="utf-8">
<link rel=help href="https://crbug.com/1020669">
<style>
.item {
display: list-item;
}
.item:after {
content: counter(section);
display: list-item;
}
.table-header {
display: table-header-group;
}
</style>
<body>
<ol reversed="reversed">
<span class="table-header">
<figure class="item"></figure>
</span>
</ol>
</body>
</html>
third_party/blink/web_tests/external/wpt/css/css-lists/ol-change-display-type.html 0 → 100644
View file @ 2c785f32
<!DOCTYPE html>
<meta charset="utf-8">
<title>CSS Lists: Change display type of reverse ol list element.</title>
<link rel=help href="https://crbug.com/1020669">
<link rel=match href="ol-change-display-type-ref.html">
<style>
.item {
display: list-item;
}
.item:after {
content: counter(section);
display: list-item;
}
.table-header {
display: table-header-group;
}
</style>
<body>
<ol reversed="reversed">
<span id="span">
<figure class="item"></figure>
</span>
</ol>
</body>
<script>
document.body.offsetTop;
document.getElementById('span').setAttribute('class', 'table-header');
</script>
</html>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment