Fix tree removal order when detaching fullscreen element.

LayoutObject::WillBeDestroyed removes children before calling Remove() on itself. Make LayoutFullScreen's override do the same. The tree walk in FindReferencingScrollAnchors relies on this. If an ancestor layout object has already been removed, we will fail to clear ScrollAnchor::anchor_object_. Bug: 823150 Change-Id: I30bf225ef22ad740c031bca0520e238e88fef23e Reviewed-on: https://chromium-review.googlesource.com/974745Reviewed-by: Stefan Zager <szager@chromium.org> Commit-Queue: Steve Kobes <skobes@chromium.org> Cr-Commit-Position: refs/heads/master@{#546213}

Fix tree removal order when detaching fullscreen element.
LayoutObject::WillBeDestroyed removes children before calling Remove() on itself. Make LayoutFullScreen's override do the same. The tree walk in FindReferencingScrollAnchors relies on this. If an ancestor layout object has already been removed, we will fail to clear ScrollAnchor::anchor_object_. Bug: 823150 Change-Id: I30bf225ef22ad740c031bca0520e238e88fef23e Reviewed-on: https://chromium-review.googlesource.com/974745Reviewed-by: Stefan Zager <szager@chromium.org> Commit-Queue: Steve Kobes <skobes@chromium.org> Cr-Commit-Position: refs/heads/master@{#546213}
a0b0d089 · Steve Kobes · Commit Bot · 9ed29db5 · a0b0d089 · a0b0d089
Commit a0b0d089 authored Mar 27, 2018 by Steve Kobes Committed by Commit Bot Mar 27, 2018
2 changed files
--- a/third_party/WebKit/LayoutTests/fast/layout/scroll-anchoring/fullscreen-crash.html
+++ b/third_party/WebKit/LayoutTests/fast/layout/scroll-anchoring/fullscreen-crash.html
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="../../../resources/run-after-layout-and-paint.js"></script>
+<style>
+
+#a { height: 700px; }
+#b { border: 4px solid #ccc; }
+
+</style>
+<div id="a"><div id="b"></div></div>
+<script>
+
+// Based on ClusterFuzz test case in crbug.com/823150.
+t = async_test("This test passes if it does not crash.");
+onload = () => {
+  addEventListener("keypress", step2);
+  eventSender.keyDown(" ", []);
+};
+step2 = () => {
+  b.webkitRequestFullScreen();
+  runAfterLayoutAndPaint(() => { runAfterLayoutAndPaint(step3); });
+};
+step3 = () => {
+  document.designMode = "on";
+  document.execCommand("selectAll");
+  document.execCommand("formatBlock", false, "p");
+  t.done();
+};
+
+</script>
--- a/third_party/WebKit/Source/core/layout/LayoutFullScreen.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutFullScreen.cpp
@@ -77,6 +77,9 @@ LayoutFullScreen* LayoutFullScreen::CreateAnonymous(Document* document) {

 void LayoutFullScreen::WillBeDestroyed() {
  if (placeholder_) {
+    // Remove children before self.
+    if (LayoutObjectChildList* children = Children())
+      children->DestroyLeftoverChildren();
    Remove();
    if (!placeholder_->BeingDestroyed())
      placeholder_->Destroy();