Fix crash when @position-try invalidates display:none

The expectation was that OutOfFlowData is nuked from a node when it is no longer rendered, but that is not the case. Null check LayoutObject before accessing it. Bug: 377324991 Change-Id: I5984a8d528667dd95d73edba7c764fedd7c582fd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6017885 Commit-Queue: Rune Lillesveen <[email protected]> Reviewed-by: Morten Stenshorne <[email protected]> Cr-Commit-Position: refs/heads/main@{#1382313}
web-platform-tests · Nov 13, 2024 · 4523075 · 4523075
1 parent 924ad9d
commit 4523075
Showing 1 changed file with 35 additions and 0 deletions.
diff --git a/css/css-anchor-position/chrome-377324991-crash.html b/css/css-anchor-position/chrome-377324991-crash.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html class="test-wait">
+<title>CSS Anchor Positioning Test: crash for simultaneous @position-try and display:none change</title>
+<link rel="help" href="https://crbug.com/377324991">
+<style>
+  @position-try --opt {
+    position-area: right center;
+  }
+  #anchor {
+    width: 100px;
+    height: 100px;
+    background-color: green;
+    anchor-name: --a;
+  }
+  #anchored {
+    position: absolute;
+    width: 100px;
+    height: 100px;
+    background-color: lime;
+    position-anchor: --a;
+    position-area: left center;
+    position-try-fallbacks: --opt;
+  }
+</style>
+<div id="anchor"></div>
+<div id="anchored"></div>
+<script>
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      anchored.style.display = 'none';
+      document.styleSheets[0].insertRule("@position-try --opt {}");
+      document.documentElement.classList.remove("test-wait");
+    });
+  });
+</script>