[webkit-changes] [WebKit/WebKit] 81bc2a: RenderElement::updateOutlineAutoAncestor should de...

[Chirag Shah]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 81bc2a0b0fb755976082c1ae57a0667cb9c4e2be
      https://github.com/WebKit/WebKit/commit/81bc2a0b0fb755976082c1ae57a0667cb9c4e2be
  Author: Chirag M Shah <chirag_m_shah at apple.com>
  Date:   2023-03-03 (Fri, 03 Mar 2023)

  Changed paths:
    A LayoutTests/fast/rendering/outline-auto-for-moved-out-element-crash-expected.txt
    A LayoutTests/fast/rendering/outline-auto-for-moved-out-element-crash.html
    M Source/WebCore/rendering/RenderElement.cpp

  Log Message:
  -----------
  RenderElement::updateOutlineAutoAncestor should deal with moved out renderers
https://bugs.webkit.org/show_bug.cgi?id=253270
rdar://105873104

Reviewed by Alan Baradlay.

Before this change, when RenderElement::updateOutlineAutoAncestor was
called on RenderMultiColumnSpannerPlaceholder, we never looked at the
children of the moved out element. This means that we would have an
invalid outline auto set in the hierarchy of the moved out element,
which can cause stack overflow. This change fixes it by making it so
that we recurse through children of the moved out element to set the
right state when dealing with RenderMultiColumnSpannerPlaceholder.

* LayoutTests/fast/rendering/outline-auto-for-moved-out-element-crash-expected.txt: Added.
* LayoutTests/fast/rendering/outline-auto-for-moved-out-element-crash.html: Added.
* Source/WebCore/rendering/RenderElement.cpp:
(WebCore::RenderElement::updateOutlineAutoAncestor):

Canonical link: https://commits.webkit.org/261148@main