[Webkit-unassigned] [Bug 162832] [ListItems] Render tree should be all clean by the end of FrameView::layout().

Sat Oct 1 21:14:46 PDT 2016

https://bugs.webkit.org/show_bug.cgi?id=162832

--- Comment #1 from zalan <zalan at apple.com> ---
Created attachment 290461
  --> https://bugs.webkit.org/attachment.cgi?id=290461&action=review
Test reduction

This happens when we start mutating the renderer tree while laying it out.
<body>
  <span>
    <li>
1. floating <li> is being laid out by the body (<span> is the direct parent but the containing block is the body)
2. we insert a new renderer (list marker) and dirty the ancestor chain
3. we never get to lay out the <span>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161002/11079091/attachment.html>