[Webkit-unassigned] [Bug 162832] [ListItems] Render tree should be all clean by the end of FrameView::layout().

Mon Oct 3 14:42:33 PDT 2016

https://bugs.webkit.org/show_bug.cgi?id=162832

--- Comment #2 from zalan <zalan at apple.com> ---
(In reply to comment #1)
> Created attachment 290461 [details]
> Test reduction
> 
> This happens when we start mutating the renderer tree while laying it out.
> <body>
>   <span>
>     <li>
> 1. floating <li> is being laid out by the body (<span> is the direct parent
> but the containing block is the body)
> 2. we insert a new renderer (list marker) and dirty the ancestor chain
> 3. we never get to lay out the <span>
Scratch the containing block part, it's just a floating renderer and not an out of flow positioned one.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20161003/827aaed5/attachment.html>