[Webkit-unassigned] [Bug 206705] Crash in RenderElement::selectionPseudoStyle with detail element set to display: contents

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=206705

Darin Adler <darin at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |darin at apple.com
 Attachment #388598|review?                     |review+
              Flags|                            |

--- Comment #2 from Darin Adler <darin at apple.com> ---
Comment on attachment 388598
  --> https://bugs.webkit.org/attachment.cgi?id=388598
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=388598&action=review

r=me but I have to admit the logic of the change is not obvious to me

> Source/WebCore/rendering/RenderElement.cpp:1419
> +            while (currentElement && currentElement->hasDisplayContents())
> +                currentElement = currentElement->parentElement();

It’s not obvious *why* this is the right thing to do. So we need a comment. Why are we skipping over any element that "has display contents"?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200127/8ba51251/attachment-0001.htm>