Skip to content

Conversation

@chromium-wpt-export-bot
Copy link
Collaborator

@chromium-wpt-export-bot chromium-wpt-export-bot commented Jan 7, 2026

Make sure that ::column pseudo-elements always store computed style.
Checking display type here was wrong, since ::column pseudo-elements
never create layout boxes. If a ::column became display:none, its
computed style would be set to null, which in turn would crash
somewhere. In the crash test included it would crash in
Element::GetOrCreateColumnPseudoElementIfNeeded() because of this.

This is a speculative fix for http://crbug.com/470512590

Big thanks to futhark for help with analyzing and advice!

Bug: 470512590
Change-Id: I7b62ab9c77dd6a7529415a7f2e721696d84ab25a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7362160
Reviewed-by: Rune Lillesveen <[email protected]>
Commit-Queue: Morten Stenshorne <[email protected]>
Reviewed-by: Daniil Sakhapov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1566152}

Make sure that ::column pseudo-elements always store computed style.
Checking display type here was wrong, since ::column pseudo-elements
never create layout boxes. If a `::column` became `display:none`, its
computed style would be set to null, which in turn would crash
somewhere. In the crash test included it would crash in
Element::GetOrCreateColumnPseudoElementIfNeeded() because of this.

This is a speculative fix for http://crbug.com/470512590

Big thanks to futhark for help with analyzing and advice!

Bug: 470512590
Change-Id: I7b62ab9c77dd6a7529415a7f2e721696d84ab25a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7362160
Reviewed-by: Rune Lillesveen <[email protected]>
Commit-Queue: Morten Stenshorne <[email protected]>
Reviewed-by: Daniil Sakhapov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1566152}
Copy link
Collaborator

@wpt-pr-bot wpt-pr-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The review process for this patch is being conducted in the Chromium project.

@chromium-wpt-export-bot chromium-wpt-export-bot merged commit 269c018 into master Jan 8, 2026
25 checks passed
@chromium-wpt-export-bot chromium-wpt-export-bot deleted the chromium-export-cl-7362160 branch January 8, 2026 11:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants