Defer SVG resource invalidation if within style-recalc or layout detach

NotifyContentChanged() can trigger ImageChanged(), which in turn can access inconsistent ComputedStyle state if it is run during style-recalc or layout detach. Fixed: 333487749 Change-Id: I0e6b7b9f3fb095809b7736c3bba84a337088af49 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5453619 Commit-Queue: Rune Lillesveen <[email protected]> Reviewed-by: Rune Lillesveen <[email protected]> Auto-Submit: Fredrik Söderquist <[email protected]> Cr-Commit-Position: refs/heads/main@{#1287945}
sadym-chromium · Apr 16, 2024 · 7ebd92c · 7ebd92c
1 parent 5d0c33d
commit 7ebd92c
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/svg/crashtests/chrome-bug-333487749.html b/svg/crashtests/chrome-bug-333487749.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<body style="mask: url(#marker)">
+  <svg>
+    <marker id="marker">
+      <rect width="10" height="10" fill="yellow"/>
+    </marker>
+    <path d="M50,50h100" marker-start="url(#marker1)"/>
+  </svg>
+</body>
+<script>
+  document.documentElement.offsetTop;
+  document.documentElement.style.display = 'none';
+  document.documentElement.offsetTop;
+</script>