| <!DOCTYPE html> |
| <div id="container"> |
| <span id="inlineBlock" style="display:inline-block; width:50px;"> |
| <div> |
| <br> |
| <span style="padding-left:30px;"><span style="padding-left:30px;"><div id="victim" style="float:left;"></div> |
| </span></span> |
| </div> |
| </span> |
| <div id="intruder" style="display:none;"></div> |
| </div> |
| <script src="../../../resources/testharness.js"></script> |
| <script src="../../../resources/testharnessreport.js"></script> |
| <script> |
| test(() => { |
| // The comments here assume that crbug.com/835613 is unfixed. |
| |
| // Trigger layout. |
| document.body.offsetTop; |
| |
| // Make two specific tree changes in the same style |
| // update. Inserting #intruder will require #container to have block |
| // children (it had inline children up until this point). It will |
| // have to insert an anonymous block around #inlineBlock. As part of |
| // inserting an anonymous block, all the children that get wrapped |
| // inside it will have their FloatingObjects cleared. The code that |
| // does this is in LayoutBoxModelObject::MoveChildTo(). It calls |
| // RemoveFloatingObjectsFromDescendants() (although that's really |
| // there to cope with a completely different scenario than this, and |
| // it's actually pretty unnecessary to clear the float in this case |
| // (the float is even inside a new formatting context)). Anyway, the |
| // bug is that we forget about RootInlineBox objects that may hold |
| // pointers to the FloatingObjects that it's removing. |
| // |
| // Then #intruder can be inserted after the new anonymous block. |
| intruder.style.display = "block"; |
| |
| // When we move on and remove #victim (the float), it will attempt |
| // to remove its FloatingObject(s). |
| // LayoutBlockFlow::MarkAllDescendantsWithFloatsForLayout() will |
| // call RemoveFloatingObject() to look for the FloatingObject, but |
| // it's already gone! So we won't get to the part where we'd |
| // otherwise mark the line that contains the FloatingObject dirty. |
| // It requires a rather special tree [1] to actually trigger a |
| // read-after-free, though. |
| // |
| // [1] The ex-float must be adjacent to an inline that's inside |
| // another inline, and the sum of the inline-start border/padding of |
| // those inlines must be larger than the inline size of the |
| // containing block. Aaand we need a line in front of all this |
| // (hence the BR). |
| victim.style.display = "none"; |
| }, "PASS if no assertion failure or heap-use-after-free"); |
| </script> |
