tree 598f63b7514c25f8347e2c428ee368e292d3485c
parent 970a7df41e6a2d12d3b6575fd8944b0e7c72c74b
author Rune Lillesveen <futhark@chromium.org> 1638996173 -0800
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1638997743 -0800

[@container] Do not re-attach container inclusive ancestors

Avoid reattaching inclusive ancestors for size containers due to legacy
layout fallback during layout. Only allow marking for re-attachment up
to, but not including, a size container.

This means we will still have DCHECK failures and broken layout for
legacy fallback when container queries are enabled, but avoids
use-after-free for layout objects.

Bug: 1276962
Change-Id: If6ff862b6269fb41cceb18cc393f24667b31b827
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3323072
Reviewed-by: Morten Stenshorne <mstensho@chromium.org>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/main@{#949683}