tree 9204bd1bb7b71c67816163e8b78ede584336bdd0
parent 85f0a5de25c036cc3a19ef626e2cfb9f87dd8c70
author Morten Stenshorne <mstensho@chromium.org> 1639589480 -0800
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1639590342 -0800

Don't miss AREA elements during block-fragmented pre-paint.

NGInlineItemsBuilderTemplate::ExitInline() has a special rule for AREA
elements, and we need to respond on that during pre-paint, so that they
are visited (and get their invalidation flags cleared).

Note that this doesn't fix the original fuzzer in crbug.com/1279525

Bug: 1279525
Change-Id: Ib05b4cc3eebff85fc5e2999b1f90d16d75bf36f1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3341320
Reviewed-by: Koji Ishii <kojii@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/main@{#951986}