<!DOCTYPE html>
<div id="container">
<span id="inlineBlock" style="display:inline-block; width:50px;">
<div>
<br>
<span style="padding-left:30px;"><span style="padding-left:30px;"><div id="victim" style="float:left;"></div>
</span></span>
</div>
</span>
<div id="intruder" style="display:none;"></div>
</div>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<script>
test(() => {
// The comments here assume that crbug.com/835613 is unfixed.
// Trigger layout.
document.body.offsetTop;
// Make two specific tree changes in the same style
// update. Inserting #intruder will require #container to have block
// children (it had inline children up until this point). It will
// have to insert an anonymous block around #inlineBlock. As part of
// inserting an anonymous block, all the children that get wrapped
// inside it will have their FloatingObjects cleared. The code that
// does this is in LayoutBoxModelObject::MoveChildTo(). It calls
// RemoveFloatingObjectsFromDescendants() (although that's really
// there to cope with a completely different scenario than this, and
// it's actually pretty unnecessary to clear the float in this case
// (the float is even inside a new formatting context)). Anyway, the
// bug is that we forget about RootInlineBox objects that may hold
// pointers to the FloatingObjects that it's removing.
//
// Then #intruder can be inserted after the new anonymous block.
intruder.style.display = "block";
// When we move on and remove #victim (the float), it will attempt
// to remove its FloatingObject(s).
// LayoutBlockFlow::MarkAllDescendantsWithFloatsForLayout() will
// call RemoveFloatingObject() to look for the FloatingObject, but
// it's already gone! So we won't get to the part where we'd
// otherwise mark the line that contains the FloatingObject dirty.
// It requires a rather special tree [1] to actually trigger a
// read-after-free, though.
//
// [1] The ex-float must be adjacent to an inline that's inside
// another inline, and the sum of the inline-start border/padding of
// those inlines must be larger than the inline size of the
// containing block. Aaand we need a line in front of all this
// (hence the BR).
victim.style.display = "none";
}, "PASS if no assertion failure or heap-use-after-free");
</script>
Codebase Browser
chromium