Reapply "[layout] Reinsert LayoutObjects which undergo a in-flow state change." [chromium/src : main]

0 views
Skip to first unread message

Ian Kilpatrick (Gerrit)

unread,
Jan 9, 2026, 6:23:55 PM (14 days ago) Jan 9
to Morten Stenshorne, Chromium LUCI CQ, AyeAye, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-re...@chromium.org, blink-revi...@chromium.org, blink-rev...@chromium.org, blink-...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, mac-r...@chromium.org, zol...@webkit.org
Attention needed from Morten Stenshorne

Ian Kilpatrick added 1 comment

Patchset-level comments
File-level comment, Patchset 5 (Latest):
Ian Kilpatrick . unresolved

I'll land this after the next branch point next week.

For the delta between the reapply and the update see:
https://chromium-review.googlesource.com/c/chromium/src/+/7427180/1..5

All a just nullptr checks so for. Clusterfuzz seemed to do a good job finding issues, so we'll see what else it finds in the reapply.

Open in Gerrit

Related details

Attention is currently required from:
  • Morten Stenshorne
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
Gerrit-Change-Number: 7427180
Gerrit-PatchSet: 5
Gerrit-Owner: Ian Kilpatrick <ikilp...@chromium.org>
Gerrit-Reviewer: Ian Kilpatrick <ikilp...@chromium.org>
Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
Gerrit-Attention: Morten Stenshorne <mste...@chromium.org>
Gerrit-Comment-Date: Fri, 09 Jan 2026 23:23:45 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Ian Kilpatrick (Gerrit)

unread,
Jan 9, 2026, 6:24:00 PM (14 days ago) Jan 9
to Morten Stenshorne, Chromium LUCI CQ, AyeAye, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-re...@chromium.org, blink-revi...@chromium.org, blink-rev...@chromium.org, blink-...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, mac-r...@chromium.org, zol...@webkit.org
Attention needed from Morten Stenshorne

Ian Kilpatrick voted Code-Review-1

Code-Review-1
Open in Gerrit

Related details

Attention is currently required from:
  • Morten Stenshorne
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement is blockingCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
    Gerrit-Change-Number: 7427180
    Gerrit-PatchSet: 5
    Gerrit-Owner: Ian Kilpatrick <ikilp...@chromium.org>
    Gerrit-Reviewer: Ian Kilpatrick <ikilp...@chromium.org>
    Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
    Gerrit-Attention: Morten Stenshorne <mste...@chromium.org>
    Gerrit-Comment-Date: Fri, 09 Jan 2026 23:23:52 +0000
    Gerrit-HasComments: No
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    blocking_requirement
    unsatisfied_requirement
    open
    diffy

    Morten Stenshorne (Gerrit)

    unread,
    Jan 12, 2026, 3:13:16 AM (11 days ago) Jan 12
    to Ian Kilpatrick, Chromium LUCI CQ, AyeAye, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-re...@chromium.org, blink-revi...@chromium.org, blink-rev...@chromium.org, blink-...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, mac-r...@chromium.org, zol...@webkit.org
    Attention needed from Ian Kilpatrick

    Morten Stenshorne added 2 comments

    Patchset-level comments
    Morten Stenshorne . resolved

    All the new nullptr checks... are we sure we really should be inside these functions if we have a nullptr?

    File third_party/blink/renderer/core/layout/layout_box_model_object.cc
    Line 203, Patchset 5 (Latest): } else if (Layer() && (RuntimeEnabledFeatures::
    Morten Stenshorne . unresolved

    We'll now do this for the root layer. Any concerns?

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Ian Kilpatrick
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement is blockingCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
    Gerrit-Change-Number: 7427180
    Gerrit-PatchSet: 5
    Gerrit-Owner: Ian Kilpatrick <ikilp...@chromium.org>
    Gerrit-Reviewer: Ian Kilpatrick <ikilp...@chromium.org>
    Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
    Gerrit-Attention: Ian Kilpatrick <ikilp...@chromium.org>
    Gerrit-Comment-Date: Mon, 12 Jan 2026 08:13:02 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    satisfied_requirement
    blocking_requirement
    unsatisfied_requirement
    open
    diffy

    Ian Kilpatrick (Gerrit)

    unread,
    Jan 14, 2026, 7:43:38 PM (9 days ago) Jan 14
    to Morten Stenshorne, Chromium LUCI CQ, AyeAye, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-re...@chromium.org, blink-revi...@chromium.org, blink-rev...@chromium.org, blink-...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, mac-r...@chromium.org, zol...@webkit.org
    Attention needed from Morten Stenshorne

    Ian Kilpatrick voted and added 2 comments

    Votes added by Ian Kilpatrick

    Code-Review+0

    2 comments

    Patchset-level comments
    Morten Stenshorne . resolved

    All the new nullptr checks... are we sure we really should be inside these functions if we have a nullptr?

    Ian Kilpatrick

    I think so - an arguable one is `DirtyVisibleContentStatus` - but it also calls `MarkAncestorChainForFlagsUpdate` which has a side-effect on the current layer which i think is needed.

    File third_party/blink/renderer/core/layout/layout_box_model_object.cc
    Line 203, Patchset 5 (Latest): } else if (Layer() && (RuntimeEnabledFeatures::
    Morten Stenshorne . unresolved

    We'll now do this for the root layer. Any concerns?

    Ian Kilpatrick

    I don't think so - (can we even change the style for the root layer?).

    This part of the change was reverted in:
    https://chromiumdash.appspot.com/commit/d19611f290f1c793202dacb7ce790c86ed6db9c3

    and clusterfuzz seemed ok with it for a few weeks (compared with a few hours for the rest of this change).

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Morten Stenshorne
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedNo-Unresolved-Comments
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
      Gerrit-Change-Number: 7427180
      Gerrit-PatchSet: 5
      Gerrit-Owner: Ian Kilpatrick <ikilp...@chromium.org>
      Gerrit-Reviewer: Ian Kilpatrick <ikilp...@chromium.org>
      Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
      Gerrit-Attention: Morten Stenshorne <mste...@chromium.org>
      Gerrit-Comment-Date: Thu, 15 Jan 2026 00:43:27 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: Yes
      Comment-In-Reply-To: Morten Stenshorne <mste...@chromium.org>
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Morten Stenshorne (Gerrit)

      unread,
      Jan 15, 2026, 3:31:57 AM (8 days ago) Jan 15
      to Ian Kilpatrick, Chromium LUCI CQ, AyeAye, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-re...@chromium.org, blink-revi...@chromium.org, blink-rev...@chromium.org, blink-...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, mac-r...@chromium.org, zol...@webkit.org
      Attention needed from Ian Kilpatrick

      Morten Stenshorne voted and added 1 comment

      Votes added by Morten Stenshorne

      Code-Review+1

      1 comment

      File third_party/blink/renderer/core/layout/layout_box_model_object.cc
      Line 203, Patchset 5: } else if (Layer() && (RuntimeEnabledFeatures::
      Morten Stenshorne . resolved

      We'll now do this for the root layer. Any concerns?

      Ian Kilpatrick

      I don't think so - (can we even change the style for the root layer?).

      This part of the change was reverted in:
      https://chromiumdash.appspot.com/commit/d19611f290f1c793202dacb7ce790c86ed6db9c3

      and clusterfuzz seemed ok with it for a few weeks (compared with a few hours for the rest of this change).

      Morten Stenshorne

      I don't think so - (can we even change the style for the root layer?).

      Yes, we can, via StyleResolver::PropagateStyleToViewport(), but in order to end up in this particular code path for LayoutView, LayerTypeRequired() would have to say that a layer is no longer required. That seems impossible.

      This part of the change was reverted in:
      https://chromiumdash.appspot.com/commit/d19611f290f1c793202dacb7ce790c86ed6db9c3

      and clusterfuzz seemed ok with it for a few weeks (compared with a few hours for the rest of this change).

      Open in Gerrit

      Related details

      Attention is currently required from:
      • Ian Kilpatrick
      Submit Requirements:
        • requirement satisfiedCode-Coverage
        • requirement satisfiedCode-Owners
        • requirement satisfiedCode-Review
        • requirement is not satisfiedNo-Unresolved-Comments
        • requirement satisfiedReview-Enforcement
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        Gerrit-MessageType: comment
        Gerrit-Project: chromium/src
        Gerrit-Branch: main
        Gerrit-Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
        Gerrit-Change-Number: 7427180
        Gerrit-PatchSet: 6
        Gerrit-Owner: Ian Kilpatrick <ikilp...@chromium.org>
        Gerrit-Reviewer: Ian Kilpatrick <ikilp...@chromium.org>
        Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
        Gerrit-Attention: Ian Kilpatrick <ikilp...@chromium.org>
        Gerrit-Comment-Date: Thu, 15 Jan 2026 08:31:36 +0000
        Gerrit-HasComments: Yes
        Gerrit-Has-Labels: Yes
        Comment-In-Reply-To: Ian Kilpatrick <ikilp...@chromium.org>
        Comment-In-Reply-To: Morten Stenshorne <mste...@chromium.org>
        satisfied_requirement
        unsatisfied_requirement
        open
        diffy

        Ian Kilpatrick (Gerrit)

        unread,
        Jan 15, 2026, 1:38:18 PM (8 days ago) Jan 15
        to Morten Stenshorne, Chromium LUCI CQ, AyeAye, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-re...@chromium.org, blink-revi...@chromium.org, blink-rev...@chromium.org, blink-...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, mac-r...@chromium.org, zol...@webkit.org

        Ian Kilpatrick voted and added 1 comment

        Votes added by Ian Kilpatrick

        Commit-Queue+2

        1 comment

        Patchset-level comments
        File-level comment, Patchset 5:
        Ian Kilpatrick . resolved

        I'll land this after the next branch point next week.

        For the delta between the reapply and the update see:
        https://chromium-review.googlesource.com/c/chromium/src/+/7427180/1..5

        All a just nullptr checks so for. Clusterfuzz seemed to do a good job finding issues, so we'll see what else it finds in the reapply.

        Ian Kilpatrick

        Acknowledged

        Open in Gerrit

        Related details

        Attention set is empty
        Submit Requirements:
          • requirement satisfiedCode-Coverage
          • requirement satisfiedCode-Owners
          • requirement satisfiedCode-Review
          • requirement satisfiedReview-Enforcement
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: comment
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
          Gerrit-Change-Number: 7427180
          Gerrit-PatchSet: 6
          Gerrit-Owner: Ian Kilpatrick <ikilp...@chromium.org>
          Gerrit-Reviewer: Ian Kilpatrick <ikilp...@chromium.org>
          Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
          Gerrit-Comment-Date: Thu, 15 Jan 2026 18:38:09 +0000
          satisfied_requirement
          open
          diffy

          Chromium LUCI CQ (Gerrit)

          unread,
          Jan 15, 2026, 1:43:23 PM (8 days ago) Jan 15
          to Ian Kilpatrick, Morten Stenshorne, AyeAye, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-re...@chromium.org, blink-revi...@chromium.org, blink-rev...@chromium.org, blink-...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, mac-r...@chromium.org, zol...@webkit.org

          Chromium LUCI CQ submitted the change

          Change information

          Commit message:
          Reapply "[layout] Reinsert LayoutObjects which undergo a in-flow state change."

          This reverts commit 07002c40c631b6ee35ee32d2bbccacc75e9052a0.

          This patch reinserts layout-objects into the layout-tree when their
          out-of-flow state changes. (E.g. a change from position:static to
          position:absolute or float:left to float:none).

          When their out-of-flow state changes we'll remove it from the
          layout-object tree, update the style, then reinsert into the tree. This
          is similar to layout-tree reattachment, except the layout-object (and
          related objects/caches) are kept around.

          This simplifies our logic when style changes in this way. Previously
          we'd need to mutate the layout tree during LayoutObject::SetStyle which
          was complex and error prone, and a source of bugs.

          See removal patch for complexity we can remove:
          https://chromium-review.googlesource.com/c/chromium/src/+/7263470

          All behaviour changes should be behind the flag:
          LayoutReinsertOnInFlowStateChange
          Bug: 469120960
          Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
          Commit-Queue: Ian Kilpatrick <ikilp...@chromium.org>
          Reviewed-by: Morten Stenshorne <mste...@chromium.org>
          Cr-Commit-Position: refs/heads/main@{#1569882}
          Files:
          • M third_party/blink/renderer/core/dom/element.cc
          • M third_party/blink/renderer/core/layout/layout_block_flow.cc
          • M third_party/blink/renderer/core/layout/layout_box.cc
          • M third_party/blink/renderer/core/layout/layout_box_model_object.cc
          • M third_party/blink/renderer/core/layout/layout_inline.cc
          • M third_party/blink/renderer/core/layout/layout_object.cc
          • M third_party/blink/renderer/core/layout/layout_object.h
          • M third_party/blink/renderer/core/paint/paint_layer.cc
          • M third_party/blink/renderer/core/style/computed_style.cc
          • M third_party/blink/renderer/core/style/computed_style.h
          • M third_party/blink/renderer/platform/runtime_enabled_features.json5
          • A third_party/blink/web_tests/external/wpt/css/CSS2/floats/crashtests/float-dynamic-change-1.html
          • A third_party/blink/web_tests/external/wpt/css/CSS2/floats/crashtests/float-dynamic-change-2.html
          • A third_party/blink/web_tests/external/wpt/css/CSS2/floats/crashtests/float-dynamic-change-3.html
          • A third_party/blink/web_tests/external/wpt/css/CSS2/floats/crashtests/float-dynamic-change-4.html
          • M third_party/blink/web_tests/paint/invalidation/position/position-change-keeping-geometry-expected.txt
          • M third_party/blink/web_tests/paint/invalidation/position/positioned-document-element-expected.txt
          • M third_party/blink/web_tests/platform/mac/paint/invalidation/position/position-change-keeping-geometry-expected.txt
          Change size: M
          Delta: 18 files changed, 182 insertions(+), 45 deletions(-)
          Branch: refs/heads/main
          Submit Requirements:
          • requirement satisfiedCode-Review: +1 by Morten Stenshorne
          Open in Gerrit
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: merged
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
          Gerrit-Change-Number: 7427180
          Gerrit-PatchSet: 7
          Gerrit-Owner: Ian Kilpatrick <ikilp...@chromium.org>
          Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>
          Gerrit-Reviewer: Ian Kilpatrick <ikilp...@chromium.org>
          Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
          open
          diffy
          satisfied_requirement

          Blink W3C Test Autoroller (Gerrit)

          unread,
          Jan 15, 2026, 2:31:08 PM (8 days ago) Jan 15
          to Chromium LUCI CQ, Ian Kilpatrick, Morten Stenshorne, AyeAye, chromium...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org, blink-re...@chromium.org, blink-revi...@chromium.org, blink-rev...@chromium.org, blink-...@chromium.org, jmedle...@chromium.org, kinuko...@chromium.org, mac-r...@chromium.org, zol...@webkit.org

          Message from Blink W3C Test Autoroller

          The WPT PR for this CL has been merged upstream! https://github.com/web-platform-tests/wpt/pull/57186

          Open in Gerrit

          Related details

          Attention set is empty
          Submit Requirements:
          • requirement satisfiedCode-Coverage
          • requirement satisfiedCode-Owners
          • requirement satisfiedCode-Review
          • requirement satisfiedReview-Enforcement
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: comment
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I983967e03d10552ad2f8cd1f70b4c3c2ea079836
          Gerrit-Change-Number: 7427180
          Gerrit-PatchSet: 7
          Gerrit-Owner: Ian Kilpatrick <ikilp...@chromium.org>
          Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>
          Gerrit-Reviewer: Ian Kilpatrick <ikilp...@chromium.org>
          Gerrit-Reviewer: Morten Stenshorne <mste...@chromium.org>
          Gerrit-CC: Blink W3C Test Autoroller <blink-w3c-te...@chromium.org>
          Gerrit-Comment-Date: Thu, 15 Jan 2026 19:31:02 +0000
          Gerrit-HasComments: No
          Gerrit-Has-Labels: No
          satisfied_requirement
          open
          diffy
          Reply all
          Reply to author
          Forward
          0 new messages