From 43a97878ce14b72f0981164f87f2e35e14151312 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 11:22:09 +0200
Subject: Adding upstream version 110.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 .../caption-with-multicol-table-cell.html           |  8 ++++++++
 .../crashtests/col_span_dynamic_crash.html          | 21 +++++++++++++++++++++
 .../css-tables/crashtests/dialog-table-crash.html   | 16 ++++++++++++++++
 .../crashtests/dynamic-recompute-baseline.html      | 12 ++++++++++++
 .../crashtests/dynamic_col_width_crash.html         | 12 ++++++++++++
 .../crashtests/dynamic_table_layout_crash.html      |  9 +++++++++
 .../empty-tbody-after-tall-section-crash.html       |  8 ++++++++
 .../css-tables/crashtests/empty_cells_crash.html    | 17 +++++++++++++++++
 .../crashtests/empty_table_with_cols.html           |  3 +++
 .../crashtests/expression_width_crash.html          |  5 +++++
 .../crashtests/inline-splitting-crash.html          | 16 ++++++++++++++++
 .../css-tables/crashtests/large-border-crash.html   |  3 +++
 .../css/css-tables/crashtests/large-col-widths.html | 11 +++++++++++
 .../css-tables/crashtests/legacy_ng_mix_crash.html  |  9 +++++++++
 .../move-oof-inside-section-row-with-borders.html   | 16 ++++++++++++++++
 .../crashtests/negative-section-distribution.html   | 12 ++++++++++++
 .../crashtests/negative_caption_margin.html         | 12 ++++++++++++
 .../crashtests/orthogonal-cell-borders.html         |  5 +++++
 .../crashtests/orthogonal-cell-crash.html           |  5 +++++
 .../table-column-display-change-chrome-crash.html   | 16 ++++++++++++++++
 .../crashtests/textarea-intrinsic-size-crash.html   |  6 ++++++
 .../crashtests/uninitialized_read_crash.html        | 18 ++++++++++++++++++
 .../crashtests/vertical_percentage_crash.html       |  9 +++++++++
 23 files changed, 249 insertions(+)
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/caption-with-multicol-table-cell.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/col_span_dynamic_crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/dialog-table-crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/dynamic-recompute-baseline.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/dynamic_col_width_crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/dynamic_table_layout_crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/empty-tbody-after-tall-section-crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/empty_cells_crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/empty_table_with_cols.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/expression_width_crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/inline-splitting-crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/large-border-crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/large-col-widths.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/legacy_ng_mix_crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/move-oof-inside-section-row-with-borders.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/negative-section-distribution.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/negative_caption_margin.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/orthogonal-cell-borders.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/orthogonal-cell-crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/table-column-display-change-chrome-crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/textarea-intrinsic-size-crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/uninitialized_read_crash.html
 create mode 100644 testing/web-platform/tests/css/css-tables/crashtests/vertical_percentage_crash.html

(limited to 'testing/web-platform/tests/css/css-tables/crashtests')

diff --git a/testing/web-platform/tests/css/css-tables/crashtests/caption-with-multicol-table-cell.html b/testing/web-platform/tests/css/css-tables/crashtests/caption-with-multicol-table-cell.html
new file mode 100644
index 0000000000..2228ad6936
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/caption-with-multicol-table-cell.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1177684">
+<table>
+  <caption>
+    <div style="columns:1; display:table-cell;"></div>
+  </caption>
+</table>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/col_span_dynamic_crash.html b/testing/web-platform/tests/css/css-tables/crashtests/col_span_dynamic_crash.html
new file mode 100644
index 0000000000..67630066fa
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/col_span_dynamic_crash.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<style>
+  col {
+    border:2px solid green;
+  }
+</style>
+<table style="border-collapse:collapse">
+  <colgroup>
+    <col span=3 id="target">
+  </colgroup>
+  <tbody>
+    <tr>
+      <td>a</td>
+      <td>b</td>
+    </tr>
+  </tbody>
+</table>
+<script>
+  document.body.offsetTop;
+  document.querySelector("#target").setAttribute("span", 0);
+</script>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/dialog-table-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/dialog-table-crash.html
new file mode 100644
index 0000000000..decc3eb1fb
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/dialog-table-crash.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<link rel="help" href="https://crbug.com/1175425">
+
+<div id="container" style="border-collapse:collapse;">
+  <div id="insertBefore"></div>
+  <div style="display:table-row-group;"></div>
+  <div id="victim" style="border:solid; display:table-row-group;">
+    <div style="display:table-cell;"></div>
+  </div>
+</div>
+
+<script>
+  document.body.offsetTop;
+  container.insertBefore(insertBefore, victim)
+</script>
+
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/dynamic-recompute-baseline.html b/testing/web-platform/tests/css/css-tables/crashtests/dynamic-recompute-baseline.html
new file mode 100644
index 0000000000..049de2f15c
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/dynamic-recompute-baseline.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<table>
+  <caption id="target"></caption>
+  <td>
+    <div style="display: inline-block; height: 10%;"></div>
+  </td>
+  <td style="vertical-align: baseline;"></td>
+</table>
+<script>
+  document.body.offsetTop;
+  document.getElementById('target').style.height = '100px';
+</script>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/dynamic_col_width_crash.html b/testing/web-platform/tests/css/css-tables/crashtests/dynamic_col_width_crash.html
new file mode 100644
index 0000000000..e19c22be31
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/dynamic_col_width_crash.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<table rules="cols">
+    <caption>caption</caption>
+    <col id="target" style="width:50%"/>
+    <tbody>
+      <tr></tr>
+    </tbody>
+  </table>
+<script>
+document.body.offsetTop;
+document.getElementById('target').style.width = 'auto';
+</script>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/dynamic_table_layout_crash.html b/testing/web-platform/tests/css/css-tables/crashtests/dynamic_table_layout_crash.html
new file mode 100644
index 0000000000..cc28f3bfdc
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/dynamic_table_layout_crash.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<table id="target" style="border: solid; border-collapse: collapse; table-layout: fixed; width: 50px;">
+  <tr><td style="background: lime;">hi</td></tr>
+  <td colspan=3>there</td>
+</table>
+<script>
+document.body.offsetTop;
+document.getElementById('target').style.tableLayout = 'auto';
+</script>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/empty-tbody-after-tall-section-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/empty-tbody-after-tall-section-crash.html
new file mode 100644
index 0000000000..b2d6e64254
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/empty-tbody-after-tall-section-crash.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1326276">
+<table cellspacing="1">
+  <caption style="border-bottom:1234567890px solid;"></caption>
+  <colgroup style="width:1px;"></colgroup>
+  <tbody></tbody>
+</table>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/empty_cells_crash.html b/testing/web-platform/tests/css/css-tables/crashtests/empty_cells_crash.html
new file mode 100644
index 0000000000..7635afc9e6
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/empty_cells_crash.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<style>
+  table {
+    empty-cells: hide;
+    border-collapse: collapse;
+  }
+  td {
+    padding:0;
+  }
+</style>
+
+<table>
+  <td></td>
+  <td colspan=2></td>
+  <td></td>
+</table>
+</div>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/empty_table_with_cols.html b/testing/web-platform/tests/css/css-tables/crashtests/empty_table_with_cols.html
new file mode 100644
index 0000000000..a2b817f85c
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/empty_table_with_cols.html
@@ -0,0 +1,3 @@
+<table style="border:1px solid black;border-collapse: collapse">
+  <colgroup >
+    <tr></tr>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/expression_width_crash.html b/testing/web-platform/tests/css/css-tables/crashtests/expression_width_crash.html
new file mode 100644
index 0000000000..5c636bef6a
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/expression_width_crash.html
@@ -0,0 +1,5 @@
+<!doctype html>
+<table >
+  <col style="width:min(100px,30%)">
+  <td style="width:min(100px,30%)"></td>
+</table>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/inline-splitting-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/inline-splitting-crash.html
new file mode 100644
index 0000000000..decc3eb1fb
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/inline-splitting-crash.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<link rel="help" href="https://crbug.com/1175425">
+
+<div id="container" style="border-collapse:collapse;">
+  <div id="insertBefore"></div>
+  <div style="display:table-row-group;"></div>
+  <div id="victim" style="border:solid; display:table-row-group;">
+    <div style="display:table-cell;"></div>
+  </div>
+</div>
+
+<script>
+  document.body.offsetTop;
+  container.insertBefore(insertBefore, victim)
+</script>
+
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/large-border-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/large-border-crash.html
new file mode 100644
index 0000000000..b61ea7f046
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/large-border-crash.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<link rel="help" href="https://crbug.com/1178044">
+<table border="2026722966"><td>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/large-col-widths.html b/testing/web-platform/tests/css/css-tables/crashtests/large-col-widths.html
new file mode 100644
index 0000000000..666750c005
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/large-col-widths.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1294634">
+<table border style="border-collapse: collapse; width: 100000000px;">
+  <col width="100000000px"></col>
+  <col width="100000000px"></col>
+  <col width="100000000px"></col>
+  <td></td>
+  <td style="border: solid 1px; border-left-width: 5px;" colspan="2">
+    <div style="overflow: hidden; width: 100px;"></div>
+  </td>
+</table>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/legacy_ng_mix_crash.html b/testing/web-platform/tests/css/css-tables/crashtests/legacy_ng_mix_crash.html
new file mode 100644
index 0000000000..7e7377ef7e
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/legacy_ng_mix_crash.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<p>PASS if no crash or DCHECK failure.</p>
+<table id="elm" style="columns:2;">
+  <colgroup style="column-count:2;">
+</table>
+<script>
+  document.body.offsetTop;
+  elm.style.columns = "auto";
+</script>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/move-oof-inside-section-row-with-borders.html b/testing/web-platform/tests/css/css-tables/crashtests/move-oof-inside-section-row-with-borders.html
new file mode 100644
index 0000000000..f6fef22ea7
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/move-oof-inside-section-row-with-borders.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1289408">
+<div style="display:table; border-collapse:collapse;">
+  <div style="display:table-row-group; border:solid; background:pink;">
+    <div style="display:table-row; border:solid; background:pink;">
+      <div style="position:relative;">
+        <div id="elm" style="top:0; position:absolute;"></div>
+      </div>
+    </div>
+  </div>
+</div>
+<script>
+  document.body.offsetTop;
+  elm.style.top = "10px";
+</script>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/negative-section-distribution.html b/testing/web-platform/tests/css/css-tables/crashtests/negative-section-distribution.html
new file mode 100644
index 0000000000..b0cedcaf5a
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/negative-section-distribution.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<div style="display: flex;">
+  <button>
+    <div style="float: left; padding-top: 2147483648em;"></div>
+  </button>
+  <table>
+    <caption style="display: flex;">
+      text<br>text
+    </caption>
+    <tbody></tbody>
+  </table>
+</div>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/negative_caption_margin.html b/testing/web-platform/tests/css/css-tables/crashtests/negative_caption_margin.html
new file mode 100644
index 0000000000..cd3c4f4bf7
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/negative_caption_margin.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+
+<style>
+*{
+  overflow:scroll;
+  margin:-900%  3000000px;
+}
+</style>
+
+<table style="overflow:scroll;margin:-900%  3000000px;">
+<caption style="overflow:scroll;margin:-900%  3000000px;">
+
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/orthogonal-cell-borders.html b/testing/web-platform/tests/css/css-tables/crashtests/orthogonal-cell-borders.html
new file mode 100644
index 0000000000..c48352a872
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/orthogonal-cell-borders.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1349181">
+<div style="display: table; border-collapse: collapse; table-layout: fixed; width: min-content;">
+  <div style="display: table-cell; width: 100%; writing-mode: vertical-rl; border-left: 100px solid green;"></div>
+</div>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/orthogonal-cell-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/orthogonal-cell-crash.html
new file mode 100644
index 0000000000..0f27d3eccd
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/orthogonal-cell-crash.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<link rel="help" href="https://crbug.com/1178130">
+<table>
+  <td style="height: 100%; writing-mode: vertical-rl;"></td>
+</table>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/table-column-display-change-chrome-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/table-column-display-change-chrome-crash.html
new file mode 100644
index 0000000000..0845882955
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/table-column-display-change-chrome-crash.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<link rel="help" href="https://crbug.com/1338779">
+<table id="table">
+  <td>
+    <span id="span1"></span>
+    <div id="div">
+      <span id="span2"></span>
+    </div>
+  </td>
+</table>
+<script>
+  document.body.offsetLeft;
+  div.style.color = "green";
+  table.style.display = "table-column";
+  span2.replaceWith(span1);
+</script>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/textarea-intrinsic-size-crash.html b/testing/web-platform/tests/css/css-tables/crashtests/textarea-intrinsic-size-crash.html
new file mode 100644
index 0000000000..e84f239987
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/textarea-intrinsic-size-crash.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1195685">
+<div style="display: -webkit-box;">
+  <div style="display: table-cell;">
+    <textarea style="padding-left: 556658635%;">
+      x
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/uninitialized_read_crash.html b/testing/web-platform/tests/css/css-tables/crashtests/uninitialized_read_crash.html
new file mode 100644
index 0000000000..5aa3b223cd
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/uninitialized_read_crash.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<link rel="help" href="https://crbug.com/1172819">
+
+<table style="height:69080px;width:100px;background: blue;border-spacing:2px;">
+
+<thead style="height:400%">
+  <tr style="height:18px"></tr>
+</thead>
+<tbody>
+  <tr style="height: 2712px"></tr>
+</tbody>
+<tbody>
+  <tr style="height: 1694px"></tr>
+</tbody>
+<tbody>
+  <tr style="height: 6436px"></tr>
+</tbody>
+</table>
diff --git a/testing/web-platform/tests/css/css-tables/crashtests/vertical_percentage_crash.html b/testing/web-platform/tests/css/css-tables/crashtests/vertical_percentage_crash.html
new file mode 100644
index 0000000000..73496da481
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/crashtests/vertical_percentage_crash.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel="author" title="Manuel Rego Casasnovas" href="mailto:rego@igalia.com">
+<link rel="help" href="https://crbug.com/1203387">
+
+<table style="writing-mode: vertical-lr">
+  <caption style="background:yellow" >
+    <textarea style="height:10%">abc</textarea>
+  </caption>
+</table>
-- 
cgit v1.2.3