[text-autospace] Clone ShapeResult if the original is shared

The `LayoutNGShapeCache` runtime flag currently in test can share `ShapeResult` for the same text content. This breaks when `text-autospace` modifies the `ShapeResult`. This patch clones `ShapeResult` if it's shared when applying `text-autospace`. Fixed: 1497899, 1463890 Change-Id: Ic4c1dc87143c2f7789d5f6e46d938420707cdc97 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5019431 Reviewed-by: Lingqi Chi <[email protected]> Auto-Submit: Koji Ishii <[email protected]> Reviewed-by: Kent Tamura <[email protected]> Commit-Queue: Koji Ishii <[email protected]> Cr-Commit-Position: refs/heads/main@{#1224103}
BruceDai · Nov 14, 2023 · 1045b03 · 1045b03
1 parent 205a73d
commit 1045b03
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/css/css-text/text-autospace/crashtests/text-autospace-shape-cache-crash.html b/css/css-text/text-autospace/crashtests/text-autospace-shape-cache-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<span>る</span>
+<div>X</div>
+<div>X</div>
+<script>
+document.body.offsetHeight;
+const span = document.querySelector('span');
+const divs = Array.prototype.slice.call(document.querySelectorAll('div'));
+for (const e of divs) {
+  const n = span.cloneNode(span);
+  e.appendChild(n);
+  e.offsetHeight;
+}
+</script>