#54281: chore: cherry-pick 0728ae248ac5 from chromium
Description of Change
Backport of https://chromium-review.googlesource.com/c/chromium/src/+/8431509.
Fixes a renderer crash in Document::UpdateStyleAndLayoutTreeForThisDocument() (CHECK(StateAllowsTreeMutations())). When a ResizeObserver hit its loop limit, script run by the resulting error event could dirty style or layout in an ancestor frame, or dirty layout without lowering the lifecycle state, and the lifecycle did not repeat. The next compositing-inputs phase then committed a pending selection, FrameSelection::SelectionHasFocus() forced a layout update, and the CHECK fired. The lifecycle now repeats after the error event is dispatched. See https://issues.chromium.org/issues/541952000.
Supersedes #52670.
Checklist
- PR description included and stakeholders cc'd
- PR title follows semantic commit guidelines
Release Notes
Notes: Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout.
Backports
Semver Impact
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron