diff options
| author | Matt A. Tobin <email@mattatobin.com> | 2020-04-17 06:38:06 -0400 |
|---|---|---|
| committer | Matt A. Tobin <email@mattatobin.com> | 2020-04-17 06:38:06 -0400 |
| commit | 55d83ea6f9aa9d99963a4d1fb1f96a3b633ede49 (patch) | |
| tree | 3c17687760f5519341c84fb4436720d5f4bf0f98 | |
| parent | 48f602e65b0bcb10e3a8367dbbb70185e2e33125 (diff) | |
| download | uxp-55d83ea6f9aa9d99963a4d1fb1f96a3b633ede49.tar.gz | |
Bug 1381134 - Ensure we're using the correct frame for the :after/:before references
Tag #1375
| -rw-r--r-- | layout/base/nsCSSFrameConstructor.cpp | 8 | ||||
| -rw-r--r-- | layout/generic/crashtests/1381134-2.html | 45 | ||||
| -rw-r--r-- | layout/generic/crashtests/1381134.html | 45 | ||||
| -rw-r--r-- | layout/generic/crashtests/crashtests.list | 2 | ||||
| -rw-r--r-- | layout/reftests/css-grid/reftest.list | 2 |
5 files changed, 97 insertions, 5 deletions
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp index 1341f96338..85f53a8200 100644 --- a/layout/base/nsCSSFrameConstructor.cpp +++ b/layout/base/nsCSSFrameConstructor.cpp @@ -6076,12 +6076,10 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState static void AddGenConPseudoToFrame(nsIFrame* aOwnerFrame, nsIContent* aContent) { - NS_ASSERTION(nsLayoutUtils::IsFirstContinuationOrIBSplitSibling(aOwnerFrame), - "property should only be set on first continuation/ib-sibling"); - // FIXME(emilio): Remove this property, and use the frame of the generated // content itself to tear the content down? It should be quite simpler. + aOwnerFrame = nsLayoutUtils::FirstContinuationOrIBSplitSibling(aOwnerFrame); nsIFrame::ContentArray* value = aOwnerFrame->GetProperty(nsIFrame::GenConProperty()); if (!value) { @@ -6343,7 +6341,9 @@ AdjustAppendParentForAfterContent(nsFrameManager* aFrameManager, // frames to find the first one that is either a ::after frame for an // ancestor of aChild or a frame that is for a node later in the // document than aChild and return that in aAfterFrame. - if (aParentFrame->GetProperty(nsIFrame::GenConProperty()) || + nsIFrame* afterBeforeOwnerFrame = + nsLayoutUtils::FirstContinuationOrIBSplitSibling(aParentFrame); + if (afterBeforeOwnerFrame->GetProperty(nsIFrame::GenConProperty()) || nsLayoutUtils::HasPseudoStyle(aContainer, aParentFrame->StyleContext(), CSSPseudoElementType::after, aParentFrame->PresContext()) || diff --git a/layout/generic/crashtests/1381134-2.html b/layout/generic/crashtests/1381134-2.html new file mode 100644 index 0000000000..d3ac73507a --- /dev/null +++ b/layout/generic/crashtests/1381134-2.html @@ -0,0 +1,45 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +addEventListener("DOMContentLoaded", () => { + [d1, d2] = document.getElementsByTagName("div"); + [s1, s2] = document.getElementsByTagName("span") + d3 = document.createElement("div") + d4 = document.createElement("div") + d4.setAttribute("class", "grid") + d3.appendChild(d4) + d1.appendChild(document.createElement("span")) + setTimeout(() => { + d2.removeChild(s2) + setTimeout(() => { + d2.insertBefore(d3, s1) + }, 100) + }, 100) +}) +</script> +<style> +.columns { + columns: 3; +} +.grid { + border:5px solid; + counter-reset: item; +} +.grid * { display:block; } +span { display:contents; } +span::before { content: counter(item) ":before"; } +span::after { content: counter(item) ":after"; } +</style> +</head> +<body> +<div class=columns> +<div class=grid> +<c></c> +<span><c></c></span> +<span><c></c></span> +</div> +</div> +</body> +</html> diff --git a/layout/generic/crashtests/1381134.html b/layout/generic/crashtests/1381134.html new file mode 100644 index 0000000000..a45fa04ecb --- /dev/null +++ b/layout/generic/crashtests/1381134.html @@ -0,0 +1,45 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +addEventListener("DOMContentLoaded", () => { + [d1, d2] = document.getElementsByTagName("div"); + [s1, s2] = document.getElementsByTagName("span") + d3 = document.createElement("div") + d4 = document.createElement("div") + d4.setAttribute("class", "grid") + d3.appendChild(d4) + d1.appendChild(document.createElement("span")) + setTimeout(() => { + d2.removeChild(s2) + setTimeout(() => { + d2.insertBefore(d3, s1) + }, 100) + }, 100) +}) +</script> +<style> +.columns { + columns: 3; +} +.grid { + display: grid; + border:5px solid; + counter-reset: item; +} +span { display:contents; } +span::before { content: counter(item) ":before"; } +span::after { content: counter(item) ":after"; } +</style> +</head> +<body> +<div class=columns> +<div class=grid> +<c></c> +<span><c></c></span> +<span><c></c></span> +</div> +</div> +</body> +</html> diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list index a3c0d62c68..1a597e51c0 100644 --- a/layout/generic/crashtests/crashtests.list +++ b/layout/generic/crashtests/crashtests.list @@ -642,3 +642,5 @@ load 1278461-1.html load 1278461-2.html load 1304441.html load 1316649.html +load 1381134.html +load 1381134-2.html diff --git a/layout/reftests/css-grid/reftest.list b/layout/reftests/css-grid/reftest.list index 7c5e6be514..52073b9bf5 100644 --- a/layout/reftests/css-grid/reftest.list +++ b/layout/reftests/css-grid/reftest.list @@ -251,7 +251,7 @@ asserts(0-10) == grid-fragmentation-015.html grid-fragmentation-015-ref.html # b != grid-fragmentation-dyn1-021.html grid-fragmentation-021-ref.html # bug 1251799 == grid-fragmentation-dyn2-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn3-021.html grid-fragmentation-021-ref.html -asserts(1-10) == grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html # assertion related to bug 1251799 ? +== grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn5-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn2-022.html grid-fragmentation-007-ref.html == grid-fragmentation-dyn1-023.html grid-fragmentation-023-ref.html |