summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatt A. Tobin <email@mattatobin.com>2020-04-17 06:38:06 -0400
committerMatt A. Tobin <email@mattatobin.com>2020-04-17 06:38:06 -0400
commit55d83ea6f9aa9d99963a4d1fb1f96a3b633ede49 (patch)
tree3c17687760f5519341c84fb4436720d5f4bf0f98
parent48f602e65b0bcb10e3a8367dbbb70185e2e33125 (diff)
downloaduxp-55d83ea6f9aa9d99963a4d1fb1f96a3b633ede49.tar.gz
Bug 1381134 - Ensure we're using the correct frame for the :after/:before references
Tag #1375
-rw-r--r--layout/base/nsCSSFrameConstructor.cpp8
-rw-r--r--layout/generic/crashtests/1381134-2.html45
-rw-r--r--layout/generic/crashtests/1381134.html45
-rw-r--r--layout/generic/crashtests/crashtests.list2
-rw-r--r--layout/reftests/css-grid/reftest.list2
5 files changed, 97 insertions, 5 deletions
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 1341f96338..85f53a8200 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -6076,12 +6076,10 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
static void
AddGenConPseudoToFrame(nsIFrame* aOwnerFrame, nsIContent* aContent)
{
- NS_ASSERTION(nsLayoutUtils::IsFirstContinuationOrIBSplitSibling(aOwnerFrame),
- "property should only be set on first continuation/ib-sibling");
-
// FIXME(emilio): Remove this property, and use the frame of the generated
// content itself to tear the content down? It should be quite simpler.
+ aOwnerFrame = nsLayoutUtils::FirstContinuationOrIBSplitSibling(aOwnerFrame);
nsIFrame::ContentArray* value =
aOwnerFrame->GetProperty(nsIFrame::GenConProperty());
if (!value) {
@@ -6343,7 +6341,9 @@ AdjustAppendParentForAfterContent(nsFrameManager* aFrameManager,
// frames to find the first one that is either a ::after frame for an
// ancestor of aChild or a frame that is for a node later in the
// document than aChild and return that in aAfterFrame.
- if (aParentFrame->GetProperty(nsIFrame::GenConProperty()) ||
+ nsIFrame* afterBeforeOwnerFrame =
+ nsLayoutUtils::FirstContinuationOrIBSplitSibling(aParentFrame);
+ if (afterBeforeOwnerFrame->GetProperty(nsIFrame::GenConProperty()) ||
nsLayoutUtils::HasPseudoStyle(aContainer, aParentFrame->StyleContext(),
CSSPseudoElementType::after,
aParentFrame->PresContext()) ||
diff --git a/layout/generic/crashtests/1381134-2.html b/layout/generic/crashtests/1381134-2.html
new file mode 100644
index 0000000000..d3ac73507a
--- /dev/null
+++ b/layout/generic/crashtests/1381134-2.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+addEventListener("DOMContentLoaded", () => {
+ [d1, d2] = document.getElementsByTagName("div");
+ [s1, s2] = document.getElementsByTagName("span")
+ d3 = document.createElement("div")
+ d4 = document.createElement("div")
+ d4.setAttribute("class", "grid")
+ d3.appendChild(d4)
+ d1.appendChild(document.createElement("span"))
+ setTimeout(() => {
+ d2.removeChild(s2)
+ setTimeout(() => {
+ d2.insertBefore(d3, s1)
+ }, 100)
+ }, 100)
+})
+</script>
+<style>
+.columns {
+ columns: 3;
+}
+.grid {
+ border:5px solid;
+ counter-reset: item;
+}
+.grid * { display:block; }
+span { display:contents; }
+span::before { content: counter(item) ":before"; }
+span::after { content: counter(item) ":after"; }
+</style>
+</head>
+<body>
+<div class=columns>
+<div class=grid>
+<c></c>
+<span><c></c></span>
+<span><c></c></span>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1381134.html b/layout/generic/crashtests/1381134.html
new file mode 100644
index 0000000000..a45fa04ecb
--- /dev/null
+++ b/layout/generic/crashtests/1381134.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+addEventListener("DOMContentLoaded", () => {
+ [d1, d2] = document.getElementsByTagName("div");
+ [s1, s2] = document.getElementsByTagName("span")
+ d3 = document.createElement("div")
+ d4 = document.createElement("div")
+ d4.setAttribute("class", "grid")
+ d3.appendChild(d4)
+ d1.appendChild(document.createElement("span"))
+ setTimeout(() => {
+ d2.removeChild(s2)
+ setTimeout(() => {
+ d2.insertBefore(d3, s1)
+ }, 100)
+ }, 100)
+})
+</script>
+<style>
+.columns {
+ columns: 3;
+}
+.grid {
+ display: grid;
+ border:5px solid;
+ counter-reset: item;
+}
+span { display:contents; }
+span::before { content: counter(item) ":before"; }
+span::after { content: counter(item) ":after"; }
+</style>
+</head>
+<body>
+<div class=columns>
+<div class=grid>
+<c></c>
+<span><c></c></span>
+<span><c></c></span>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index a3c0d62c68..1a597e51c0 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -642,3 +642,5 @@ load 1278461-1.html
load 1278461-2.html
load 1304441.html
load 1316649.html
+load 1381134.html
+load 1381134-2.html
diff --git a/layout/reftests/css-grid/reftest.list b/layout/reftests/css-grid/reftest.list
index 7c5e6be514..52073b9bf5 100644
--- a/layout/reftests/css-grid/reftest.list
+++ b/layout/reftests/css-grid/reftest.list
@@ -251,7 +251,7 @@ asserts(0-10) == grid-fragmentation-015.html grid-fragmentation-015-ref.html # b
!= grid-fragmentation-dyn1-021.html grid-fragmentation-021-ref.html # bug 1251799
== grid-fragmentation-dyn2-021.html grid-fragmentation-021-ref.html
== grid-fragmentation-dyn3-021.html grid-fragmentation-021-ref.html
-asserts(1-10) == grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html # assertion related to bug 1251799 ?
+== grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html
== grid-fragmentation-dyn5-021.html grid-fragmentation-021-ref.html
== grid-fragmentation-dyn2-022.html grid-fragmentation-007-ref.html
== grid-fragmentation-dyn1-023.html grid-fragmentation-023-ref.html