diff options
| -rw-r--r-- | layout/base/nsCSSFrameConstructor.cpp | 8 | ||||
| -rw-r--r-- | layout/generic/crashtests/1381134-2.html | 45 | ||||
| -rw-r--r-- | layout/generic/crashtests/1381134.html | 45 | ||||
| -rw-r--r-- | layout/generic/crashtests/crashtests.list | 2 | ||||
| -rw-r--r-- | layout/reftests/css-grid/reftest.list | 2 |
5 files changed, 97 insertions, 5 deletions
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp index 1341f9633..85f53a820 100644 --- a/layout/base/nsCSSFrameConstructor.cpp +++ b/layout/base/nsCSSFrameConstructor.cpp @@ -6076,12 +6076,10 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState static void AddGenConPseudoToFrame(nsIFrame* aOwnerFrame, nsIContent* aContent) { - NS_ASSERTION(nsLayoutUtils::IsFirstContinuationOrIBSplitSibling(aOwnerFrame), - "property should only be set on first continuation/ib-sibling"); - // FIXME(emilio): Remove this property, and use the frame of the generated // content itself to tear the content down? It should be quite simpler. + aOwnerFrame = nsLayoutUtils::FirstContinuationOrIBSplitSibling(aOwnerFrame); nsIFrame::ContentArray* value = aOwnerFrame->GetProperty(nsIFrame::GenConProperty()); if (!value) { @@ -6343,7 +6341,9 @@ AdjustAppendParentForAfterContent(nsFrameManager* aFrameManager, // frames to find the first one that is either a ::after frame for an // ancestor of aChild or a frame that is for a node later in the // document than aChild and return that in aAfterFrame. - if (aParentFrame->GetProperty(nsIFrame::GenConProperty()) || + nsIFrame* afterBeforeOwnerFrame = + nsLayoutUtils::FirstContinuationOrIBSplitSibling(aParentFrame); + if (afterBeforeOwnerFrame->GetProperty(nsIFrame::GenConProperty()) || nsLayoutUtils::HasPseudoStyle(aContainer, aParentFrame->StyleContext(), CSSPseudoElementType::after, aParentFrame->PresContext()) || diff --git a/layout/generic/crashtests/1381134-2.html b/layout/generic/crashtests/1381134-2.html new file mode 100644 index 000000000..d3ac73507 --- /dev/null +++ b/layout/generic/crashtests/1381134-2.html @@ -0,0 +1,45 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +addEventListener("DOMContentLoaded", () => { + [d1, d2] = document.getElementsByTagName("div"); + [s1, s2] = document.getElementsByTagName("span") + d3 = document.createElement("div") + d4 = document.createElement("div") + d4.setAttribute("class", "grid") + d3.appendChild(d4) + d1.appendChild(document.createElement("span")) + setTimeout(() => { + d2.removeChild(s2) + setTimeout(() => { + d2.insertBefore(d3, s1) + }, 100) + }, 100) +}) +</script> +<style> +.columns { + columns: 3; +} +.grid { + border:5px solid; + counter-reset: item; +} +.grid * { display:block; } +span { display:contents; } +span::before { content: counter(item) ":before"; } +span::after { content: counter(item) ":after"; } +</style> +</head> +<body> +<div class=columns> +<div class=grid> +<c></c> +<span><c></c></span> +<span><c></c></span> +</div> +</div> +</body> +</html> diff --git a/layout/generic/crashtests/1381134.html b/layout/generic/crashtests/1381134.html new file mode 100644 index 000000000..a45fa04ec --- /dev/null +++ b/layout/generic/crashtests/1381134.html @@ -0,0 +1,45 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +addEventListener("DOMContentLoaded", () => { + [d1, d2] = document.getElementsByTagName("div"); + [s1, s2] = document.getElementsByTagName("span") + d3 = document.createElement("div") + d4 = document.createElement("div") + d4.setAttribute("class", "grid") + d3.appendChild(d4) + d1.appendChild(document.createElement("span")) + setTimeout(() => { + d2.removeChild(s2) + setTimeout(() => { + d2.insertBefore(d3, s1) + }, 100) + }, 100) +}) +</script> +<style> +.columns { + columns: 3; +} +.grid { + display: grid; + border:5px solid; + counter-reset: item; +} +span { display:contents; } +span::before { content: counter(item) ":before"; } +span::after { content: counter(item) ":after"; } +</style> +</head> +<body> +<div class=columns> +<div class=grid> +<c></c> +<span><c></c></span> +<span><c></c></span> +</div> +</div> +</body> +</html> diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list index a3c0d62c6..1a597e51c 100644 --- a/layout/generic/crashtests/crashtests.list +++ b/layout/generic/crashtests/crashtests.list @@ -642,3 +642,5 @@ load 1278461-1.html load 1278461-2.html load 1304441.html load 1316649.html +load 1381134.html +load 1381134-2.html diff --git a/layout/reftests/css-grid/reftest.list b/layout/reftests/css-grid/reftest.list index 7c5e6be51..52073b9bf 100644 --- a/layout/reftests/css-grid/reftest.list +++ b/layout/reftests/css-grid/reftest.list @@ -251,7 +251,7 @@ asserts(0-10) == grid-fragmentation-015.html grid-fragmentation-015-ref.html # b != grid-fragmentation-dyn1-021.html grid-fragmentation-021-ref.html # bug 1251799 == grid-fragmentation-dyn2-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn3-021.html grid-fragmentation-021-ref.html -asserts(1-10) == grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html # assertion related to bug 1251799 ? +== grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn5-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn2-022.html grid-fragmentation-007-ref.html == grid-fragmentation-dyn1-023.html grid-fragmentation-023-ref.html |