From 55d83ea6f9aa9d99963a4d1fb1f96a3b633ede49 Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Fri, 17 Apr 2020 06:38:06 -0400 Subject: Bug 1381134 - Ensure we're using the correct frame for the :after/:before references Tag #1375 --- layout/base/nsCSSFrameConstructor.cpp | 8 +++--- layout/generic/crashtests/1381134-2.html | 45 +++++++++++++++++++++++++++++++ layout/generic/crashtests/1381134.html | 45 +++++++++++++++++++++++++++++++ layout/generic/crashtests/crashtests.list | 2 ++ layout/reftests/css-grid/reftest.list | 2 +- 5 files changed, 97 insertions(+), 5 deletions(-) create mode 100644 layout/generic/crashtests/1381134-2.html create mode 100644 layout/generic/crashtests/1381134.html (limited to 'layout') diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp index 1341f9633..85f53a820 100644 --- a/layout/base/nsCSSFrameConstructor.cpp +++ b/layout/base/nsCSSFrameConstructor.cpp @@ -6076,12 +6076,10 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState static void AddGenConPseudoToFrame(nsIFrame* aOwnerFrame, nsIContent* aContent) { - NS_ASSERTION(nsLayoutUtils::IsFirstContinuationOrIBSplitSibling(aOwnerFrame), - "property should only be set on first continuation/ib-sibling"); - // FIXME(emilio): Remove this property, and use the frame of the generated // content itself to tear the content down? It should be quite simpler. + aOwnerFrame = nsLayoutUtils::FirstContinuationOrIBSplitSibling(aOwnerFrame); nsIFrame::ContentArray* value = aOwnerFrame->GetProperty(nsIFrame::GenConProperty()); if (!value) { @@ -6343,7 +6341,9 @@ AdjustAppendParentForAfterContent(nsFrameManager* aFrameManager, // frames to find the first one that is either a ::after frame for an // ancestor of aChild or a frame that is for a node later in the // document than aChild and return that in aAfterFrame. - if (aParentFrame->GetProperty(nsIFrame::GenConProperty()) || + nsIFrame* afterBeforeOwnerFrame = + nsLayoutUtils::FirstContinuationOrIBSplitSibling(aParentFrame); + if (afterBeforeOwnerFrame->GetProperty(nsIFrame::GenConProperty()) || nsLayoutUtils::HasPseudoStyle(aContainer, aParentFrame->StyleContext(), CSSPseudoElementType::after, aParentFrame->PresContext()) || diff --git a/layout/generic/crashtests/1381134-2.html b/layout/generic/crashtests/1381134-2.html new file mode 100644 index 000000000..d3ac73507 --- /dev/null +++ b/layout/generic/crashtests/1381134-2.html @@ -0,0 +1,45 @@ + + + + + + + + +

+ + + +

+ + diff --git a/layout/generic/crashtests/1381134.html b/layout/generic/crashtests/1381134.html new file mode 100644 index 000000000..a45fa04ec --- /dev/null +++ b/layout/generic/crashtests/1381134.html @@ -0,0 +1,45 @@ + + + + + + + + +

+ + + +

+ + diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list index a3c0d62c6..1a597e51c 100644 --- a/layout/generic/crashtests/crashtests.list +++ b/layout/generic/crashtests/crashtests.list @@ -642,3 +642,5 @@ load 1278461-1.html load 1278461-2.html load 1304441.html load 1316649.html +load 1381134.html +load 1381134-2.html diff --git a/layout/reftests/css-grid/reftest.list b/layout/reftests/css-grid/reftest.list index 7c5e6be51..52073b9bf 100644 --- a/layout/reftests/css-grid/reftest.list +++ b/layout/reftests/css-grid/reftest.list @@ -251,7 +251,7 @@ asserts(0-10) == grid-fragmentation-015.html grid-fragmentation-015-ref.html # b != grid-fragmentation-dyn1-021.html grid-fragmentation-021-ref.html # bug 1251799 == grid-fragmentation-dyn2-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn3-021.html grid-fragmentation-021-ref.html -asserts(1-10) == grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html # assertion related to bug 1251799 ? +== grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn5-021.html grid-fragmentation-021-ref.html == grid-fragmentation-dyn2-022.html grid-fragmentation-007-ref.html == grid-fragmentation-dyn1-023.html grid-fragmentation-023-ref.html -- cgit v1.2.3