wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 15:28:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Bug 1381134 - Ensure we're using the correct frame for the :after/:before references

Browse source 
Tag #1375
This commit is contained in:
Matt A. Tobin 2020-04-17 06:38:06 -04:00 • committed by Roy Tam
commit d3c2a6b6b5
5 changed files with 97 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
layout/base/nsCSSFrameConstructor.cpp
View file

@ -6076,12 +6076,10 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
static void
AddGenConPseudoToFrame(nsIFrame* aOwnerFrame, nsIContent* aContent)
{
NS_ASSERTION(nsLayoutUtils::IsFirstContinuationOrIBSplitSibling(aOwnerFrame),
"property should only be set on first continuation/ib-sibling");
// FIXME(emilio): Remove this property, and use the frame of the generated
// content itself to tear the content down? It should be quite simpler.
aOwnerFrame = nsLayoutUtils::FirstContinuationOrIBSplitSibling(aOwnerFrame);
nsIFrame::ContentArray* value =
aOwnerFrame->GetProperty(nsIFrame::GenConProperty());
if (!value) {
@ -6343,7 +6341,9 @@ AdjustAppendParentForAfterContent(nsFrameManager* aFrameManager,
// frames to find the first one that is either a ::after frame for an
// ancestor of aChild or a frame that is for a node later in the
// document than aChild and return that in aAfterFrame.
if (aParentFrame->GetProperty(nsIFrame::GenConProperty()) ||
nsIFrame* afterBeforeOwnerFrame =
nsLayoutUtils::FirstContinuationOrIBSplitSibling(aParentFrame);
if (afterBeforeOwnerFrame->GetProperty(nsIFrame::GenConProperty()) ||
nsLayoutUtils::HasPseudoStyle(aContainer, aParentFrame->StyleContext(),
CSSPseudoElementType::after,
aParentFrame->PresContext()) ||

45
layout/generic/crashtests/1381134-2.html Normal file
View file

@ -0,0 +1,45 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script>
addEventListener("DOMContentLoaded", () => {
[d1, d2] = document.getElementsByTagName("div");
[s1, s2] = document.getElementsByTagName("span")
d3 = document.createElement("div")
d4 = document.createElement("div")
d4.setAttribute("class", "grid")
d3.appendChild(d4)
d1.appendChild(document.createElement("span"))
setTimeout(() => {
d2.removeChild(s2)
setTimeout(() => {
d2.insertBefore(d3, s1)
}, 100)
}, 100)
})
</script>
<style>
.columns {
columns: 3;
}
.grid {
border:5px solid;
counter-reset: item;
}
.grid * { display:block; }
span { display:contents; }
span::before { content: counter(item) ":before"; }
span::after { content: counter(item) ":after"; }
</style>
</head>
<body>
<div class=columns>
<div class=grid>
<c></c>
<span><c></c></span>
<span><c></c></span>
</div>
</div>
</body>
</html>

45
layout/generic/crashtests/1381134.html Normal file
View file

@ -0,0 +1,45 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script>
addEventListener("DOMContentLoaded", () => {
[d1, d2] = document.getElementsByTagName("div");
[s1, s2] = document.getElementsByTagName("span")
d3 = document.createElement("div")
d4 = document.createElement("div")
d4.setAttribute("class", "grid")
d3.appendChild(d4)
d1.appendChild(document.createElement("span"))
setTimeout(() => {
d2.removeChild(s2)
setTimeout(() => {
d2.insertBefore(d3, s1)
}, 100)
}, 100)
})
</script>
<style>
.columns {
columns: 3;
}
.grid {
display: grid;
border:5px solid;
counter-reset: item;
}
span { display:contents; }
span::before { content: counter(item) ":before"; }
span::after { content: counter(item) ":after"; }
</style>
</head>
<body>
<div class=columns>
<div class=grid>
<c></c>
<span><c></c></span>
<span><c></c></span>
</div>
</div>
</body>
</html>

2
layout/generic/crashtests/crashtests.list
View file

@ -642,3 +642,5 @@ load 1278461-1.html
load 1278461-2.html
load 1304441.html
load 1316649.html
load 1381134.html
load 1381134-2.html

2
layout/reftests/css-grid/reftest.list
View file

@ -251,7 +251,7 @@ asserts(0-10) == grid-fragmentation-015.html grid-fragmentation-015-ref.html # b
!= grid-fragmentation-dyn1-021.html grid-fragmentation-021-ref.html # bug 1251799
== grid-fragmentation-dyn2-021.html grid-fragmentation-021-ref.html
== grid-fragmentation-dyn3-021.html grid-fragmentation-021-ref.html
asserts(1-10) == grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html # assertion related to bug 1251799 ?
== grid-fragmentation-dyn4-021.html grid-fragmentation-021-ref.html
== grid-fragmentation-dyn5-021.html grid-fragmentation-021-ref.html
== grid-fragmentation-dyn2-022.html grid-fragmentation-007-ref.html
== grid-fragmentation-dyn1-023.html grid-fragmentation-023-ref.html