Bug 1410226: Properly compute the insertion point for a display: contents child in an XBL binding. r=mats
authorEmilio Cobos Álvarez <emilio@crisal.io>
Fri, 20 Oct 2017 13:42:15 +0200
changeset 387500 cc74db25e470a24480dba59c56e74049c3aa774a
parent 387499 f33ef94ef46cf5294152b98a00220568fa6ed4bc
child 387501 b15691743aba624c320246fb696b980abc360b0e
push id32723
push userarchaeopteryx@coole-files.de
push dateSun, 22 Oct 2017 09:33:30 +0000
treeherdermozilla-central@250cd4e41592 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmats
bugs1410226
milestone58.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1410226: Properly compute the insertion point for a display: contents child in an XBL binding. r=mats MozReview-Commit-ID: DzuGDHZEc1A
layout/base/nsCSSFrameConstructor.cpp
layout/style/crashtests/1410226-1.html
layout/style/crashtests/1410226-2.html
layout/style/crashtests/crashtests.list
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7106,37 +7106,33 @@ nsCSSFrameConstructor::GetInsertionPrevS
 
   *aIsRangeInsertSafe = (childDisplay == UNSET_DISPLAY);
   return prevSibling;
 }
 
 nsContainerFrame*
 nsCSSFrameConstructor::GetContentInsertionFrameFor(nsIContent* aContent)
 {
-  // Get the primary frame associated with the content
-  nsIFrame* frame = aContent->GetPrimaryFrame();
-
-  if (!frame) {
-    if (GetDisplayContentsStyleFor(aContent)) {
-      nsIContent* parent = aContent->GetParent();
-      if (parent && parent == aContent->GetContainingShadow()) {
-        parent = parent->GetBindingParent();
-      }
-      frame = parent ? GetContentInsertionFrameFor(parent) : nullptr;
-    }
-    if (!frame) {
+  nsIFrame* frame;
+  while (!(frame = aContent->GetPrimaryFrame())) {
+    if (!GetDisplayContentsStyleFor(aContent)) {
+      return nullptr;
+    }
+
+    aContent = aContent->GetFlattenedTreeParent();
+    if (!aContent) {
       return nullptr;
     }
-  } else {
-    // If the content of the frame is not the desired content then this is not
-    // really a frame for the desired content.
-    // XXX This check is needed due to bug 135040. Remove it once that's fixed.
-    if (frame->GetContent() != aContent) {
-      return nullptr;
-    }
+  }
+
+  // If the content of the frame is not the desired content then this is not
+  // really a frame for the desired content.
+  // XXX This check is needed due to bug 135040. Remove it once that's fixed.
+  if (frame->GetContent() != aContent) {
+    return nullptr;
   }
 
   nsContainerFrame* insertionFrame = frame->GetContentInsertionFrame();
 
   NS_ASSERTION(!insertionFrame || insertionFrame == frame || !frame->IsLeaf(),
     "The insertion frame is the primary frame or the primary frame isn't a leaf");
 
   return insertionFrame;
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1410226-1.html
@@ -0,0 +1,8 @@
+<style>
+ * { display: contents; }
+</style>
+<details>
+</details>
+<marquee>
+<ul>
+<canvas>
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1410226-2.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<style>
+ * { display: contents; }
+</style>
+<marquee>
+<div id="target">
+</div>
+</marquee>
+<script>
+document.body.offsetTop;
+let div = document.createElement('div');
+div.style.display = "block";
+div.appendChild(document.createTextNode('where am I'));
+target.appendChild(div);
+document.body.style.color = "red";
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -248,8 +248,10 @@ load 1404316.html
 load 1406222-1.html
 load 1406222-2.html
 load 1404324-1.html
 load 1404324-2.html
 load 1404324-3.html
 load 1404057.html
 load 1409502.html
 load 1409931.html
+load 1410226-1.html
+load 1410226-2.html