Backed out 2 changesets (bug 1473813, bug 1472403) for bustages in /builds/worker/workspace/build/src/dom/base/MessageSender.cpp:24:19 on a CLOSED TREE
authorshindli <shindli@mozilla.com>
Mon, 16 Jul 2018 18:45:33 +0300
changeset 818904 63239b786a26cfd8778106916eb21ddf4fa67bed
parent 818903 c2b1f1b52866d2c58f5e23fe2df97c9127ebcacf
child 818905 267ff4f4ca9ba42740c1f36007738ef181f933d0
push id116388
push userrwood@mozilla.com
push dateMon, 16 Jul 2018 19:48:57 +0000
bugs1473813, 1472403
milestone63.0a1
backs out93e4dff7e34689b0aeb6882aa5233214e93f40b3
365a0841117ae364c69dc777deddce8b0aaf3999
Backed out 2 changesets (bug 1473813, bug 1472403) for bustages in /builds/worker/workspace/build/src/dom/base/MessageSender.cpp:24:19 on a CLOSED TREE Backed out changeset 93e4dff7e346 (bug 1473813) Backed out changeset 365a0841117a (bug 1472403)
dom/base/GeneratedImageContent.cpp
dom/base/GeneratedImageContent.h
dom/base/moz.build
dom/base/nsContentCreatorFunctions.h
dom/base/nsGenConImageContent.cpp
dom/base/nsImageLoadingContent.cpp
dom/base/nsImageLoadingContent.h
layout/base/nsCSSFrameConstructor.cpp
layout/base/nsCSSFrameConstructor.h
layout/generic/crashtests/1472403.html
layout/generic/crashtests/crashtests.list
layout/generic/nsImageFrame.cpp
layout/generic/nsImageFrame.h
layout/reftests/pagination/content-url-pseudo-ref.html
layout/reftests/pagination/reftest.list
testing/web-platform/meta/MANIFEST.json
testing/web-platform/tests/css/css-content/pseudo-element-inline-box-ref.html
testing/web-platform/tests/css/css-content/pseudo-element-inline-box.html
deleted file mode 100644
--- a/dom/base/GeneratedImageContent.cpp
+++ /dev/null
@@ -1,52 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/dom/GeneratedImageContent.h"
-
-#include "nsContentCreatorFunctions.h"
-#include "nsGkAtoms.h"
-#include "nsIDocument.h"
-#include "nsNodeInfoManager.h"
-#include "mozilla/dom/HTMLElementBinding.h"
-#include "mozilla/dom/NameSpaceConstants.h"
-
-namespace mozilla {
-namespace dom {
-
-NS_IMPL_ELEMENT_CLONE(GeneratedImageContent);
-
-already_AddRefed<GeneratedImageContent>
-GeneratedImageContent::Create(nsIDocument& aDocument, uint32_t aContentIndex)
-{
-  RefPtr<dom::NodeInfo> nodeInfo =
-    aDocument.NodeInfoManager()->
-      GetNodeInfo(nsGkAtoms::mozgeneratedcontentimage,
-                  nullptr,
-                  kNameSpaceID_XHTML,
-                  nsINode::ELEMENT_NODE);
-
-  // Work around not being able to bind a non-const lvalue reference
-  // to an rvalue of non-reference type by just creating an rvalue
-  // reference.  And we can't change the constructor signature,
-  // because then the macro-generated Clone() method fails to compile.
-  already_AddRefed<dom::NodeInfo>&& rvalue = nodeInfo.forget();
-
-  auto image =
-    MakeRefPtr<GeneratedImageContent>(rvalue);
-  image->mIndex = aContentIndex;
-  return image.forget();
-}
-
-JSObject*
-GeneratedImageContent::WrapNode(JSContext* aCx,
-                                JS::Handle<JSObject*> aGivenProto)
-{
-  return dom::HTMLElement_Binding::Wrap(aCx, this, aGivenProto);
-}
-
-} // namespace dom
-} // namespace mozilla
-
deleted file mode 100644
--- a/dom/base/GeneratedImageContent.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef dom_base_GeneratedImageContent_h
-#define dom_base_GeneratedImageContent_h
-
-/* A content node that keeps track of an index in the parent's `content`
- * property value, used for url() values in the content of a ::before or ::after
- * pseudo-element. */
-
-#include "mozilla/dom/HTMLElementBinding.h"
-#include "mozilla/dom/NameSpaceConstants.h"
-#include "mozilla/dom/NodeInfo.h"
-#include "nsGenericHTMLElement.h"
-
-namespace mozilla {
-namespace dom {
-
-class GeneratedImageContent final
-  : public nsGenericHTMLElement
-{
-public:
-  static already_AddRefed<GeneratedImageContent>
-    Create(nsIDocument&, uint32_t aContentIndex);
-
-  explicit GeneratedImageContent(already_AddRefed<dom::NodeInfo>& aNodeInfo)
-    : nsGenericHTMLElement(aNodeInfo)
-  {
-    MOZ_ASSERT(IsInNamespace(kNameSpaceID_XHTML), "Someone messed up our nodeinfo");
-  }
-
-  nsresult Clone(dom::NodeInfo* aNodeInfo,
-                 nsINode** aResult,
-                 bool aPreallocateChildren) const final;
-
-  nsresult CopyInnerTo(GeneratedImageContent* aDest, bool aPreallocateChildren)
-  {
-    nsresult rv =
-      nsGenericHTMLElement::CopyInnerTo(aDest, aPreallocateChildren);
-    NS_ENSURE_SUCCESS(rv, rv);
-    aDest->mIndex = mIndex;
-    return NS_OK;
-  }
-
-  uint32_t Index() const
-  {
-    return mIndex;
-  }
-
-protected:
-  JSObject* WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) final;
-
-private:
-  virtual ~GeneratedImageContent() = default;
-  uint32_t mIndex = 0;
-};
-
-} // namespace dom
-} // namespace mozilla
-
-#endif // dom_base_GeneratedImageContent_h
--- a/dom/base/moz.build
+++ b/dom/base/moz.build
@@ -174,17 +174,16 @@ EXPORTS.mozilla.dom += [
     'DOMStringList.h',
     'DOMTokenListSupportedTokens.h',
     'Element.h',
     'ElementInlines.h',
     'EventSource.h',
     'FormData.h',
     'FragmentOrElement.h',
     'FromParser.h',
-    'GeneratedImageContent.h',
     'IdleDeadline.h',
     'IdleRequest.h',
     'IDTracker.h',
     'ImageEncoder.h',
     'ImageTracker.h',
     'IntlUtils.h',
     'Link.h',
     'Location.h',
@@ -265,17 +264,16 @@ UNIFIED_SOURCES += [
     'DOMQuad.cpp',
     'DOMRect.cpp',
     'DOMRequest.cpp',
     'DOMStringList.cpp',
     'Element.cpp',
     'EventSource.cpp',
     'FormData.cpp',
     'FragmentOrElement.cpp',
-    'GeneratedImageContent.cpp',
     'IdleDeadline.cpp',
     'IdleRequest.cpp',
     'IDTracker.cpp',
     'ImageEncoder.cpp',
     'ImageTracker.cpp',
     'IntlUtils.cpp',
     'Link.cpp',
     'Location.cpp',
@@ -305,16 +303,17 @@ UNIFIED_SOURCES += [
     'nsDOMCaretPosition.cpp',
     'nsDOMMutationObserver.cpp',
     'nsDOMNavigationTiming.cpp',
     'nsDOMSerializer.cpp',
     'nsDOMTokenList.cpp',
     'nsDOMWindowList.cpp',
     'nsFocusManager.cpp',
     'nsFrameLoader.cpp',
+    'nsGenConImageContent.cpp',
     'nsGlobalWindowCommands.cpp',
     'nsHistory.cpp',
     'nsHTMLContentSerializer.cpp',
     'nsIGlobalObject.cpp',
     'nsINode.cpp',
     'nsInProcessTabChildGlobal.cpp',
     'nsJSEnvironment.cpp',
     'nsJSTimeoutHandler.cpp',
--- a/dom/base/nsContentCreatorFunctions.h
+++ b/dom/base/nsContentCreatorFunctions.h
@@ -71,9 +71,16 @@ NS_TrustedNewXULElement(mozilla::dom::El
                         already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 #endif
 
 nsresult
 NS_NewSVGElement(mozilla::dom::Element** aResult,
                  already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
                  mozilla::dom::FromParser aFromParser);
 
+namespace mozilla {
+namespace dom {
+already_AddRefed<nsIContent>
+CreateGenConImageContent(nsIDocument* aDocument, imgRequestProxy* aImageRequest);
+} // namespace dom
+} // namespace mozilla
+
 #endif // nsContentCreatorFunctions_h__
new file mode 100644
--- /dev/null
+++ b/dom/base/nsGenConImageContent.cpp
@@ -0,0 +1,166 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * A fake content node class so that the image frame for
+ *   content: url(foo);
+ * in CSS can have an nsIImageLoadingContent but use an
+ * imgIRequest that's already been loaded from the style system.
+ */
+
+#include "nsContentCreatorFunctions.h"
+#include "nsGenericHTMLElement.h"
+#include "nsGkAtoms.h"
+#include "nsIDocument.h"
+#include "nsImageLoadingContent.h"
+#include "imgIRequest.h"
+#include "nsNodeInfoManager.h"
+#include "mozilla/BasicEvents.h"
+#include "mozilla/EventDispatcher.h"
+#include "mozilla/EventStates.h"
+#include "mozilla/dom/HTMLElementBinding.h"
+#include "mozilla/dom/NameSpaceConstants.h"
+
+using namespace mozilla;
+
+class nsGenConImageContent final : public nsGenericHTMLElement,
+                                   public nsImageLoadingContent
+{
+public:
+  explicit nsGenConImageContent(already_AddRefed<dom::NodeInfo>& aNodeInfo)
+    : nsGenericHTMLElement(aNodeInfo)
+  {
+    // nsImageLoadingContent starts out broken, so we start out
+    // suppressed to match it.
+    AddStatesSilently(NS_EVENT_STATE_SUPPRESSED);
+    MOZ_ASSERT(IsInNamespace(kNameSpaceID_XHTML), "Someone messed up our nodeinfo");
+  }
+
+  nsresult Init(imgRequestProxy* aImageRequest)
+  {
+    // No need to notify, since we have no frame.
+    return UseAsPrimaryRequest(aImageRequest, false, eImageLoadType_Normal);
+  }
+
+  // nsIContent overrides
+  virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
+                              nsIContent* aBindingParent,
+                              bool aCompileEventHandlers) override;
+  virtual void UnbindFromTree(bool aDeep, bool aNullParent) override;
+  virtual EventStates IntrinsicState() const override;
+
+  void GetEventTargetParent(EventChainPreVisitor& aVisitor) override
+  {
+    MOZ_ASSERT(IsInNativeAnonymousSubtree());
+    if (aVisitor.mEvent->mMessage == eLoad ||
+        aVisitor.mEvent->mMessage == eLoadError) {
+      // Don't propagate the events to the parent.
+      return;
+    }
+    nsGenericHTMLElement::GetEventTargetParent(aVisitor);
+  }
+
+protected:
+  nsIContent* AsContent() override { return this; }
+
+  virtual JSObject* WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto) override;
+  virtual nsresult Clone(dom::NodeInfo* aNodeInfo,
+                         nsINode** aResult,
+                         bool aPreallocateChildren) const override;
+
+private:
+  virtual ~nsGenConImageContent();
+
+public:
+  NS_DECL_ISUPPORTS_INHERITED
+};
+
+NS_IMPL_ISUPPORTS_INHERITED(nsGenConImageContent,
+                            nsGenericHTMLElement,
+                            nsIImageLoadingContent,
+                            imgINotificationObserver)
+
+NS_IMPL_ELEMENT_CLONE(nsGenConImageContent)
+
+namespace mozilla {
+namespace dom {
+
+already_AddRefed<nsIContent>
+CreateGenConImageContent(nsIDocument* aDocument, imgRequestProxy* aImageRequest)
+{
+  MOZ_ASSERT(aImageRequest, "Must have request!");
+  RefPtr<NodeInfo> nodeInfo =
+    aDocument->NodeInfoManager()->
+      GetNodeInfo(nsGkAtoms::mozgeneratedcontentimage,
+                  nullptr,
+                  kNameSpaceID_XHTML,
+                  nsINode::ELEMENT_NODE);
+  // Work around not being able to bind a non-const lvalue reference
+  // to an rvalue of non-reference type by just creating an rvalue
+  // reference.  And we can't change the constructor signature,
+  // because then the macro-generated Clone() method fails to compile.
+  already_AddRefed<NodeInfo>&& rvalue = nodeInfo.forget();
+  RefPtr<nsGenConImageContent> it = new nsGenConImageContent(rvalue);
+  nsresult rv = it->Init(aImageRequest);
+  if (NS_FAILED(rv)) {
+    return nullptr;
+  }
+
+  return it.forget();
+}
+
+} // namespace dom
+} // namespace mozilla
+
+nsGenConImageContent::~nsGenConImageContent()
+{
+  DestroyImageLoadingContent();
+}
+
+nsresult
+nsGenConImageContent::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
+                                 nsIContent* aBindingParent,
+                                 bool aCompileEventHandlers)
+{
+  nsresult rv;
+  rv = nsGenericHTMLElement::BindToTree(aDocument, aParent, aBindingParent,
+                                aCompileEventHandlers);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsImageLoadingContent::BindToTree(aDocument, aParent, aBindingParent,
+                                    aCompileEventHandlers);
+  return NS_OK;
+}
+
+void
+nsGenConImageContent::UnbindFromTree(bool aDeep, bool aNullParent)
+{
+  nsImageLoadingContent::UnbindFromTree(aDeep, aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
+}
+
+EventStates
+nsGenConImageContent::IntrinsicState() const
+{
+  EventStates state = nsGenericHTMLElement::IntrinsicState();
+
+  EventStates imageState = nsImageLoadingContent::ImageState();
+  if (imageState.HasAtLeastOneOfStates(NS_EVENT_STATE_BROKEN | NS_EVENT_STATE_USERDISABLED)) {
+    // We should never be in an error state; if the image fails to load, we
+    // just go to the suppressed state.
+    imageState |= NS_EVENT_STATE_SUPPRESSED;
+    imageState &= ~NS_EVENT_STATE_BROKEN;
+  }
+  imageState &= ~NS_EVENT_STATE_LOADING;
+  return state | imageState;
+}
+
+JSObject*
+nsGenConImageContent::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
+{
+  return dom::HTMLElement_Binding::Wrap(aCx, this, aGivenProto);
+}
+
--- a/dom/base/nsImageLoadingContent.cpp
+++ b/dom/base/nsImageLoadingContent.cpp
@@ -1160,16 +1160,42 @@ nsImageLoadingContent::UpdateImageState(
 void
 nsImageLoadingContent::CancelImageRequests(bool aNotify)
 {
   AutoStateChanger changer(this, aNotify);
   ClearPendingRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DISCARD_IMAGES));
   ClearCurrentRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DISCARD_IMAGES));
 }
 
+nsresult
+nsImageLoadingContent::UseAsPrimaryRequest(imgRequestProxy* aRequest,
+                                           bool aNotify,
+                                           ImageLoadType aImageLoadType)
+{
+  // Our state will change. Watch it.
+  AutoStateChanger changer(this, aNotify);
+
+  // Get rid if our existing images
+  ClearPendingRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DISCARD_IMAGES));
+  ClearCurrentRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DISCARD_IMAGES));
+
+  // Clone the request we were given.
+  RefPtr<imgRequestProxy>& req = PrepareNextRequest(aImageLoadType);
+  nsresult rv = aRequest->SyncClone(this, GetOurOwnerDoc(), getter_AddRefs(req));
+  if (NS_SUCCEEDED(rv)) {
+    CloneScriptedRequests(req);
+    TrackImage(req);
+  } else {
+    MOZ_ASSERT(!req, "Shouldn't have non-null request here");
+    return rv;
+  }
+
+  return NS_OK;
+}
+
 nsIDocument*
 nsImageLoadingContent::GetOurOwnerDoc()
 {
   return AsContent()->OwnerDoc();
 }
 
 nsIDocument*
 nsImageLoadingContent::GetOurCurrentDoc()
--- a/dom/base/nsImageLoadingContent.h
+++ b/dom/base/nsImageLoadingContent.h
@@ -186,16 +186,25 @@ protected:
   /**
    * CancelImageRequests is called by subclasses when they want to
    * cancel all image requests (for example when the subclass is
    * somehow not an image anymore).
    */
   void CancelImageRequests(bool aNotify);
 
   /**
+   * UseAsPrimaryRequest is called by subclasses when they have an existing
+   * imgRequestProxy that they want this nsImageLoadingContent to use.  This may
+   * effectively be called instead of LoadImage or LoadImageWithChannel.
+   * If aNotify is true, this method will notify on state changes.
+   */
+  nsresult UseAsPrimaryRequest(imgRequestProxy* aRequest, bool aNotify,
+                               ImageLoadType aImageLoadType);
+
+  /**
    * Derived classes of nsImageLoadingContent MUST call
    * DestroyImageLoadingContent from their destructor, or earlier.  It
    * does things that cannot be done in ~nsImageLoadingContent because
    * they rely on being able to QueryInterface to other derived classes,
    * which cannot happen once the derived class destructor has started
    * calling the base class destructors.
    */
   void DestroyImageLoadingContent();
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -10,17 +10,16 @@
  */
 
 #include "nsCSSFrameConstructor.h"
 
 #include "mozilla/AutoRestore.h"
 #include "mozilla/ComputedStyleInlines.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/ErrorResult.h"
-#include "mozilla/dom/GeneratedImageContent.h"
 #include "mozilla/dom/HTMLDetailsElement.h"
 #include "mozilla/dom/HTMLSelectElement.h"
 #include "mozilla/dom/HTMLSummaryElement.h"
 #include "mozilla/EventStates.h"
 #include "mozilla/Likely.h"
 #include "mozilla/LinkedList.h"
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/PresShell.h"
@@ -319,19 +318,16 @@ nsIFrame*
 NS_NewScrollbarFrame (nsIPresShell* aPresShell, ComputedStyle* aStyle);
 
 nsIFrame*
 NS_NewScrollbarButtonFrame (nsIPresShell* aPresShell, ComputedStyle* aStyle);
 
 nsIFrame*
 NS_NewImageFrameForContentProperty(nsIPresShell*, ComputedStyle*);
 
-nsIFrame*
-NS_NewImageFrameForGeneratedContentIndex(nsIPresShell*, ComputedStyle*);
-
 
 #ifdef NOISY_FINDFRAME
 static int32_t FFWC_totalCount=0;
 static int32_t FFWC_doLoop=0;
 static int32_t FFWC_doSibling=0;
 static int32_t FFWC_recursions=0;
 static int32_t FFWC_nextInFlows=0;
 #endif
@@ -1586,31 +1582,16 @@ MoveChildrenTo(nsIFrame* aOldParent,
   if (aNewParent->PrincipalChildList().IsEmpty() &&
       (aNewParent->GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
     aNewParent->SetInitialChildList(kPrincipalList, aFrameList);
   } else {
     aNewParent->AppendFrames(kPrincipalList, aFrameList);
   }
 }
 
-static bool
-ShouldCreateImageFrameForContent(const Element& aElement, ComputedStyle& aStyle)
-{
-  if (aElement.IsRootOfNativeAnonymousSubtree()) {
-    return false;
-  }
-
-  auto& content = *aStyle.StyleContent();
-  if (content.ContentCount() != 1) {
-    return false;
-  }
-
-  return content.ContentAt(0).GetType() == StyleContentType::Image;
-}
-
 //----------------------------------------------------------------------
 
 nsCSSFrameConstructor::nsCSSFrameConstructor(nsIDocument* aDocument,
                                              nsIPresShell* aPresShell)
   : nsFrameManager(aPresShell)
   , mDocument(aDocument)
   , mRootElementFrame(nullptr)
   , mRootElementStyleFrame(nullptr)
@@ -1723,26 +1704,37 @@ nsCSSFrameConstructor::CreateGenConTextN
   }
   return content.forget();
 }
 
 already_AddRefed<nsIContent>
 nsCSSFrameConstructor::CreateGeneratedContent(nsFrameConstructorState& aState,
                                               Element* aParentContent,
                                               ComputedStyle* aComputedStyle,
-                                              uint32_t aContentIndex)
+                                              uint32_t        aContentIndex)
 {
   // Get the content value
   const nsStyleContentData& data =
     aComputedStyle->StyleContent()->ContentAt(aContentIndex);
   const StyleContentType type = data.GetType();
 
   switch (type) {
-    case StyleContentType::Image:
-      return GeneratedImageContent::Create(*mDocument, aContentIndex);
+    case StyleContentType::Image: {
+      imgRequestProxy* image = data.GetImage();
+      if (!image) {
+        // CSS had something specified that couldn't be converted to an
+        // image object
+        return nullptr;
+      }
+
+      // Create an image content object and pass it the image request.
+      // XXX Check if it's an image type we can handle...
+
+      return CreateGenConImageContent(mDocument, image);
+    }
 
     case StyleContentType::String:
       return CreateGenConTextNode(aState,
                                   nsDependentString(data.GetString()),
                                   nullptr, nullptr);
 
     case StyleContentType::Attr: {
       const nsStyleContentAttr* attr = data.GetAttr();
@@ -3621,17 +3613,17 @@ nsCSSFrameConstructor::FindHTMLData(Elem
     // positioned legends we want to construct by display type and
     // not do special legend stuff.
     return nullptr;
   }
 
   static const FrameConstructionDataByTag sHTMLData[] = {
     SIMPLE_TAG_CHAIN(img, nsCSSFrameConstructor::FindImgData),
     SIMPLE_TAG_CHAIN(mozgeneratedcontentimage,
-                     nsCSSFrameConstructor::FindGeneratedImageData),
+                     nsCSSFrameConstructor::FindImgData),
     { &nsGkAtoms::br,
       FCDATA_DECL(FCDATA_IS_LINE_PARTICIPANT | FCDATA_IS_LINE_BREAK,
                   NS_NewBRFrame) },
     SIMPLE_TAG_CREATE(wbr, NS_NewWBRFrame),
     SIMPLE_TAG_CHAIN(input, nsCSSFrameConstructor::FindInputData),
     SIMPLE_TAG_CREATE(textarea, NS_NewTextControlFrame),
     COMPLEX_TAG_CREATE(select, &nsCSSFrameConstructor::ConstructSelectFrame),
     SIMPLE_TAG_CHAIN(object, nsCSSFrameConstructor::FindObjectData),
@@ -3657,30 +3649,16 @@ nsCSSFrameConstructor::FindHTMLData(Elem
   };
 
   return FindDataByTag(aTag, aElement, aComputedStyle, sHTMLData,
                        ArrayLength(sHTMLData));
 }
 
 /* static */
 const nsCSSFrameConstructor::FrameConstructionData*
-nsCSSFrameConstructor::FindGeneratedImageData(Element* aElement,
-                                              ComputedStyle* aStyle)
-{
-  if (!aElement->IsInNativeAnonymousSubtree()) {
-    return nullptr;
-  }
-
-  static const FrameConstructionData sImgData =
-    SIMPLE_FCDATA(NS_NewImageFrameForGeneratedContentIndex);
-  return &sImgData;
-}
-
-/* static */
-const nsCSSFrameConstructor::FrameConstructionData*
 nsCSSFrameConstructor::FindImgData(Element* aElement,
                                    ComputedStyle* aComputedStyle)
 {
   if (!nsImageFrame::ShouldCreateImageFrameFor(aElement, aComputedStyle)) {
     return nullptr;
   }
 
   static const FrameConstructionData sImgData = SIMPLE_FCDATA(NS_NewImageFrame);
@@ -5646,16 +5624,27 @@ ShouldSuppressFrameInNonOpenDetails(cons
       !aChild->IsGeneratedContentContainerForBefore() &&
       !aChild->IsGeneratedContentContainerForAfter()) {
     return false;
   }
 
   return true;
 }
 
+static bool
+ShouldCreateImageFrameForContent(ComputedStyle& aStyle)
+{
+  auto& content = *aStyle.StyleContent();
+  if (content.ContentCount() != 1) {
+    return false;
+  }
+
+  return content.ContentAt(0).GetType() == StyleContentType::Image;
+}
+
 void
 nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState& aState,
                                                          nsIContent* aContent,
                                                          nsContainerFrame* aParentFrame,
                                                          bool aSuppressWhiteSpaceOptimizations,
                                                          ComputedStyle* aComputedStyle,
                                                          uint32_t aFlags,
                                                          nsTArray<nsIAnonymousContentCreator::ContentInfo>* aAnonChildren,
@@ -5812,17 +5801,17 @@ nsCSSFrameConstructor::AddFrameConstruct
       data = FindSVGData(element, tag, namespaceId, aParentFrame,
                          aFlags & ITEM_IS_WITHIN_SVG_TEXT,
                          aFlags & ITEM_ALLOWS_TEXT_PATH_CHILD,
                          computedStyle);
     }
 
     // Check for 'content: <image-url>' on the element (which makes us ignore
     // 'display' values other than 'none' or 'contents').
-    if (!data && ShouldCreateImageFrameForContent(*element, *computedStyle)) {
+    if (!data && ShouldCreateImageFrameForContent(*computedStyle)) {
       static const FrameConstructionData sImgData =
         SIMPLE_FCDATA(NS_NewImageFrameForContentProperty);
       data = &sImgData;
     }
 
     // Now check for XUL display types
     if (!data) {
       data = FindXULDisplayData(display, element, computedStyle);
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@@ -1451,24 +1451,26 @@ private:
   // aParentFrame might be null.  If it is, that means it was an
   // inline frame.
   static const FrameConstructionData* FindHTMLData(Element* aContent,
                                                    nsAtom* aTag,
                                                    int32_t aNameSpaceID,
                                                    nsIFrame* aParentFrame,
                                                    ComputedStyle* aComputedStyle);
   // HTML data-finding helper functions
-  static const FrameConstructionData* FindImgData(Element*, ComputedStyle*);
-  static const FrameConstructionData* FindGeneratedImageData(Element*,
-                                                             ComputedStyle*);
-  static const FrameConstructionData* FindImgControlData(Element*,
-                                                         ComputedStyle*);
-  static const FrameConstructionData* FindInputData(Element*, ComputedStyle*);
-  static const FrameConstructionData* FindObjectData(Element*, ComputedStyle*);
-  static const FrameConstructionData* FindCanvasData(Element*, ComputedStyle*);
+  static const FrameConstructionData*
+    FindImgData(Element* aElement, ComputedStyle* aComputedStyle);
+  static const FrameConstructionData*
+    FindImgControlData(Element* aElement, ComputedStyle* aComputedStyle);
+  static const FrameConstructionData*
+    FindInputData(Element* aElement, ComputedStyle* aComputedStyle);
+  static const FrameConstructionData*
+    FindObjectData(Element* aElement, ComputedStyle* aComputedStyle);
+  static const FrameConstructionData*
+    FindCanvasData(Element* aElement, ComputedStyle* aComputedStyle);
 
   /* Construct a frame from the given FrameConstructionItem.  This function
      will handle adding the frame to frame lists, processing children, setting
      the frame as the primary frame for the item's content, and so forth.
 
      @param aItem the FrameConstructionItem to use.
      @param aState the frame construction state to use.
      @param aParentFrame the frame to set as the parent of the
deleted file mode 100644
--- a/layout/generic/crashtests/1472403.html
+++ /dev/null
@@ -1,6 +0,0 @@
-<!doctype html>
-<div id="target"></div>
-<script>
-  let element = document.createElement('_moz_generated_content_image');
-  target.appendChild(element);
-</script>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -699,9 +699,8 @@ load 1431781-2.html
 asserts(6) load 1458028.html # bug 847368
 load 1459697.html
 load 1460158-1.html
 load 1460158-2.html
 load 1460158-3.html
 load 1461039.html
 load 1461979-1.html
 load 1467239.html
-load 1472403.html
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -13,17 +13,16 @@
 #include "gfxUtils.h"
 #include "mozilla/ComputedStyle.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Encoding.h"
 #include "mozilla/EventStates.h"
 #include "mozilla/gfx/2D.h"
 #include "mozilla/gfx/Helpers.h"
 #include "mozilla/gfx/PathHelpers.h"
-#include "mozilla/dom/GeneratedImageContent.h"
 #include "mozilla/dom/HTMLImageElement.h"
 #include "mozilla/dom/ResponsiveImageSelector.h"
 #include "mozilla/layers/WebRenderLayerManager.h"
 #include "mozilla/MouseEvents.h"
 #include "mozilla/Unused.h"
 
 #include "nsCOMPtr.h"
 #include "nsFontMetrics.h"
@@ -135,25 +134,17 @@ NS_NewImageFrame(nsIPresShell* aPresShel
   return new (aPresShell) nsImageFrame(aStyle, nsImageFrame::Kind::ImageElement);
 }
 
 nsIFrame*
 NS_NewImageFrameForContentProperty(nsIPresShell* aPresShell,
                                    ComputedStyle* aStyle)
 {
   return new (aPresShell) nsImageFrame(
-    aStyle, nsImageFrame::Kind::ContentProperty);
-}
-
-nsIFrame*
-NS_NewImageFrameForGeneratedContentIndex(nsIPresShell* aPresShell,
-                                         ComputedStyle* aStyle)
-{
-  return new (aPresShell) nsImageFrame(
-    aStyle, nsImageFrame::Kind::ContentPropertyAtIndex);
+    aStyle, nsImageFrame::Kind::NonGeneratedContentProperty);
 }
 
 nsImageFrame*
 nsImageFrame::CreateContinuingFrame(nsIPresShell* aPresShell,
                                     ComputedStyle* aStyle) const
 {
   return new (aPresShell) nsImageFrame(aStyle, mKind);
 }
@@ -320,35 +311,17 @@ nsImageFrame::Init(nsIContent* aContent,
   if (mKind == Kind::ImageElement) {
     nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(aContent);
     MOZ_ASSERT(imageLoader);
     imageLoader->AddNativeObserver(mListener);
     // We have a PresContext now, so we need to notify the image content node
     // that it can register images.
     imageLoader->FrameCreated(this);
   } else {
-    uint32_t contentIndex = 0;
-    const nsStyleContent* styleContent = StyleContent();
-    if (mKind == Kind::ContentPropertyAtIndex) {
-      MOZ_RELEASE_ASSERT(
-        aParent->GetContent()->IsGeneratedContentContainerForAfter() ||
-        aParent->GetContent()->IsGeneratedContentContainerForBefore());
-      MOZ_RELEASE_ASSERT(aContent->IsHTMLElement(nsGkAtoms::mozgeneratedcontentimage));
-      nsIFrame* nonAnonymousParent = aParent;
-      while (nonAnonymousParent->Style()->IsAnonBox()) {
-        nonAnonymousParent = nonAnonymousParent->GetParent();
-      }
-      MOZ_RELEASE_ASSERT(aParent->GetContent() == nonAnonymousParent->GetContent());
-      styleContent = nonAnonymousParent->StyleContent();
-      contentIndex = static_cast<GeneratedImageContent*>(aContent)->Index();
-    }
-    MOZ_RELEASE_ASSERT(contentIndex < styleContent->ContentCount());
-    MOZ_RELEASE_ASSERT(styleContent->ContentAt(contentIndex).GetType() ==
-                       StyleContentType::Image);
-    if (auto* proxy = styleContent->ContentAt(contentIndex).GetImage()) {
+    if (auto* proxy = StyleContent()->ContentAt(0).GetImage()) {
       proxy->Clone(mListener,
                    mContent->OwnerDoc(),
                    getter_AddRefs(mContentURLRequest));
       SetupForContentURLRequest();
     }
   }
 
   // Give image loads associated with an image frame a small priority boost.
@@ -509,17 +482,17 @@ nsImageFrame::GetSourceToDestTransform(n
 }
 
 // This function checks whether the given request is the current request for our
 // mContent.
 bool
 nsImageFrame::IsPendingLoad(imgIRequest* aRequest) const
 {
   // Default to pending load in case of errors
-  if (mKind != Kind::ImageElement) {
+  if (mKind == Kind::NonGeneratedContentProperty) {
     MOZ_ASSERT(aRequest == mContentURLRequest);
     return false;
   }
 
   nsCOMPtr<nsIImageLoadingContent> imageLoader(do_QueryInterface(mContent));
   MOZ_ASSERT(imageLoader);
 
   int32_t requestType = nsIImageLoadingContent::UNKNOWN_REQUEST;
@@ -943,17 +916,17 @@ nsImageFrame::EnsureIntrinsicSizeAndRati
     UpdateIntrinsicSize(mImage);
     UpdateIntrinsicRatio(mImage);
     return;
   }
 
   // NOTE(emilio, https://github.com/w3c/csswg-drafts/issues/2832): WebKit
   // and Blink behave differently here for content: url(..), for now adapt to
   // Blink's behavior.
-  const bool mayDisplayBrokenIcon = mKind == Kind::ImageElement;
+  const bool mayDisplayBrokenIcon = IsForNonGeneratedImageElement();
   if (!mayDisplayBrokenIcon) {
     return;
   }
   // image request is null or image size not known, probably an
   // invalid image specified
   bool imageInvalid = false;
 
   // check for broken images. valid null images (eg. img src="") are
@@ -1890,17 +1863,17 @@ nsImageFrame::PaintImage(gfxContext& aRe
   }
 
   return result;
 }
 
 already_AddRefed<imgIRequest>
 nsImageFrame::GetCurrentRequest() const
 {
-  if (mKind != Kind::ImageElement) {
+  if (mKind == Kind::NonGeneratedContentProperty) {
     return do_AddRef(mContentURLRequest);
   }
 
   MOZ_ASSERT(!mContentURLRequest);
 
   nsCOMPtr<imgIRequest> request;
   nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
   MOZ_ASSERT(imageLoader);
--- a/layout/generic/nsImageFrame.h
+++ b/layout/generic/nsImageFrame.h
@@ -179,32 +179,37 @@ public:
 
   // nsIReflowCallback
   virtual bool ReflowFinished() override;
   virtual void ReflowCallbackCanceled() override;
 
   // The kind of image frame we are.
   enum class Kind : uint8_t
   {
-    // For an nsImageLoadingContent.
+    // For an nsImageLoadingContent, including generated ::before and ::after
+    // content, which are an nsGenConImageContent.
     ImageElement,
-    // For css 'content: url(..)' on non-generated content.
-    ContentProperty,
-    // For a child of a ::before / ::after pseudo-element that had an url() item
-    // for the content property.
-    ContentPropertyAtIndex,
+    // For css 'content: url(..)' on other elements.
+    NonGeneratedContentProperty,
   };
 
+  // Whether this frame is for a non-generated image element, that is, one that
+  // isn't a ::before / ::after.
+  bool IsForNonGeneratedImageElement() const
+  {
+    return mKind == Kind::ImageElement &&
+      !HasAnyStateBits(NS_FRAME_GENERATED_CONTENT);
+  }
+
   // Creates a suitable continuing frame for this frame.
   nsImageFrame* CreateContinuingFrame(nsIPresShell*, ComputedStyle*) const;
 
 private:
   friend nsIFrame* NS_NewImageFrame(nsIPresShell*, ComputedStyle*);
   friend nsIFrame* NS_NewImageFrameForContentProperty(nsIPresShell*, ComputedStyle*);
-  friend nsIFrame* NS_NewImageFrameForGeneratedContentIndex(nsIPresShell*, ComputedStyle*);
 
   nsImageFrame(ComputedStyle* aStyle, Kind aKind)
     : nsImageFrame(aStyle, kClassID, aKind)
   { }
 
   nsImageFrame(ComputedStyle*, ClassID, Kind);
 
 protected:
deleted file mode 100644
--- a/layout/reftests/pagination/content-url-pseudo-ref.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<!doctype html>
-<html class="reftest-paged">
-<style>
-  div {
-    display: block;
-    height: 20in;
-  }
-</style>
-<div>
-  <img src="data:image/gif,GIF89a%01%00%E8%03%80%00%00%00%00%00%FF%FF%FF!%F9%04%00%00%00%00%00%2C%00%00%00%00%01%00%E8%03%00%02%1E%84%8F%A9%CB%ED%0F%A3%9C%B4%DA%8B%B3%DE%BC%FB%0F%86%E2H%96%E6%89%A6%EA%CA%B6%EE%0B%3B%05%00%3B">
-</div>
--- a/layout/reftests/pagination/reftest.list
+++ b/layout/reftests/pagination/reftest.list
@@ -113,9 +113,9 @@ fuzzy-if(cocoaWidget,1,5000) == 745025-1
 # trying to test (shrink-to-fit behavior), due to bug 967311.
 == 960822.html 960822-ref.html
 == 966419-1.html 966419-1-ref.html
 == 966419-2.html 966419-2-ref.html
 # asserts(3) fails 1108104.html 1108104-ref.html # bug 1067755, 1135556
 == 1166147.html 1166147-ref.html
 == 1321803-1a.html 1321803-1-ref.html
 == content-url-element.html image.html
-== content-url-pseudo.html content-url-pseudo-ref.html
+== content-url-pseudo.html image.html
--- a/testing/web-platform/meta/MANIFEST.json
+++ b/testing/web-platform/meta/MANIFEST.json
@@ -109670,28 +109670,16 @@
       [
        "/css/css-content/element-replacement-ref.html",
        "=="
       ]
      ],
      {}
     ]
    ],
-   "css/css-content/pseudo-element-inline-box.html": [
-    [
-     "/css/css-content/pseudo-element-inline-box.html",
-     [
-      [
-       "/css/css-content/pseudo-element-inline-box-ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
    "css/css-counter-styles/broken-symbols.htm": [
     [
      "/css/css-counter-styles/broken-symbols.htm",
      [
       [
        "/css/css-counter-styles/broken-symbols-ref.htm",
        "=="
       ]
@@ -241744,21 +241732,16 @@
      {}
     ]
    ],
    "css/css-content/element-replacement-ref.html": [
     [
      {}
     ]
    ],
-   "css/css-content/pseudo-element-inline-box-ref.html": [
-    [
-     {}
-    ]
-   ],
    "css/css-content/resources/blank.html": [
     [
      {}
     ]
    ],
    "css/css-content/resources/rect.svg": [
     [
      {}
@@ -507628,24 +507611,16 @@
   "css/css-content/element-replacement-ref.html": [
    "f1ad3fca133b1b671e45ae1307fbe9454c40e3ec",
    "support"
   ],
   "css/css-content/element-replacement.html": [
    "f491ddf2b3062ea2f9b616c968c88b9cc95f22eb",
    "reftest"
   ],
-  "css/css-content/pseudo-element-inline-box-ref.html": [
-   "9dac06a226bb54ce2c735bfb00aca30d204b2dfd",
-   "support"
-  ],
-  "css/css-content/pseudo-element-inline-box.html": [
-   "af67630b8d0f14c2a3512c942c1f8b487388ee69",
-   "reftest"
-  ],
   "css/css-content/resources/blank.html": [
    "d96d45f3a57b58460787fcde5fd15ccb324b123c",
    "support"
   ],
   "css/css-content/resources/rect.svg": [
    "e0c37ea653aee58f962133219edc4484a734c6e0",
    "support"
   ],
deleted file mode 100644
--- a/testing/web-platform/tests/css/css-content/pseudo-element-inline-box-ref.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<!doctype html>
-<title>CSS Test Reference</title>
-<p>Should see a green image with a blue border</p>
-<div>
-  <span style="border: 10px solid blue">
-    <img src="resources/rect.svg">
-  </span>
-</div>
deleted file mode 100644
--- a/testing/web-platform/tests/css/css-content/pseudo-element-inline-box.html
+++ /dev/null
@@ -1,15 +0,0 @@
-<!doctype html>
-<title>CSS Test: content: url() on pseudo-elements is under a non-replaced box.</title>
-<link rel="match" href="pseudo-element-inline-box-ref.html">
-<link rel="author" title="Emilio Cobos Álvarez" href="mailto:emilio@crisal.io">
-<link rel="author" title="Boris Zbarsky" href="mailto:bzbarsky@mit.edu">
-<link rel="help" href="https://drafts.csswg.org/css-content/#typedef-content-content-list">
-<style>
-  div::before {
-    border: 10px solid blue;
-    content: url(resources/rect.svg);
-    display: inline;
-  }
-</style>
-<p>Should see a green image with a blue border</p>
-<div></div>