Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-01 00:32:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1745860 - Fix assert to deal with terrible <area> hack. r=dholbert

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D137753
This commit is contained in:
Emilio Cobos Álvarez 2022-02-04 22:03:27 +00:00
parent b3b0d2b63d
commit 546aa68368
3 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
layout/base/crashtests/1745860.html Normal file
View File

@ -0,0 +1,14 @@
<script>
let go = () => {
d.appendChild(b)
c.src = "data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs="
}
window.onload = go
</script>
<map id="a">
<area id="b"></area>
<video src="data:video/webm;base64,GkXfowEAAAAAAAAfQoaBAUL3gQFC8oEEQvOBCEKChHdlYm1Ch4ECQoWBAhhTgGcBAAAAAAAB6BFNm3RALE27i1OrhBVJqWZTrIHfTbuMU6uEFlSua1OsggEwTbuMU6uEHFO7a1OsggHL7AEAAAAAAACkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVSalmAQAAAAAAAEUq17GDD0JATYCNTGF2ZjU3LjI5LjEwMVdBjUxhdmY1Ny4yOS4xMDFzpJBAb17Yv2oNAF1ZEESuco33RImIQFCAAAAAAAAWVK5rAQAAAAAAADyuAQAAAAAAADPXgQFzxYEBnIEAIrWcg3VuZIaFVl9WUDmDgQEj44OEAfygVeABAAAAAAAAB7CCAUC6gfAfQ7Z1AQAAAAAAAEfngQCjqYEAAICCSYNCABPwDvYAOCQcGFQAAFBh9jAAABML7AAATEnjdRwIJ+gAo5eBACEAhgBAkpwATEAABCasAABekcXgABxTu2sBAAAAAAAAEbuPs4EAt4r3gQHxggF48IED">
</video>
<img id="c" usemap="#a"></img>
<video id="d" onloadstart="go()">
<source></source>

1
layout/base/crashtests/crashtests.list
View File

@ -563,4 +563,5 @@ load 1723200.html
load 1729578.html
load 1729581.html
load 1734007.html
load 1745860.html
load 1752649.html

6
layout/base/nsCSSFrameConstructor.cpp
View File

@ -6398,7 +6398,11 @@ void nsCSSFrameConstructor::IssueSingleInsertNofications(
InsertionKind aInsertionKind) {
for (nsIContent* child = aStartChild; child != aEndChild;
child = child->GetNextSibling()) {
MOZ_ASSERT(!child->GetPrimaryFrame());
// XXX the GetContent() != child check is needed due to bug 135040.
// Remove it once that's fixed.
MOZ_ASSERT(
!child->GetPrimaryFrame() ||
child->GetPrimaryFrame()->GetContent() != child);
// Call ContentRangeInserted with this node.
ContentRangeInserted(child, child->GetNextSibling(), aInsertionKind);