Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 21:31:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1663232 - Don't delete a child's next-in-flow if it's going to be reflow again due to clearance. r=emilio

Browse Source 
After this patch, the testcase still triggers soft assertions like

  ASSERTION: Placeholder relationship should have been torn down already;
  this might mean we have a stray placeholder in the tree.

We have multiple bugs filed for this assertions such as bug 856269.

Differential Revision: https://phabricator.services.mozilla.com/D90760
This commit is contained in:
Ting-Yu Lin 2020-12-07 12:45:38 +00:00
parent 1480e86815
commit 61dd350d4f
2 changed files with 42 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
layout/generic/nsBlockReflowContext.cpp
View File

@ -313,11 +313,13 @@ void nsBlockReflowContext::ReflowBlock(
}
if (!aFrameReflowStatus.IsInlineBreakBefore() &&
!aFrameRI.WillReflowAgainForClearance() &&
aFrameReflowStatus.IsFullyComplete()) {
// If frame is complete and has a next-in-flow, we need to delete
// them now. Do not do this when a break-before is signaled because
// the frame is going to get reflowed again (whether the frame is
// (in)complete is undefined in that case anyway).
// If mFrame is fully-complete and has a next-in-flow, we need to delete
// them now. Do not do this when a break-before is signaled or when a
// clearance frame is discovered in mFrame's subtree because mFrame is going
// to get reflowed again (whether the frame is (in)complete is undefined in
// that case anyway).
if (nsIFrame* kidNextInFlow = mFrame->GetNextInFlow()) {
// Remove all of the childs next-in-flows. Make sure that we ask
// the right parent to do the removal (it's possible that the

36
testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html Normal file
View File

@ -0,0 +1,36 @@
<!-- quirks mode -->
<meta charset="utf-8">
<title>Should not crash when a clearance frame having a fragmented float is discovered</title>
<link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
<link rel="author" title="Mozilla" href="https://www.mozilla.org/">
<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1663232">
<style>
:not(em) {
border-left: 4px dashed green;
column-width: 0;
}
</style>
<script>
function go() {
b.appendChild(a)
}
</script>
<m>
<details ontoggle="go()" open>
<f>
<menu>U<menu>
<table align="RIGHT">
<caption>
<o>
<ul>
<l>
<li>
<tr>6
<table>
<a>
<details id="b" open>
<summary>
<i id="a">
</summary>
<details style="float: right">