gecko-dev/layout/base/crashtests/1437155.html
Emilio Cobos Álvarez dc83850d63 Bug 1437155: Avoid giving a first-letter frame to a display: contents element. r=mats
It doesn't make sense, since they have no frame themselves, and it breaks
invariants other code relies on. Use the parent frame instead.

The stack overflow happens because we give the first-letter frame to the
display: contents element, then we reframe it.

Removing a display: contents node calls ContentRemoved on all the children. One
of these children is this text-node inside the first-letter frame. Since it was
split by bidi resolution we go ahead and reframe the parent in:

  https://searchfox.org/mozilla-central/rev/d2b4b40901c15614fad2fa34718eea428774306e/layout/base/nsCSSFrameConstructor.cpp#9688

But the parent is the display: contents node, which results in infinite
recursion.

The usage of GetParent() is wrong anyway too, since it doesn't handle XBL or
Shadow DOM in any way.

MozReview-Commit-ID: JFD16at316V

--HG--
extra : rebase_source : e485b45bc146a70c26f8534f760899218da07500
2018-03-05 11:42:12 +01:00

14 lines
256 B
HTML

<script>
window.onload=function() {
document.getElementById('a').hidden='false';
}
</script>
<a></a>
<section dir='rtl'>
<kbd id='a' dir='auto'>
a
<style>
:only-child{ display:contents }
:first-of-type::first-letter{ background-position:unset }
</style>