Bug 1395591. When looking for our layout parent style, make sure to start with the placeholder if we're out of flow. r=emilio

MozReview-Commit-ID: 1M52bi3oQFX
2017-08-31 22:46:35 -04:00 · 2017-08-31 22:46:35 -04:00 · 11a90dfbd9
--- a/layout/base/ServoRestyleManager.cpp
+++ b/layout/base/ServoRestyleManager.cpp
@ -1554,9 +1554,15 @@ ServoRestyleManager::DoReparentStyleContext(nsIFrame* aFrame,

  if (!providerFrame) {
    // No providerFrame means we inherited from a display:contents thing.  Our
-    // layout parent style is the style of our nearest ancestor frame.
-    providerFrame = nsFrame::CorrectStyleParentFrame(aFrame->GetParent(),
-                                                     oldContext->GetPseudo());
+    // layout parent style is the style of our nearest ancestor frame.  But we have
+    // to be careful to do that with our placeholder, not with us, if we're out of
+    // flow.
+    if (aFrame->HasAnyStateBits(NS_FRAME_OUT_OF_FLOW)) {
+      aFrame->GetPlaceholderFrame()->GetLayoutParentStyleForOutOfFlow(&providerFrame);
+    } else {
+      providerFrame = nsFrame::CorrectStyleParentFrame(aFrame->GetParent(),
+                                                       oldContext->GetPseudo());
+    }
  }
  ServoStyleContext* layoutParent = providerFrame->StyleContext()->AsServo();

--- a/layout/base/crashtests/1395591-1.html
+++ b/layout/base/crashtests/1395591-1.html
@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<style>
+span {
+  position: fixed;
+}
+div {
+  display: contents
+}
+body::first-line {}
+</style>
+<div><span></span></div>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@ -495,3 +495,4 @@ load 1362423-1.html
 load 1381323.html
 asserts-if(!stylo,1) load 1388625-1.html # bug 1389286
 load 1390389.html
+load 1395591-1.html
--- a/layout/generic/nsPlaceholderFrame.cpp
+++ b/layout/generic/nsPlaceholderFrame.cpp
@ -203,6 +203,12 @@ nsPlaceholderFrame::GetParentStyleContextForOutOfFlow(nsIFrame** aProviderFrame)
    }
  }

+  return GetLayoutParentStyleForOutOfFlow(aProviderFrame);
+}
+
+nsStyleContext*
+nsPlaceholderFrame::GetLayoutParentStyleForOutOfFlow(nsIFrame** aProviderFrame) const
+{
  nsIFrame* parentFrame = GetParent();
  // Placeholder of backdrop frame is a child of the corresponding top
  // layer frame, and its style context inherits from that frame. In
--- a/layout/generic/nsPlaceholderFrame.h
+++ b/layout/generic/nsPlaceholderFrame.h
@ -146,6 +146,9 @@ public:

  nsStyleContext* GetParentStyleContextForOutOfFlow(nsIFrame** aProviderFrame) const;

+  // Like GetParentStyleContextForOutOfFlow, but ignores display:contents bits.
+  nsStyleContext* GetLayoutParentStyleForOutOfFlow(nsIFrame** aProviderFrame) const;
+
  bool RenumberFrameAndDescendants(int32_t* aOrdinal,
                                   int32_t aDepth,
                                   int32_t aIncrement,