From 40f2b82d3e99336fe968c115ea68956dd5e98f6e Mon Sep 17 00:00:00 2001
From: Kagami Sascha Rosylight <krosylight@mozilla.com>
Date: Tue, 2 Feb 2021 00:09:59 +0000
Subject: [PATCH] Bug 1676970 - Always consider text controls has independent
 selection r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D97720
---
 layout/generic/crashtests/1676970.html    | 20 +++++++++++++++
 layout/generic/crashtests/crashtests.list |  1 +
 layout/generic/nsIFrame.cpp               | 30 ++++++++++++++++-------
 3 files changed, 42 insertions(+), 9 deletions(-)
 create mode 100644 layout/generic/crashtests/1676970.html
diff --git a/layout/generic/crashtests/1676970.html b/layout/generic/crashtests/1676970.html
new file mode 100644
index 000000000000..fd3af85db2bb
--- /dev/null
+++ b/layout/generic/crashtests/1676970.html
@@ -0,0 +1,20 @@
+<script>
+function go() {
+  a.appendChild(c)
+  a.getRootNode().addEventListener("DOMSubtreeModified", eh, { once: true })
+  b.setAttribute("oninvalid", "eh()")
+}
+function eh() {
+  b.setAttribute("role", "dialog")
+  window.scrollBy(0.802, 0.384)
+  var x = document.getSelection()
+  x.extend(a)
+  x.modify("move", "forward", "lineboundary")
+  a.style.setProperty("column-span", "all")
+}
+</script>
+<body onload=go()>
+<select>
+<option id="a" contenteditable="true">x</span>
+<input id="b">
+<textarea id="c">
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 59282163fcee..5154312bb840 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -787,6 +787,7 @@ asserts(0-7) load 1654925.html
 load 1663222.html
 load 1666592.html
 load 1670336.html
+load 1676970.html
 HTTP load 1677518-1.html
 load 1680406.html
 load 1681788.html
diff --git a/layout/generic/nsIFrame.cpp b/layout/generic/nsIFrame.cpp
index 0b9ba661997b..7200e2cdc52f 100644
--- a/layout/generic/nsIFrame.cpp
+++ b/layout/generic/nsIFrame.cpp
@@ -5263,20 +5263,32 @@ static bool SelfIsSelectable(nsIFrame* aFrame, uint32_t aFlags) {
 }
 
 static bool SelectionDescendToKids(nsIFrame* aFrame) {
-  StyleUserSelect style = aFrame->StyleUIReset()->mUserSelect;
-  nsIFrame* parent = aFrame->GetParent();
   // If we are only near (not directly over) then don't traverse
-  // frames with independent selection (e.g. text and list controls)
-  // unless we're already inside such a frame (see bug 268497).  Note that this
-  // prevents any of the users of this method from entering form controls.
+  // frames with independent selection (e.g. text and list controls, see bug
+  // 268497).  Note that this prevents any of the users of this method from
+  // entering form controls.
   // XXX We might want some way to allow using the up-arrow to go into a form
   // control, but the focus didn't work right anyway; it'd probably be enough
   // if the left and right arrows could enter textboxes (which I don't believe
   // they can at the moment)
-  return !aFrame->IsGeneratedContentFrame() && style != StyleUserSelect::All &&
-         style != StyleUserSelect::None &&
-         (parent->HasAnyStateBits(NS_FRAME_INDEPENDENT_SELECTION) ||
-          !aFrame->HasAnyStateBits(NS_FRAME_INDEPENDENT_SELECTION));
+  if (aFrame->IsTextInputFrame() || aFrame->IsListControlFrame()) {
+    MOZ_ASSERT(aFrame->HasAnyStateBits(NS_FRAME_INDEPENDENT_SELECTION));
+    return false;
+  }
+
+  // Failure in this assertion means a new type of frame forms the root of an
+  // NS_FRAME_INDEPENDENT_SELECTION subtree. In such case, the condition above
+  // should be changed to handle it.
+  MOZ_ASSERT_IF(
+      aFrame->HasAnyStateBits(NS_FRAME_INDEPENDENT_SELECTION),
+      aFrame->GetParent()->HasAnyStateBits(NS_FRAME_INDEPENDENT_SELECTION));
+
+  if (aFrame->IsGeneratedContentFrame()) {
+    return false;
+  }
+
+  auto style = aFrame->StyleUIReset()->mUserSelect;
+  return style != StyleUserSelect::All && style != StyleUserSelect::None;
 }
 
 static FrameTarget GetSelectionClosestFrameForChild(nsIFrame* aChild,
