Bug 1343948 - Merge overflow container children to next-in-flow's OverflowContainersProperty() if the property already exists. r=mats

This is to prevent the assertion at the beginning of
DrainExcessOverflowContainersList().

The invariant is described in the comment revised in this patch. That
is, "only one overflow containers list exists for a given frame: either
its own OverflowContainersProperty or its prev-in-flow's
ExcessOverflowContainersProperty, not both."

Differential Revision: https://phabricator.services.mozilla.com/D77328

layout/base/crashtests/crashtests.list

@@ -452,7 +452,7 @@ load 1308848-2.html
 load 1338772-1.html
 load 1340571.html
 pref(dom.animations-api.implicit-keyframes.enabled,true) load 1343139-1.html
-asserts(0-1) asserts-if(Android,1-4) load 1343606.html # bug 1343948
+load 1343606.html
 load 1343937.html
 load 1352380.html
 load 1362423-1.html

layout/generic/nsContainerFrame.cpp

@@ -1741,7 +1741,18 @@ bool nsContainerFrame::PushIncompleteChildren(
     MergeSortedOverflow(incompleteList);
   }
   if (!overflowIncompleteList.IsEmpty()) {
-    MergeSortedExcessOverflowContainers(overflowIncompleteList);
+    // If our next-in-flow already has overflow containers list, merge the
+    // overflowIncompleteList into that list. Otherwise, merge it into our
+    // excess overflow containers list, to be drained by our next-in-flow.
+    auto* nif = static_cast<nsContainerFrame*>(GetNextInFlow());
+    nsFrameList* oc =
+        nif ? nif->GetPropTableFrames(OverflowContainersProperty()) : nullptr;
+    if (oc) {
+      ReparentFrames(overflowIncompleteList, this, nif);
+      MergeSortedFrameLists(*oc, overflowIncompleteList, GetContent());
+    } else {
+      MergeSortedExcessOverflowContainers(overflowIncompleteList);
+    }
   }
   return true;
 }

layout/generic/nsContainerFrame.h

@@ -288,15 +288,15 @@ class nsContainerFrame : public nsSplittableFrame {
 
   // ==========================================================================
   /* Overflow containers are continuation frames that hold overflow. They
-   * are created when the frame runs out of computed height, but still has
-   * too much content to fit in the availableHeight. The parent creates a
+   * are created when the frame runs out of computed block-size, but still has
+   * too much content to fit in the AvailableBSize. The parent creates a
    * continuation as usual, but marks it as NS_FRAME_IS_OVERFLOW_CONTAINER
    * and adds it to its next-in-flow's overflow container list, either by
    * adding it directly or by putting it in its own excess overflow containers
    * list (to be drained by the next-in-flow when it calls
    * ReflowOverflowContainerChildren). The parent continues reflow as if
-   * the frame was complete once it ran out of computed height, but returns a
-   * reflow status with either IsIncomplete() or IsOverflowIncomplete() equal
+   * the frame was complete once it ran out of computed block-size, but returns
+   * a reflow status with either IsIncomplete() or IsOverflowIncomplete() equal
    * to true to request a next-in-flow. The parent's next-in-flow is then
    * responsible for calling ReflowOverflowContainerChildren to (drain and)
    * reflow these overflow continuations. Overflow containers do not affect
@@ -310,13 +310,13 @@ class nsContainerFrame : public nsSplittableFrame {
    *   - new continuations may need to be spliced into the middle of the list
    *     or deleted continuations slipped out
    *     e.g. A, B, C are all fixed-size containers on one page, all have
-   *      overflow beyond availableHeight, and content is dynamically added
+   *      overflow beyond AvailableBSize, and content is dynamically added
    *      and removed from B
    * As a result, it is not possible to simply prepend the new continuations
-   * to the old list as with the overflowProperty mechanism. To avoid
+   * to the old list as with the OverflowProperty mechanism. To avoid
    * complicated list splicing, the code assumes only one overflow containers
-   * list exists for a given frame: either its own overflowContainersProperty
-   * or its prev-in-flow's excessOverflowContainersProperty, not both.
+   * list exists for a given frame: either its own OverflowContainersProperty
+   * or its prev-in-flow's ExcessOverflowContainersProperty, not both.
    *
    * The nsOverflowContinuationTracker helper class should be used for tracking
    * overflow containers and adding them to the appropriate list.