Bug 1654925 - Make FindNearestCommonAncestorFrameWithinBlock handle bad frame trees without crashing. r=jfkthame

Differential Revision: https://phabricator.services.mozilla.com/D84768
2020-07-24 22:43:36 +00:00 · 2020-07-24 22:43:36 +00:00 · 5a44fc3b55
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@ -2834,14 +2834,28 @@ const nsIFrame* nsLayoutUtils::FindNearestCommonAncestorFrameWithinBlock(
  int n1 = 1;
  int n2 = 1;

-  for (auto f = f1->GetParent(); !f->IsBlockFrameOrSubclass();
-       f = f->GetParent()) {
+  for (auto f = f1->GetParent();;) {
+    NS_ASSERTION(f, "All text frames should have a block ancestor");
+    if (!f) {
+      return nullptr;
+    }
+    if (f->IsBlockFrameOrSubclass()) {
+      break;
+    }
    ++n1;
+    f = f->GetParent();
  }

-  for (auto f = f2->GetParent(); !f->IsBlockFrameOrSubclass();
-       f = f->GetParent()) {
+  for (auto f = f2->GetParent();;) {
+    NS_ASSERTION(f, "All text frames should have a block ancestor");
+    if (!f) {
+      return nullptr;
+    }
+    if (f->IsBlockFrameOrSubclass()) {
+      break;
+    }
    ++n2;
+    f = f->GetParent();
  }

  if (n1 > n2) {
--- a/layout/generic/crashtests/1654925.html
+++ b/layout/generic/crashtests/1654925.html
@ -0,0 +1,16 @@
+<script>
+function go() {
+  a.appendChild(b)
+}
+</script>
+<style>
+#b {
+  display: unset;
+  position: fixed;
+}
+</style>
+<body onload=go()>
+<ul id="a">
+<audio id="b">
+<marquee></marquee>
+<span>x</span>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -782,3 +782,4 @@ load 1645549-1.html
 load 1648577.html
 load 1652618.html
 load 1652897.html
+asserts(0-7) load 1654925.html