From 61dd350d4f840f2a6d05f764db18ad4d814d00d2 Mon Sep 17 00:00:00 2001
From: Ting-Yu Lin <tlin@mozilla.com>
Date: Mon, 7 Dec 2020 12:45:38 +0000
Subject: [PATCH] Bug 1663232 - Don't delete a child's next-in-flow if it's
 going to be reflow again due to clearance. r=emilio

After this patch, the testcase still triggers soft assertions like

  ASSERTION: Placeholder relationship should have been torn down already;
  this might mean we have a stray placeholder in the tree.

We have multiple bugs filed for this assertions such as bug 856269.

Differential Revision: https://phabricator.services.mozilla.com/D90760
---
 layout/generic/nsBlockReflowContext.cpp       | 10 +++---
 ...nce-containing-fragmented-float-crash.html | 36 +++++++++++++++++++
 2 files changed, 42 insertions(+), 4 deletions(-)
 create mode 100644 testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html

diff --git a/layout/generic/nsBlockReflowContext.cpp b/layout/generic/nsBlockReflowContext.cpp
index dcd12f5471c2..21263260b00a 100644
--- a/layout/generic/nsBlockReflowContext.cpp
+++ b/layout/generic/nsBlockReflowContext.cpp
@@ -313,11 +313,13 @@ void nsBlockReflowContext::ReflowBlock(
   }
 
   if (!aFrameReflowStatus.IsInlineBreakBefore() &&
+      !aFrameRI.WillReflowAgainForClearance() &&
       aFrameReflowStatus.IsFullyComplete()) {
-    // If frame is complete and has a next-in-flow, we need to delete
-    // them now. Do not do this when a break-before is signaled because
-    // the frame is going to get reflowed again (whether the frame is
-    // (in)complete is undefined in that case anyway).
+    // If mFrame is fully-complete and has a next-in-flow, we need to delete
+    // them now. Do not do this when a break-before is signaled or when a
+    // clearance frame is discovered in mFrame's subtree because mFrame is going
+    // to get reflowed again (whether the frame is (in)complete is undefined in
+    // that case anyway).
     if (nsIFrame* kidNextInFlow = mFrame->GetNextInFlow()) {
       // Remove all of the childs next-in-flows. Make sure that we ask
       // the right parent to do the removal (it's possible that the
diff --git a/testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html b/testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html
new file mode 100644
index 000000000000..3e62a52c30a4
--- /dev/null
+++ b/testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html
@@ -0,0 +1,36 @@
+<!-- quirks mode -->
+<meta charset="utf-8">
+<title>Should not crash when a clearance frame having a fragmented float is discovered</title>
+<link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
+<link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1663232">
+
+<style>
+:not(em) {
+  border-left: 4px dashed green;
+  column-width: 0;
+}
+</style>
+<script>
+function go() {
+  b.appendChild(a)
+}
+</script>
+<m>
+<details ontoggle="go()" open>
+<f>
+<menu>U<menu>
+<table align="RIGHT">
+<caption>
+<o>
+<ul>
+<l>
+<li>
+<tr>6
+<table>
+<a>
+<details id="b" open>
+<summary>
+<i id="a">
+</summary>
+<details style="float: right">