Bug 1870103 - Disallow fragmentation-imposed block-size growth for replaced elements. r=dholbert

Differential Revision: https://phabricator.services.mozilla.com/D196811
2023-12-19 16:33:58 +00:00 · 2023-12-19 16:33:58 +00:00 · 84705736a5
--- a/layout/generic/nsFlexContainerFrame.cpp
+++ b/layout/generic/nsFlexContainerFrame.cpp
@ -6070,6 +6070,11 @@ nsReflowStatus nsFlexContainerFrame::ReflowFlexItem(
    if (!aReflowInput.IsInFragmentedContext()) {
      return false;
    }
+    if (aItem.Frame()->IsReplaced()) {
+      // Disallow fragmentation-imposed block-size growth for replaced elements
+      // since they are monolithic, and cannot be fragmented.
+      return false;
+    }
    if (aItem.HasAspectRatio()) {
      // Aspect-ratio's automatic content-based minimum size doesn't work
      // properly in a fragmented context (Bug 1868284) when we use 'auto'
--- a/testing/web-platform/tests/css/css-break/flexbox/textarea-input-flex-items-in-multicol-crash.html
+++ b/testing/web-platform/tests/css/css-break/flexbox/textarea-input-flex-items-in-multicol-crash.html
@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
+<link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1870103">
+
+<div style="columns: 2;">
+  <div style="display: flex;">
+    <textarea></textarea>
+    <input>
+  </div>
+</div>