From 9c360d52a843469b2b45897665f2069c70bdbd31 Mon Sep 17 00:00:00 2001
From: Sandor Molnar <smolnar@mozilla.com>
Date: Thu, 13 Jul 2023 19:00:50 +0300
Subject: [PATCH] Backed out changeset 2b33eb976812 (bug 1843261) for causing
 assertion failures in widget/PuppetWidget.cpp CLOSED TREE

---
 browser/app/profile/firefox.js           |  1 +
 layout/base/crashtests/336999-1.xhtml    | 24 ++++++++++++++++++++++++
 layout/base/crashtests/crashtests.list   |  1 +
 modules/libpref/init/StaticPrefList.yaml |  5 +++++
 widget/PuppetWidget.cpp                  |  9 ++++++++-
 5 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 layout/base/crashtests/336999-1.xhtml

diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 0f1ff3d0f78b..916a22851113 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -2076,6 +2076,7 @@ pref("privacy.fingerprintingProtection.pbmode", true);
 
 // Start the browser in e10s mode
 pref("browser.tabs.remote.autostart", true);
+pref("browser.tabs.remote.desktopbehavior", true);
 
 // Run media transport in a separate process?
 pref("media.peerconnection.mtransport_process", true);
diff --git a/layout/base/crashtests/336999-1.xhtml b/layout/base/crashtests/336999-1.xhtml
new file mode 100644
index 000000000000..193b6816130d
--- /dev/null
+++ b/layout/base/crashtests/336999-1.xhtml
@@ -0,0 +1,24 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait">
+
+<script>
+
+function boom()
+{
+  document.getElementById("xxx").style.position = "fixed";
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function(){setTimeout(boom, 30)}, 0);
+
+</script>
+
+  <hbox id="xxx" style="position: absolute; display: block;">
+    <label value="X" />
+    <menulist>
+      <menupopup>
+        <menuitem label="Y" />
+      </menupopup>
+    </menulist>
+  </hbox>
+
+</window>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index e2d629cfccb4..c9bbbfefc750 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -87,6 +87,7 @@ load 331679-3.xml
 load 331883-1.html
 load 335140-1.html
 load 336291-1.html
+skip-if(Android) load chrome://reftest/content/crashtests/layout/base/crashtests/336999-1.xhtml
 load 337066-1.xhtml
 load 337268-1.html
 load 337419-1.html
diff --git a/modules/libpref/init/StaticPrefList.yaml b/modules/libpref/init/StaticPrefList.yaml
index fb93993c85d2..5e355bfb63f8 100644
--- a/modules/libpref/init/StaticPrefList.yaml
+++ b/modules/libpref/init/StaticPrefList.yaml
@@ -1646,6 +1646,11 @@
   value: false
   mirror: always
 
+- name: browser.tabs.remote.desktopbehavior
+  type: bool
+  value: false
+  mirror: always
+
 - name: browser.tabs.remote.force-paint
   type: bool
   value: true
diff --git a/widget/PuppetWidget.cpp b/widget/PuppetWidget.cpp
index 41e8e024cc20..ca1d4c238093 100644
--- a/widget/PuppetWidget.cpp
+++ b/widget/PuppetWidget.cpp
@@ -18,6 +18,8 @@
 #include "mozilla/Preferences.h"
 #include "mozilla/PresShell.h"
 #include "mozilla/SchedulerGroup.h"
+#include "mozilla/StaticPrefs_browser.h"
+#include "mozilla/StaticPrefs_gfx.h"
 #include "mozilla/TextComposition.h"
 #include "mozilla/TextEventDispatcher.h"
 #include "mozilla/TextEvents.h"
@@ -995,7 +997,12 @@ void PuppetWidget::OnMemoryPressure(layers::MemoryPressureReason aWhy) {
 bool PuppetWidget::NeedsPaint() {
   // e10s popups are handled by the parent process, so never should be painted
   // here
-  MOZ_ASSERT(mWindowType != WindowType::Popup);
+  if (XRE_IsContentProcess() &&
+      StaticPrefs::browser_tabs_remote_desktopbehavior() &&
+      mWindowType == WindowType::Popup) {
+    NS_WARNING("Trying to paint an e10s popup in the child process!");
+    return false;
+  }
 
   return mVisible;
 }