Bug 1680406 - Allow a prev-in-flow to have an ExcessOverflowContainers list and merge it to our OverflowContainers as needed. r=TYLin CLOSED TREE

Differential Revision: https://phabricator.services.mozilla.com/D99637

layout/generic/crashtests/1680406.html

@@ -0,0 +1,16 @@
+<style>
+.a {
+  column-count: 4;
+  display: block;
+}
+* {
+  height: 1vmax;
+  grid-row-gap: 7em;
+  display: -webkit-flex;
+  -webkit-flex-direction: column
+}
+</style>
+<time class="a"></x>
+<label>
+x
+<q>

layout/generic/crashtests/crashtests.list

@@ -787,3 +787,4 @@ load 1652897.html
 asserts(0-7) load 1654925.html
 load 1666592.html
 HTTP load 1677518-1.html
+load 1680406.html

layout/generic/nsContainerFrame.cpp

@@ -2225,19 +2225,19 @@ nsFrameList* nsContainerFrame::DrainExcessOverflowContainersList(
     ChildFrameMerger aMergeFunc) {
   nsFrameList* overflowContainers = GetOverflowContainers();
 
-  NS_ASSERTION(!(overflowContainers && GetPrevInFlow() &&
-                 static_cast<nsContainerFrame*>(GetPrevInFlow())
-                     ->GetExcessOverflowContainers()),
-               "conflicting overflow containers lists");
-
-  if (!overflowContainers) {
-    // Drain excess overflow containers from our prev-in-flow.
-    if (auto* prev = static_cast<nsContainerFrame*>(GetPrevInFlow())) {
-      AutoFrameListPtr excessFrames(PresContext(),
-                                    prev->StealExcessOverflowContainers());
-      if (excessFrames) {
-        excessFrames->ApplySetParent(this);
-        nsContainerFrame::ReparentFrameViewList(*excessFrames, prev, this);
+  // Drain excess overflow containers from our prev-in-flow.
+  if (auto* prev = static_cast<nsContainerFrame*>(GetPrevInFlow())) {
+    AutoFrameListPtr excessFrames(PresContext(),
+                                  prev->StealExcessOverflowContainers());
+    if (excessFrames) {
+      excessFrames->ApplySetParent(this);
+      nsContainerFrame::ReparentFrameViewList(*excessFrames, prev, this);
+      if (overflowContainers) {
+        // The default merge function is AppendFrames, so we use excessFrames as
+        // the destination and then assign the result to overflowContainers.
+        aMergeFunc(*excessFrames, *overflowContainers, this);
+        *overflowContainers = std::move(*excessFrames);
+      } else {
         overflowContainers = SetOverflowContainers(std::move(*excessFrames));
       }
     }

layout/generic/nsContainerFrame.h

@@ -327,6 +327,18 @@ class nsContainerFrame : public nsSplittableFrame {
    * See nsBlockFrame::Reflow for a sample implementation.
    *
    * For more information, see https://wiki.mozilla.org/Gecko:Continuation_Model
+   *
+   * Note that Flex/GridContainerFrame doesn't use nsOverflowContinuationTracker
+   * so the above doesn't apply.  Flex/Grid containers may have items that
+   * aren't in document order between fragments, due to the 'order' property,
+   * but they do maintain the invariant that children in the same nsFrameList
+   * are in document order.  This means that when pushing/pulling items or
+   * merging lists, the result needs to be sorted to restore the order.
+   * However, given that lists are individually sorted, it's a simple merge
+   * operation of the two lists to make the result sorted.
+   * DrainExcessOverflowContainersList takes a merging function to perform that
+   * operation.  (By "document order" here we mean normal frame tree order,
+   * which is approximately flattened DOM tree order.)
    */
 
   friend class nsOverflowContinuationTracker;