Bug 1673524 - When passing a null abspos containing block, also make fixed pos respect it. r=TYLin

Otherwise fixed-pos elements still escape the container chain, which is
what the null-abspos container hack (currently used by mathml) is
supposed to prevent.

Differential Revision: https://phabricator.services.mozilla.com/D96779

layout/base/nsCSSFrameConstructor.cpp

@@ -680,11 +680,14 @@ class MOZ_STACK_CLASS nsFrameConstructorState {
   // using this state.
   nsFrameState mAdditionalStateBits;
 
-  // When working with the transform and filter properties, we want to hook
-  // the abs-pos and fixed-pos lists together, since such
-  // elements are fixed-pos containing blocks.  This flag determines
-  // whether or not we want to wire the fixed-pos and abs-pos lists
-  // together.
+  // When working with transform / filter properties, we want to hook the
+  // abs-pos and fixed-pos lists together, since such elements are fixed-pos
+  // containing blocks.
+  //
+  // Similarly when restricting absolute positioning (for e.g. mathml).
+  //
+  // This flag determines whether or not we want to wire the fixed-pos and
+  // abs-pos lists together.
   bool mFixedPosIsAbsPos;
 
   // A boolean to indicate whether we have a "pending" popupgroup.  That is, we
@@ -892,6 +895,8 @@ void nsFrameConstructorState::ProcessFrameInsertionsForAllLists() {
 void nsFrameConstructorState::PushAbsoluteContainingBlock(
     nsContainerFrame* aNewAbsoluteContainingBlock, nsIFrame* aPositionedFrame,
     nsFrameConstructorSaveState& aSaveState) {
+  MOZ_ASSERT(!!aNewAbsoluteContainingBlock == !!aPositionedFrame,
+             "We should have both or none");
   aSaveState.mList = &mAbsoluteList;
   aSaveState.mSavedList = mAbsoluteList;
   aSaveState.mChildListID = nsIFrame::kAbsoluteList;
@@ -908,10 +913,11 @@ void nsFrameConstructorState::PushAbsoluteContainingBlock(
   mAbsoluteList = AbsoluteFrameList(aNewAbsoluteContainingBlock);
 
   /* See if we're wiring the fixed-pos and abs-pos lists together.  This happens
-   * iff we're a transformed element.
+   * if we're a transformed/filtered/etc element, or if we force a null abspos
+   * containing block (for mathml for example).
    */
   mFixedPosIsAbsPos =
-      aPositionedFrame && aPositionedFrame->IsFixedPosContainingBlock();
+      !aPositionedFrame || aPositionedFrame->IsFixedPosContainingBlock();
 
   if (aNewAbsoluteContainingBlock) {
     aNewAbsoluteContainingBlock->MarkAsAbsoluteContainingBlock();

testing/web-platform/meta/mathml/relations/css-styling/not-participating-to-parent-layout.html.ini

@@ -119,3 +119,18 @@
   [msup layout is not affected by children with "position: fixed" style]
     expected: FAIL
 
+  [ms layout is not affected by children with "position: fixed" style]
+    expected: FAIL
+
+  [mn layout is not affected by children with "position: fixed" style]
+    expected: FAIL
+
+  [mtext layout is not affected by children with "position: fixed" style]
+    expected: FAIL
+
+  [mo layout is not affected by children with "position: fixed" style]
+    expected: FAIL
+
+  [mi layout is not affected by children with "position: fixed" style]
+    expected: FAIL
+

testing/web-platform/tests/mathml/crashtests/fixed-pos-children.html

@@ -0,0 +1,25 @@
+<style>
+    * {
+        border-bottom: hsla(115.49088416259553deg 12% 15% / 18%) groove thin;
+        -webkit-text-stroke: InactiveCaptionText thin;
+        scale: -121
+    }
+
+    * * {
+        padding-inline: 69%;
+    }
+</style>
+<script>
+  document.addEventListener('DOMContentLoaded', () => {
+    const style = document.createElement('style')
+    document.head.appendChild(style)
+    style.sheet.insertRule('* {-webkit-mask-image:url(', 0)
+  })
+</script>
+<math>
+    <mmultiscripts>
+        <mglyph>
+            <maligngroup style='position:fixed'></maligngroup>
+        </mglyph>
+    </mmultiscripts>
+</math>