Backed out 7 changesets (bug 1542807) for causing failures at inert-retargeting-iframe.tentative.html. CLOSED TREE

Backed out changeset e9ef32fa2f2e (bug 1542807) Backed out changeset 8fa0cb199975 (bug 1542807) Backed out changeset 38daf64afe59 (bug 1542807) Backed out changeset e3aee052c495 (bug 1542807) Backed out changeset a71056d4c7cc (bug 1542807) Backed out changeset cf91e7d0a37f (bug 1542807) Backed out changeset eee949e5fd67 (bug 1542807)
2021-06-12 01:38:25 +03:00 · 2021-06-12 01:38:25 +03:00 · ed3da455ae
--- a/accessible/base/nsAccessibilityService.cpp
+++ b/accessible/base/nsAccessibilityService.cpp
@ -1129,10 +1129,11 @@ LocalAccessible* nsAccessibilityService::CreateAccessible(
      }
    } else if (content->IsGeneratedContentContainerForMarker()) {
      if (aContext->IsHTMLListItem()) {
-        newAcc = new HTMLListBulletAccessible(content, document);
-      }
-      if (aIsSubtreeHidden) {
-        *aIsSubtreeHidden = true;
+        const nsStyleList* styleList = frame->StyleList();
+        if (!styleList->mListStyleImage.IsNone() ||
+            !styleList->mCounterStyle.IsNone()) {
+          newAcc = new HTMLListBulletAccessible(content, document);
+        }
      }
    }
  }
--- a/accessible/generic/HyperTextAccessible.cpp
+++ b/accessible/generic/HyperTextAccessible.cpp
@ -423,8 +423,8 @@ uint32_t HyperTextAccessible::TransformOffset(LocalAccessible* aDescendant,
      // We manually set the offset so the error doesn't propagate up.
      if (offset == 0 && parent && parent->IsHTMLListItem() &&
          descendant->LocalPrevSibling() &&
-          descendant->LocalPrevSibling() ==
-              parent->AsHTMLListItem()->Bullet()) {
+          descendant->LocalPrevSibling()->GetFrame() &&
+          descendant->LocalPrevSibling()->GetFrame()->IsBulletFrame()) {
        offset = 0;
      } else {
        offset = (offset > 0 || descendant->IndexInParent() > 0) ? 1 : 0;
--- a/accessible/html/HTMLListAccessible.cpp
+++ b/accessible/html/HTMLListAccessible.cpp
@ -10,10 +10,11 @@
 #include "DocAccessible.h"
 #include "EventTree.h"
 #include "nsAccUtils.h"
-#include "nsPersistentProperties.h"
+#include "nsTextEquivUtils.h"
 #include "Role.h"
 #include "States.h"

+#include "nsBulletFrame.h"
 #include "nsLayoutUtils.h"

 using namespace mozilla;
@ -89,7 +90,24 @@ HTMLListBulletAccessible::HTMLListBulletAccessible(nsIContent* aContent,
 // HTMLListBulletAccessible: LocalAccessible

 ENameValueFlag HTMLListBulletAccessible::Name(nsString& aName) const {
-  nsLayoutUtils::GetMarkerSpokenText(mContent, aName);
+  aName.Truncate();
+
+  // Native anonymous content, ARIA can't be used. Get list bullet text.
+  if (nsBulletFrame* frame = do_QueryFrame(GetFrame())) {
+    if (!frame->StyleList()->mListStyleImage.IsNone()) {
+      // Bullet is an image, so use default bullet character.
+      const char16_t kDiscCharacter = 0x2022;
+      aName.Assign(kDiscCharacter);
+      aName.Append(' ');
+      return eNameOK;
+    }
+    frame->GetSpokenText(aName);
+  } else {
+    // If marker is not a bullet frame but instead has content
+    nsTextEquivUtils::AppendFromDOMChildren(mContent, &aName);
+    aName.CompressWhitespace();
+  }
+
  return eNameOK;
 }

--- a/accessible/tests/mochitest/common.js
+++ b/accessible/tests/mochitest/common.js
@ -96,7 +96,7 @@ const kEmbedChar = String.fromCharCode(0xfffc);
 const kDiscBulletChar = String.fromCharCode(0x2022);
 const kDiscBulletText = kDiscBulletChar + " ";
 const kCircleBulletText = String.fromCharCode(0x25e6) + " ";
-const kSquareBulletText = String.fromCharCode(0x25aa) + " ";
+const kSquareBulletText = String.fromCharCode(0x25fe) + " ";

 const MAX_TRIM_LENGTH = 100;

--- a/accessible/tests/mochitest/name/test_list.html
+++ b/accessible/tests/mochitest/name/test_list.html
@ -35,18 +35,7 @@
      this.finalCheck = function bulletUpdate_finalCheck() {
        testName("li_start", "1. list start");
        testName("li_end", "2. list end");
-      };

-      this.getID = function bulletUpdate_getID() {
-        return "insertBefore new list item";
-      };
-    }
-    function bulletUpdate2() {
-      this.eventSeq = [
-        new invokerChecker(EVENT_REORDER, getNode("li_end")),
-      ];
-
-      this.invoke = function bulletUpdate2_invoke() {
        // change list style type
        var list = getNode("list");
        list.setAttribute("style", "list-style-type: disc;");
@ -57,15 +46,13 @@
        // nsTextFrame::GetRenderedText to report the text of a text
        // frame is empty.
        list.offsetWidth; // flush layout (which also flushes style)
-      };

-      this.finalCheck = function bulletUpdate2_finalCheck() {
        testName("li_start", kDiscBulletText + "list start");
        testName("li_end", kDiscBulletText + "list end");
      };

-      this.getID = function bulletUpdate2_getID() {
-        return "Update list item style";
+      this.getID = function bulletUpdate_getID() {
+        return "Update bullet of list items";
      };
    }

@ -73,7 +60,6 @@
    function doTest() {
      gQueue = new eventQueue();
      gQueue.push(new bulletUpdate());
-      gQueue.push(new bulletUpdate2());
      gQueue.invoke(); // SimpleTest.finish();
    }

--- a/accessible/tests/mochitest/text/test_paragraphboundary.html
+++ b/accessible/tests/mochitest/text/test_paragraphboundary.html
@ -56,9 +56,7 @@
      [[0, 0, kEmbedChar, 0, 1],
      [1, 2, kEmbedChar, 1, 2]]);
      testTextAtOffset("li1", BOUNDARY_PARAGRAPH,
-      [[0, 0, "• ", 0, 2], [2, 3, "a", 2, 3]]);
-      testTextAtOffset("li2", BOUNDARY_PARAGRAPH,
-      [[0, 0, "• ", 0, 2], [2, 3, "a", 2, 3]]);
+      [[0, 3, "• a", 0, 3]]);

      // Test line breaks in a textarea.
      testTextAtOffset("textarea", BOUNDARY_PARAGRAPH,
@ -127,8 +125,6 @@
  <p id="pWithLink">a<a id="link" href="https://example.com/">bc</a>d</p>
  <p id="pWithLinkWithBr">a<a href="#">b<br>c</a>d</p>
  <ul id="ul"><li id="li1">a</li><li>b</li></ul>
-  <style>#li2::marker { content:'\2022\0020'; }</style>
-  <ul id="ul"><li id="li2">a</li><li>b</li></ul>
  <textarea id="textarea">a
 b

--- a/accessible/tests/mochitest/textattrs/test_general.html
+++ b/accessible/tests/mochitest/textattrs/test_general.html
@ -538,13 +538,9 @@

      attrs = {
        "auto-generated": "true",
-        "font-family": "-moz-bullet-font",
      };
-      testTextAttrs(ID, 0, attrs, defAttrs, 0, 2);
+      testTextAttrs(ID, 0, attrs, defAttrs, 0, 3);
      testTextAttrs(ID, 3, { }, defAttrs, 3, 7);
-      attrs = {
-        "auto-generated": "true",
-      };
      testTextAttrs(ID, 7, attrs, defAttrs, 7, 8);

       // ////////////////////////////////////////////////////////////////////////
--- a/accessible/tests/mochitest/tree/test_list.html
+++ b/accessible/tests/mochitest/tree/test_list.html
@ -190,7 +190,7 @@
            children: [
              { // ::marker content text and counter
                role: ROLE_LISTITEM_MARKER,
-                name: "foo1",
+                name: "foo 1",
              },
              {
                role: ROLE_TEXT_LEAF,
@ -203,7 +203,7 @@
            children: [
              { // ::marker content text and counter
                role: ROLE_LISTITEM_MARKER,
-                name: "foo2",
+                name: "foo 2",
              },
              {
                role: ROLE_TEXT_LEAF,
--- a/dom/base/GeneratedImageContent.cpp
+++ b/dom/base/GeneratedImageContent.cpp
@ -30,11 +30,6 @@ already_AddRefed<GeneratedImageContent> GeneratedImageContent::Create(
  return image.forget();
 }

-already_AddRefed<GeneratedImageContent>
-GeneratedImageContent::CreateForListStyleImage(Document& aDocument) {
-  return Create(aDocument, uint32_t(-1));
-}
-
 JSObject* GeneratedImageContent::WrapNode(JSContext* aCx,
                                          JS::Handle<JSObject*> aGivenProto) {
  return dom::HTMLElement_Binding::Wrap(aCx, this, aGivenProto);
--- a/dom/base/GeneratedImageContent.h
+++ b/dom/base/GeneratedImageContent.h
@ -23,9 +23,6 @@ class GeneratedImageContent final : public nsGenericHTMLElement {
 public:
  static already_AddRefed<GeneratedImageContent> Create(Document&,
                                                        uint32_t aContentIndex);
-  // An image created from 'list-style-image' for a ::marker pseudo.
-  static already_AddRefed<GeneratedImageContent> CreateForListStyleImage(
-      Document&);

  explicit GeneratedImageContent(already_AddRefed<dom::NodeInfo>&& aNodeInfo)
      : nsGenericHTMLElement(std::move(aNodeInfo)) {
@ -33,13 +30,6 @@ class GeneratedImageContent final : public nsGenericHTMLElement {
               "Someone messed up our nodeinfo");
  }

-  EventStates IntrinsicState() const override {
-    EventStates state = nsGenericHTMLElement::IntrinsicState();
-    if (mBroken) {
-      state |= NS_EVENT_STATE_BROKEN;
-    }
-    return state;
-  }
  nsresult Clone(dom::NodeInfo* aNodeInfo, nsINode** aResult) const final;

  nsresult CopyInnerTo(GeneratedImageContent* aDest) {
@ -49,25 +39,14 @@ class GeneratedImageContent final : public nsGenericHTMLElement {
    return NS_OK;
  }

-  // Is this an image created from 'list-style-image'?
-  bool IsForListStyleImageMarker() const { return Index() == uint32_t(-1); }
-
-  // @note we use -1 for images created from 'list-style-image'
  uint32_t Index() const { return mIndex; }

-  // Notify this image failed to load.
-  void NotifyLoadFailed() {
-    mBroken = true;
-    UpdateState(true);
-  }
-
 protected:
  JSObject* WrapNode(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) final;

 private:
  virtual ~GeneratedImageContent() = default;
  uint32_t mIndex = 0;
-  bool mBroken = false;
 };

 }  // namespace dom
--- a/dom/base/nsContentPolicyUtils.h
+++ b/dom/base/nsContentPolicyUtils.h
@ -143,7 +143,6 @@ inline const char* NS_CP_ContentTypeName(nsContentPolicyType contentType) {
    CASE_RETURN(TYPE_INTERNAL_CHROMEUTILS_COMPILED_SCRIPT);
    CASE_RETURN(TYPE_INTERNAL_FRAME_MESSAGEMANAGER_SCRIPT);
    CASE_RETURN(TYPE_INTERNAL_FETCH_PRELOAD);
-    CASE_RETURN(TYPE_UA_FONT);
    case nsIContentPolicy::TYPE_INVALID:
      break;
      // Do not add default: so that compilers can catch the missing case.
@ -191,8 +190,7 @@ inline const char* NS_CP_ContentTypeName(ExtContentPolicyType contentType) {
    if (NS_CP_REJECTED(*decision)) {                                           \
      return NS_OK;                                                            \
    }                                                                          \
-    if (contentType != nsIContentPolicy::TYPE_DOCUMENT &&                      \
-        contentType != nsIContentPolicy::TYPE_UA_FONT) {                       \
+    if (contentType != nsIContentPolicy::TYPE_DOCUMENT) {                      \
      *decision = nsIContentPolicy::ACCEPT;                                    \
      nsCOMPtr<nsINode> n = do_QueryInterface(context);                        \
      if (!n) {                                                                \
--- a/dom/base/nsDataDocumentContentPolicy.cpp
+++ b/dom/base/nsDataDocumentContentPolicy.cpp
@ -84,7 +84,6 @@ nsDataDocumentContentPolicy::ShouldLoad(nsIURI* aContentLocation,
        case ExtContentPolicy::TYPE_IMAGE:
        case ExtContentPolicy::TYPE_IMAGESET:
        case ExtContentPolicy::TYPE_FONT:
-        case ExtContentPolicy::TYPE_UA_FONT:
        // This one is a bit sketchy, but nsObjectLoadingContent takes care of
        // only getting here if it is an image.
        case ExtContentPolicy::TYPE_OBJECT:
--- a/dom/base/nsIContentPolicy.idl
+++ b/dom/base/nsIContentPolicy.idl
@ -413,12 +413,6 @@ interface nsIContentPolicy : nsISupports
     */
    TYPE_INTERNAL_FETCH_PRELOAD = 54,

-    /**
-     * Indicates a font loaded via @font-face rule in an UA style sheet.
-     * (CSP does not apply.)
-     */
-    TYPE_UA_FONT = 55,
-
    /* When adding new content types, please update
     * NS_CP_ContentTypeName, nsCSPContext, CSP_ContentTypeToDirective,
     * DoContentSecurityChecks, all nsIContentPolicy implementations, the
@ -575,7 +569,6 @@ enum class ExtContentPolicyType : uint8_t {
  TYPE_WEB_MANIFEST = nsIContentPolicy::TYPE_WEB_MANIFEST,
  TYPE_SAVEAS_DOWNLOAD = nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD,
  TYPE_SPECULATIVE = nsIContentPolicy::TYPE_SPECULATIVE,
-  TYPE_UA_FONT = nsIContentPolicy::TYPE_UA_FONT,
 };

 typedef ExtContentPolicyType ExtContentPolicy;
--- a/dom/cache/DBSchema.cpp
+++ b/dom/cache/DBSchema.cpp
@ -338,8 +338,7 @@ static_assert(
        nsIContentPolicy::TYPE_INTERNAL_FONT_PRELOAD == 51 &&
        nsIContentPolicy::TYPE_INTERNAL_CHROMEUTILS_COMPILED_SCRIPT == 52 &&
        nsIContentPolicy::TYPE_INTERNAL_FRAME_MESSAGEMANAGER_SCRIPT == 53 &&
-        nsIContentPolicy::TYPE_INTERNAL_FETCH_PRELOAD == 54 &&
-        nsIContentPolicy::TYPE_UA_FONT == 55,
+        nsIContentPolicy::TYPE_INTERNAL_FETCH_PRELOAD == 54,
    "nsContentPolicyType values are as expected");

 namespace {
--- a/dom/fetch/InternalRequest.cpp
+++ b/dom/fetch/InternalRequest.cpp
@ -245,7 +245,6 @@ RequestDestination InternalRequest::MapContentPolicyTypeToRequestDestination(
      return RequestDestination::_empty;
    case nsIContentPolicy::TYPE_FONT:
    case nsIContentPolicy::TYPE_INTERNAL_FONT_PRELOAD:
-    case nsIContentPolicy::TYPE_UA_FONT:
      return RequestDestination::Font;
    case nsIContentPolicy::TYPE_MEDIA:
      return RequestDestination::_empty;
--- a/dom/security/SecFetch.cpp
+++ b/dom/security/SecFetch.cpp
@ -75,7 +75,6 @@ nsCString MapInternalContentPolicyTypeToDest(nsContentPolicyType aType) {
      return "empty"_ns;
    case nsIContentPolicy::TYPE_FONT:
    case nsIContentPolicy::TYPE_INTERNAL_FONT_PRELOAD:
-    case nsIContentPolicy::TYPE_UA_FONT:
      return "font"_ns;
    case nsIContentPolicy::TYPE_MEDIA:
      return "empty"_ns;
--- a/dom/security/nsCSPUtils.cpp
+++ b/dom/security/nsCSPUtils.cpp
@ -339,7 +339,6 @@ CSPDirective CSP_ContentTypeToDirective(nsContentPolicyType aType) {
      return nsIContentSecurityPolicy::NO_DIRECTIVE;

    case nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD:
-    case nsIContentPolicy::TYPE_UA_FONT:
      return nsIContentSecurityPolicy::NO_DIRECTIVE;

    // Fall through to error for all other directives
--- a/dom/security/nsContentSecurityManager.cpp
+++ b/dom/security/nsContentSecurityManager.cpp
@ -529,8 +529,7 @@ static nsresult DoContentSecurityChecks(nsIChannel* aChannel,
      break;
    }

-    case ExtContentPolicy::TYPE_FONT:
-    case ExtContentPolicy::TYPE_UA_FONT: {
+    case ExtContentPolicy::TYPE_FONT: {
      mimeTypeGuess.Truncate();
      break;
    }
--- a/dom/security/nsHTTPSOnlyStreamListener.cpp
+++ b/dom/security/nsHTTPSOnlyStreamListener.cpp
@ -192,7 +192,6 @@ void nsHTTPSOnlyStreamListener::RecordUpgradeTelemetry(nsIRequest* request,
        break;

      case ExtContentPolicy::TYPE_FONT:
-      case ExtContentPolicy::TYPE_UA_FONT:
        typeKey = "font"_ns;
        break;

--- a/dom/security/nsMixedContentBlocker.cpp
+++ b/dom/security/nsMixedContentBlocker.cpp
@ -536,7 +536,6 @@ nsresult nsMixedContentBlocker::ShouldLoad(bool aHadInsecureImageRedirect,
    case ExtContentPolicy::TYPE_DTD:
    case ExtContentPolicy::TYPE_FETCH:
    case ExtContentPolicy::TYPE_FONT:
-    case ExtContentPolicy::TYPE_UA_FONT:
    case ExtContentPolicy::TYPE_IMAGESET:
    case ExtContentPolicy::TYPE_OBJECT:
    case ExtContentPolicy::TYPE_SCRIPT:
--- a/gfx/tests/reftest/reftest.list
+++ b/gfx/tests/reftest/reftest.list
@ -26,7 +26,6 @@ fuzzy-if(!useDrawSnapshot&&webrender,2-7,17500-36908) == 1523776.html 1523776-re
 == 1616444-same-color-different-paths.html 1616444-same-color-different-paths-ref.html
 skip-if(!asyncPan||!webrender||Android) fuzzy-if(winWidget,94-94,3415-3419) fuzzy-if(cocoaWidget,24-24,1190-1200) pref(apz.allow_zooming,true) == picture-caching-on-async-zoom.html picture-caching-on-async-zoom.html?ref
 pref(apz.allow_zooming,true) fails-if(useDrawSnapshot) == 1662062-1-no-blurry.html 1662062-1-ref.html
-# Bug 1715676: nsBulletFrame has been removed and the new rendering does not use PushRoundedRect that this test is for:
-# == 1681610.html 1681610-ref.html
+== 1681610.html 1681610-ref.html
 skip-if(!webrender||geckoview) fuzzy-if(!useDrawSnapshot&&webrender&&!geckoview,0-255,0-61) fuzzy-if(useDrawSnapshot&&webrender,0-215,0-3601) == 1687157-1.html 1687157-1-ref.html
 skip-if(!webrender) fuzzy-if(webrender,64-99,512-520) == 1696439-1.html 1696439-1-ref.html
--- a/layout/base/RestyleManager.cpp
+++ b/layout/base/RestyleManager.cpp
@ -37,6 +37,7 @@
 #include "Layers.h"
 #include "nsAnimationManager.h"
 #include "nsBlockFrame.h"
+#include "nsBulletFrame.h"
 #include "nsContentUtils.h"
 #include "nsCSSFrameConstructor.h"
 #include "nsCSSRendering.h"
@ -464,11 +465,7 @@ static bool StateChangeMayAffectFrame(const Element& aElement,
                                      const nsIFrame& aFrame,
                                      EventStates aStates) {
  if (aFrame.IsGeneratedContentFrame()) {
-    if (aElement.IsHTMLElement(nsGkAtoms::mozgeneratedcontentimage)) {
-      return aStates.HasState(NS_EVENT_STATE_BROKEN);
-    }
-
-    // If it's other generated content, ignore LOADING/etc state changes on it.
+    // If it's generated content, ignore LOADING/etc state changes on it.
    return false;
  }

@ -1964,7 +1961,7 @@ static const nsIFrame* ExpectedOwnerForChild(const nsIFrame* aFrame) {

  parent = FirstContinuationOrPartOfIBSplit(parent);

-  // We've handled already anon boxes, so now we're looking at
+  // We've handled already anon boxes and bullet frames, so now we're looking at
  // a frame of a DOM element or pseudo. Hop through anon and line-boxes
  // generated by our DOM parent, and go find the owner frame for it.
  while (parent && (IsAnonBox(parent) || parent->IsLineFrame())) {
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@ -268,8 +268,8 @@ nsIFrame* NS_NewScrollbarButtonFrame(PresShell* aPresShell,
                                     ComputedStyle* aStyle);

 nsIFrame* NS_NewImageFrameForContentProperty(PresShell*, ComputedStyle*);
+
 nsIFrame* NS_NewImageFrameForGeneratedContentIndex(PresShell*, ComputedStyle*);
-nsIFrame* NS_NewImageFrameForListStyleImage(PresShell*, ComputedStyle*);

 // Returns true if aFrame is an anonymous flex/grid item.
 static inline bool IsAnonymousFlexOrGridItem(const nsIFrame* aFrame) {
@ -1600,66 +1600,6 @@ already_AddRefed<nsIContent> nsCSSFrameConstructor::CreateGeneratedContent(
  return nullptr;
 }

-void nsCSSFrameConstructor::CreateGeneratedContentFromListStyle(
-    nsFrameConstructorState& aState, const ComputedStyle& aPseudoStyle,
-    const FunctionRef<void(nsIContent*)> aAddChild) {
-  const nsStyleList* styleList = aPseudoStyle.StyleList();
-  if (!styleList->mListStyleImage.IsNone()) {
-    RefPtr<nsIContent> child =
-        GeneratedImageContent::CreateForListStyleImage(*mDocument);
-    aAddChild(child);
-    child = CreateGenConTextNode(aState, u" "_ns, nullptr);
-    aAddChild(child);
-    return;
-  }
-  CreateGeneratedContentFromListStyleType(aState, aPseudoStyle, aAddChild);
-}
-
-void nsCSSFrameConstructor::CreateGeneratedContentFromListStyleType(
-    nsFrameConstructorState& aState, const ComputedStyle& aPseudoStyle,
-    const FunctionRef<void(nsIContent*)> aAddChild) {
-  const nsStyleList* styleList = aPseudoStyle.StyleList();
-  CounterStyle* counterStyle =
-      mPresShell->GetPresContext()->CounterStyleManager()->ResolveCounterStyle(
-          styleList->mCounterStyle);
-  bool needUseNode = false;
-  switch (counterStyle->GetStyle()) {
-    case NS_STYLE_LIST_STYLE_NONE:
-      return;
-    case NS_STYLE_LIST_STYLE_DISC:
-    case NS_STYLE_LIST_STYLE_CIRCLE:
-    case NS_STYLE_LIST_STYLE_SQUARE:
-    case NS_STYLE_LIST_STYLE_DISCLOSURE_CLOSED:
-    case NS_STYLE_LIST_STYLE_DISCLOSURE_OPEN:
-      break;
-    default:
-      const auto* anonStyle = counterStyle->AsAnonymous();
-      if (!anonStyle || !anonStyle->IsSingleString()) {
-        needUseNode = true;
-      }
-  }
-
-  auto node = MakeUnique<nsCounterUseNode>(nsCounterUseNode::ForLegacyBullet,
-                                           styleList->mCounterStyle);
-  if (!needUseNode) {
-    nsAutoString text;
-    node->GetText(WritingMode(&aPseudoStyle), counterStyle, text);
-    // Note that we're done with 'node' in this case.  It's not inserted into
-    // any list so it's deleted when we return.
-    RefPtr<nsIContent> child = CreateGenConTextNode(aState, text, nullptr);
-    aAddChild(child);
-    return;
-  }
-
-  nsCounterList* counterList =
-      mCounterManager.CounterListFor(nsGkAtoms::list_item);
-  auto initializer = MakeUnique<nsGenConInitializer>(
-      std::move(node), counterList, &nsCSSFrameConstructor::CountersDirty);
-  RefPtr<nsIContent> child =
-      CreateGenConTextNode(aState, EmptyString(), std::move(initializer));
-  aAddChild(child);
-}
-
 /*
 * aParentFrame - the frame that should be the parent of the generated
 *   content.  This is the frame for the corresponding content node,
@ -1720,10 +1660,8 @@ void nsCSSFrameConstructor::CreateGeneratedContentItem(
      MOZ_ASSERT_UNREACHABLE("unexpected aPseudoElement");
  }

-  // |ProbePseudoElementStyle| checked the 'display' property and the
-  // |ContentCount()| of the 'content' property for us, and for ::marker
-  // also that we have either a 'list-style-type' or 'list-style-image'
-  // non-initial value in case we have no 'content'.
+  // |ProbePseudoStyleFor| checked the 'display' property and the
+  // |ContentCount()| of the 'content' property for us.
  RefPtr<NodeInfo> nodeInfo = mDocument->NodeInfoManager()->GetNodeInfo(
      elemName, nullptr, kNameSpaceID_None, nsINode::ELEMENT_NODE);
  RefPtr<Element> container;
@ -1766,31 +1704,26 @@ void nsCSSFrameConstructor::CreateGeneratedContentItem(
    pseudoStyle = ServoStyleSet::ResolveServoStyle(*container);
  }

-  auto AppendChild = [&container, this](nsIContent* aChild) {
+  uint32_t contentCount = pseudoStyle->StyleContent()->ContentCount();
+  for (uint32_t contentIndex = 0; contentIndex < contentCount; contentIndex++) {
+    nsCOMPtr<nsIContent> content = CreateGeneratedContent(
+        aState, aOriginatingElement, *pseudoStyle, contentIndex);
+    if (!content) {
+      continue;
+    }
    // We don't strictly have to set NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE
    // here; it would get set under AppendChildTo.  But AppendChildTo might
    // think that we're going from not being anonymous to being anonymous and
    // do some extra work; setting the flag here avoids that.
-    aChild->SetFlags(NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE);
-    container->AppendChildTo(aChild, false, IgnoreErrors());
-    if (auto* childElement = Element::FromNode(aChild)) {
+    content->SetFlags(NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE);
+    container->AppendChildTo(content, false, IgnoreErrors());
+    if (auto* element = Element::FromNode(content)) {
      // If we created any children elements, Servo needs to traverse them, but
      // the root is already set up.
-      mPresShell->StyleSet()->StyleNewSubtree(childElement);
-    }
-  };
-  const uint32_t contentCount = pseudoStyle->StyleContent()->ContentCount();
-  for (uint32_t contentIndex = 0; contentIndex < contentCount; contentIndex++) {
-    if (RefPtr<nsIContent> content = CreateGeneratedContent(
-            aState, aOriginatingElement, *pseudoStyle, contentIndex)) {
-      AppendChild(content);
+      mPresShell->StyleSet()->StyleNewSubtree(element);
    }
  }

-  // If a ::marker has no 'content' then generate it from its 'list-style-*'.
-  if (contentCount == 0 && aPseudoElement == PseudoStyleType::marker) {
-    CreateGeneratedContentFromListStyle(aState, *pseudoStyle, AppendChild);
-  }
  AddFrameConstructionItemsInternal(aState, container, aParentFrame, true,
                                    pseudoStyle, {ItemFlag::IsGeneratedContent},
                                    aItems);
@ -3421,13 +3354,6 @@ nsCSSFrameConstructor::FindGeneratedImageData(const Element& aElement,
    return nullptr;
  }

-  auto& generatedContent = static_cast<const GeneratedImageContent&>(aElement);
-  if (generatedContent.IsForListStyleImageMarker()) {
-    static const FrameConstructionData sImgData =
-        SIMPLE_FCDATA(NS_NewImageFrameForListStyleImage);
-    return &sImgData;
-  }
-
  static const FrameConstructionData sImgData =
      SIMPLE_FCDATA(NS_NewImageFrameForGeneratedContentIndex);
  return &sImgData;
@ -3881,6 +3807,16 @@ void nsCSSFrameConstructor::ConstructFrameFromItemInternal(
    }
  }

+  if (computedStyle->GetPseudoType() == PseudoStyleType::marker &&
+      newFrame->IsBulletFrame()) {
+    MOZ_ASSERT(!computedStyle->StyleContent()->ContentCount());
+    auto* node = new nsCounterUseNode(nsCounterUseNode::ForLegacyBullet);
+    auto* list = mCounterManager.CounterListFor(nsGkAtoms::list_item);
+    if (node->InitBullet(list, newFrame)) {
+      CountersDirty();
+    }
+  }
+
  NS_ASSERTION(newFrame->IsFrameOfType(nsIFrame::eLineParticipant) ==
                   ((bits & FCDATA_IS_LINE_PARTICIPANT) != 0),
               "Incorrectly set FCDATA_IS_LINE_PARTICIPANT bits");
@ -5295,6 +5231,16 @@ nsCSSFrameConstructor::FindElementTagData(const Element& aElement,
                                          ComputedStyle& aStyle,
                                          nsIFrame* aParentFrame,
                                          ItemFlags aFlags) {
+  // A ::marker pseudo creates a nsBulletFrame, unless 'content' was set.
+  if (aStyle.GetPseudoType() == PseudoStyleType::marker &&
+      aStyle.StyleContent()->ContentCount() == 0) {
+    static const FrameConstructionData data = FCDATA_DECL(
+        FCDATA_DISALLOW_OUT_OF_FLOW | FCDATA_SKIP_ABSPOS_PUSH |
+            FCDATA_DISALLOW_GENERATED_CONTENT | FCDATA_IS_LINE_PARTICIPANT |
+            FCDATA_IS_INLINE | FCDATA_USE_CHILD_ITEMS,
+        NS_NewBulletFrame);
+    return &data;
+  }
  switch (aElement.GetNameSpaceID()) {
    case kNameSpaceID_XHTML:
      return FindHTMLData(aElement, aParentFrame, aStyle);
@ -7117,48 +7063,6 @@ void nsCSSFrameConstructor::ContentRangeInserted(nsIContent* aStartChild,
    }
  }

-  // This handles fallback to 'list-style-type' when a 'list-style-image' fails
-  // to load.
-  if (aStartChild->IsInNativeAnonymousSubtree() &&
-      aStartChild->IsHTMLElement(nsGkAtoms::mozgeneratedcontentimage)) {
-    MOZ_ASSERT(isSingleInsert);
-    MOZ_ASSERT(insertion.mParentFrame->Style()->GetPseudoType() ==
-                   PseudoStyleType::marker,
-               "we can only handle ::marker fallback for now");
-    nsIContent* const nextSibling = aStartChild->GetNextSibling();
-    MOZ_ASSERT(nextSibling && nextSibling->IsText(),
-               "expected a text node after the list-style-image image");
-    RemoveFrame(kPrincipalList, nextSibling->GetPrimaryFrame());
-    auto* const container = aStartChild->GetParent()->AsElement();
-    nsIContent* firstNewChild = nullptr;
-    auto InsertChild = [this, container, nextSibling,
-                        &firstNewChild](RefPtr<nsIContent>&& aChild) {
-      // We don't strictly have to set NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE
-      // here; it would get set under AppendChildTo.  But AppendChildTo might
-      // think that we're going from not being anonymous to being anonymous and
-      // do some extra work; setting the flag here avoids that.
-      aChild->SetFlags(NODE_IS_IN_NATIVE_ANONYMOUS_SUBTREE);
-      container->InsertChildBefore(aChild, nextSibling, false, IgnoreErrors());
-      if (auto* childElement = Element::FromNode(aChild)) {
-        // If we created any children elements, Servo needs to traverse them,
-        // but the root is already set up.
-        mPresShell->StyleSet()->StyleNewSubtree(childElement);
-      }
-      if (!firstNewChild) {
-        firstNewChild = aChild;
-      }
-    };
-    CreateGeneratedContentFromListStyleType(
-        state, *insertion.mParentFrame->Style(), InsertChild);
-    if (!firstNewChild) {
-      // No fallback content - we're done.
-      return;
-    }
-    aStartChild = firstNewChild;
-    MOZ_ASSERT(firstNewChild->GetNextSibling() == nextSibling,
-               "list-style-type should only create one child");
-  }
-
  AutoFrameConstructionItemList items(this);
  ParentType parentType = GetParentType(frameType);
  FlattenedChildIterator iter(insertion.mContainer);
@ -9671,13 +9575,6 @@ void nsCSSFrameConstructor::ProcessChildren(
          listItem->SetMarkerFrameForListItem(childFrame);
          MOZ_ASSERT(listItem->HasAnyStateBits(
                         NS_BLOCK_FRAME_HAS_OUTSIDE_MARKER) == isOutsideMarker);
-#ifdef ACCESSIBILITY
-          if (nsAccessibilityService* accService =
-                  PresShell::GetAccessibilityService()) {
-            auto* marker = markerFrame->GetContent();
-            accService->ContentRangeInserted(mPresShell, marker, nullptr);
-          }
-#endif
          break;
        }
      }
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@ -14,7 +14,6 @@

 #include "mozilla/ArenaAllocator.h"
 #include "mozilla/Attributes.h"
-#include "mozilla/FunctionRef.h"
 #include "mozilla/LinkedList.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/RestyleManager.h"
@ -334,10 +333,8 @@ class nsCSSFrameConstructor final : public nsFrameManager {

  void AddSizeOfIncludingThis(nsWindowSizes& aSizes) const;

-#ifdef ACCESSIBILITY
-  // Exposed only for nsLayoutUtils::GetMarkerSpokenText to use.
-  const nsCounterManager* CounterManager() const { return &mCounterManager; }
-#endif
+  // temporary - please don't add external uses outside of nsBulletFrame
+  nsCounterManager* CounterManager() { return &mCounterManager; }

 private:
  struct FrameConstructionItem;
@ -463,19 +460,6 @@ class nsCSSFrameConstructor final : public nsFrameManager {
      nsFrameConstructorState& aState, const Element& aOriginatingElement,
      ComputedStyle& aComputedStyle, uint32_t aContentIndex);

-  /**
-   * Create child content nodes for a ::marker from its 'list-style-*' values.
-   */
-  void CreateGeneratedContentFromListStyle(
-      nsFrameConstructorState& aState, const ComputedStyle& aPseudoStyle,
-      const mozilla::FunctionRef<void(nsIContent*)> aAddChild);
-  /**
-   * Create child content nodes for a ::marker from its 'list-style-type'.
-   */
-  void CreateGeneratedContentFromListStyleType(
-      nsFrameConstructorState& aState, const ComputedStyle& aPseudoStyle,
-      const mozilla::FunctionRef<void(nsIContent*)> aAddChild);
-
  // aParentFrame may be null; this method doesn't use it directly in any case.
  void CreateGeneratedContentItem(nsFrameConstructorState& aState,
                                  nsContainerFrame* aParentFrame,
--- a/layout/base/nsCounterManager.cpp
+++ b/layout/base/nsCounterManager.cpp
@ -13,6 +13,7 @@
 #include "mozilla/PresShell.h"
 #include "mozilla/StaticPrefs_layout.h"
 #include "mozilla/WritingModes.h"
+#include "nsBulletFrame.h"  // legacy location for list style type to text code
 #include "nsContentUtils.h"
 #include "nsIContent.h"
 #include "nsTArray.h"
@ -42,6 +43,13 @@ bool nsCounterUseNode::InitTextFrame(nsGenConList* aList,
  return false;
 }

+bool nsCounterUseNode::InitBullet(nsGenConList* aList, nsIFrame* aBullet) {
+  MOZ_ASSERT(aBullet->IsBulletFrame());
+  MOZ_ASSERT(aBullet->Style()->GetPseudoType() == PseudoStyleType::marker);
+  MOZ_ASSERT(mForLegacyBullet);
+  return InitTextFrame(aList, aBullet, nullptr);
+}
+
 // assign the correct |mValueAfter| value to a node that has been inserted
 // Should be called immediately after calling |Insert|.
 void nsCounterUseNode::Calc(nsCounterList* aList, bool aNotify) {
@ -51,6 +59,11 @@ void nsCounterUseNode::Calc(nsCounterList* aList, bool aNotify) {
    nsAutoString contentString;
    GetText(contentString);
    mText->SetText(contentString, aNotify);
+  } else if (mForLegacyBullet) {
+    MOZ_ASSERT_IF(mPseudoFrame, mPseudoFrame->IsBulletFrame());
+    if (nsBulletFrame* f = do_QueryFrame(mPseudoFrame)) {
+      f->SetOrdinal(mValueAfter, aNotify);
+    }
  }
 }

@ -69,34 +82,9 @@ void nsCounterChangeNode::Calc(nsCounterList* aList) {
  }
 }

+// The text that should be displayed for this counter.
 void nsCounterUseNode::GetText(nsString& aResult) {
-  CounterStyle* style =
-      mPseudoFrame->PresContext()->CounterStyleManager()->ResolveCounterStyle(
-          mCounterStyle);
-  GetText(mPseudoFrame->GetWritingMode(), style, aResult);
-}
-
-void nsCounterUseNode::GetText(WritingMode aWM, CounterStyle* aStyle,
-                               nsString& aResult) {
-  const bool isBidiRTL = aWM.IsBidiRTL();
-  auto AppendCounterText = [&aResult, isBidiRTL](const nsAutoString& aText,
-                                                 bool aIsRTL) {
-    if (MOZ_LIKELY(isBidiRTL == aIsRTL)) {
-      aResult.Append(aText);
-    } else {
-      // RLM = 0x200f, LRM = 0x200e
-      const char16_t mark = aIsRTL ? 0x200f : 0x200e;
-      aResult.Append(mark);
-      aResult.Append(aText);
-      aResult.Append(mark);
-    }
-  };
-
-  if (mForLegacyBullet) {
-    nsAutoString prefix;
-    aStyle->GetPrefix(prefix);
-    aResult.Assign(prefix);
-  }
+  aResult.Truncate();

  AutoTArray<nsCounterNode*, 8> stack;
  stack.AppendElement(static_cast<nsCounterNode*>(this));
@ -107,26 +95,21 @@ void nsCounterUseNode::GetText(WritingMode aWM, CounterStyle* aStyle,
    }
  }

-  for (nsCounterNode* n : Reversed(stack)) {
+  WritingMode wm = mPseudoFrame->GetWritingMode();
+  CounterStyle* style =
+      mPseudoFrame->PresContext()->CounterStyleManager()->ResolveCounterStyle(
+          mCounterStyle);
+  for (uint32_t i = stack.Length() - 1;; --i) {
+    nsCounterNode* n = stack[i];
    nsAutoString text;
    bool isTextRTL;
-    aStyle->GetCounterText(n->mValueAfter, aWM, text, isTextRTL);
-    if (!mForLegacyBullet || aStyle->IsBullet()) {
-      aResult.Append(text);
-    } else {
-      AppendCounterText(text, isTextRTL);
-    }
-    if (n == this) {
+    style->GetCounterText(n->mValueAfter, wm, text, isTextRTL);
+    aResult.Append(text);
+    if (i == 0) {
      break;
    }
    aResult.Append(mSeparator);
  }
-
-  if (mForLegacyBullet) {
-    nsAutoString suffix;
-    aStyle->GetSuffix(suffix);
-    aResult.Append(suffix);
-  }
 }

 void nsCounterList::SetScope(nsCounterNode* aNode) {
@ -357,41 +340,6 @@ bool nsCounterManager::DestroyNodesFor(nsIFrame* aFrame) {
  return destroyedAny;
 }

-#ifdef ACCESSIBILITY
-void nsCounterManager::GetSpokenCounterText(nsIFrame* aFrame,
-                                            nsAString& aText) const {
-  CounterValue ordinal = 1;
-  if (const auto* list = mNames.Get(nsGkAtoms::list_item)) {
-    for (nsCounterNode* n = list->GetFirstNodeFor(aFrame);
-         n && n->mPseudoFrame == aFrame; n = list->Next(n)) {
-      if (n->mType == nsCounterNode::USE) {
-        ordinal = n->mValueAfter;
-        break;
-      }
-    }
-  }
-  CounterStyle* counterStyle =
-      aFrame->PresContext()->CounterStyleManager()->ResolveCounterStyle(
-          aFrame->StyleList()->mCounterStyle);
-  nsAutoString text;
-  bool isBullet;
-  counterStyle->GetSpokenCounterText(ordinal, aFrame->GetWritingMode(), text,
-                                     isBullet);
-  if (isBullet) {
-    aText = text;
-    if (!counterStyle->IsNone()) {
-      aText.Append(' ');
-    }
-  } else {
-    counterStyle->GetPrefix(aText);
-    aText += text;
-    nsAutoString suffix;
-    counterStyle->GetSuffix(suffix);
-    aText += suffix;
-  }
-}
-#endif
-
 #ifdef DEBUG
 void nsCounterManager::Dump() {
  printf("\n\nCounter Manager Lists:\n");
--- a/layout/base/nsCounterManager.h
+++ b/layout/base/nsCounterManager.h
@ -62,7 +62,6 @@ struct nsCounterNode : public nsGenConNode {
  // 'counter-reset', 'counter-increment' or 'counter-set'  property
  // instead of within the 'content' property but offset to ensure
  // that (reset, increment, set, use) sort in that order.
-  // It is zero for legacy bullet USE counter nodes.
  // (This slight weirdness allows sharing a lot of code with 'quotes'.)
  nsCounterNode(int32_t aContentIndex, Type aType)
      : nsGenConNode(aContentIndex), mType(aType) {}
@ -84,10 +83,10 @@ struct nsCounterUseNode : public nsCounterNode {
  bool mForLegacyBullet = false;

  enum ForLegacyBullet { ForLegacyBullet };
-  nsCounterUseNode(enum ForLegacyBullet, mozilla::CounterStylePtr aCounterStyle)
-      : nsCounterNode(0, USE),
-        mCounterStyle(std::move(aCounterStyle)),
-        mForLegacyBullet(true) {}
+  explicit nsCounterUseNode(enum ForLegacyBullet)
+      : nsCounterNode(0, USE), mForLegacyBullet(true) {
+    mCounterStyle = nsGkAtoms::list_item;
+  }

  // args go directly to member variables here and of nsGenConNode
  nsCounterUseNode(mozilla::CounterStylePtr aCounterStyle, nsString aSeparator,
@ -99,8 +98,10 @@ struct nsCounterUseNode : public nsCounterNode {
    NS_ASSERTION(aContentIndex <= INT32_MAX, "out of range");
  }

-  bool InitTextFrame(nsGenConList* aList, nsIFrame* aPseudoFrame,
-                     nsIFrame* aTextFrame) override;
+  virtual bool InitTextFrame(nsGenConList* aList, nsIFrame* aPseudoFrame,
+                             nsIFrame* aTextFrame) override;
+
+  bool InitBullet(nsGenConList* aList, nsIFrame* aBulletFrame);

  // assign the correct |mValueAfter| value to a node that has been inserted,
  // and update the value of the text node, notifying if `aNotify` is true.
@ -109,8 +110,6 @@ struct nsCounterUseNode : public nsCounterNode {

  // The text that should be displayed for this counter.
  void GetText(nsString& aResult);
-  void GetText(mozilla::WritingMode aWM, mozilla::CounterStyle* aStyle,
-               nsString& aResult);
 };

 struct nsCounterChangeNode : public nsCounterNode {
@ -172,11 +171,6 @@ class nsCounterList : public nsGenConList {
 public:
  nsCounterList() : nsGenConList(), mDirty(false) {}

-  // Return the first node for aFrame on this list, or nullptr.
-  nsCounterNode* GetFirstNodeFor(nsIFrame* aFrame) const {
-    return static_cast<nsCounterNode*>(nsGenConList::GetFirstNodeFor(aFrame));
-  }
-
  void Insert(nsCounterNode* aNode) {
    nsGenConList::Insert(aNode);
    // Don't SetScope if we're dirty -- we'll reset all the scopes anyway,
@ -241,11 +235,6 @@ class nsCounterManager {
  // Clear all data.
  void Clear() { mNames.Clear(); }

-#ifdef ACCESSIBILITY
-  // Returns the spoken text for the 'list-item' counter for aFrame in aText.
-  void GetSpokenCounterText(nsIFrame* aFrame, nsAString& aText) const;
-#endif
-
 #ifdef DEBUG
  void Dump();
 #endif
--- a/layout/base/nsGenConList.h
+++ b/layout/base/nsGenConList.h
@ -34,6 +34,7 @@ struct nsGenConNode : public mozilla::LinkedListElement<nsGenConNode> {
  // null for:
  //  * content: no-open-quote / content: no-close-quote
  //  * counter nodes for increments and resets
+  //  * counter nodes for bullets (mPseudoFrame->IsBulletFrame()).
  RefPtr<nsTextNode> mText;

  explicit nsGenConNode(int32_t aContentIndex)
@ -64,9 +65,12 @@ struct nsGenConNode : public mozilla::LinkedListElement<nsGenConNode> {
  void CheckFrameAssertions() {
    NS_ASSERTION(
        mContentIndex < int32_t(mPseudoFrame->StyleContent()->ContentCount()) ||
-            // Special-case for the USE node created for the legacy markers,
+            // Special-case for the use node created for the legacy markers,
            // which don't use the content property.
-            mContentIndex == 0,
+            (mPseudoFrame->IsBulletFrame() && mContentIndex == 0 &&
+             mPseudoFrame->Style()->GetPseudoType() ==
+                 mozilla::PseudoStyleType::marker &&
+             !mPseudoFrame->StyleContent()->ContentCount()),
        "index out of range");
    // We allow negative values of mContentIndex for 'counter-reset' and
    // 'counter-increment'.
@ -108,11 +112,6 @@ class nsGenConList {
  // have been destroyed; otherwise false.
  bool DestroyNodesFor(nsIFrame* aFrame);

-  // Return the first node for aFrame on this list, or nullptr.
-  nsGenConNode* GetFirstNodeFor(nsIFrame* aFrame) const {
-    return mNodes.Get(aFrame);
-  }
-
  // Return true if |aNode1| is after |aNode2|.
  static bool NodeAfter(const nsGenConNode* aNode1, const nsGenConNode* aNode2);

--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@ -893,40 +893,6 @@ nsIFrame* nsLayoutUtils::GetMarkerFrame(const nsIContent* aContent) {
  return pseudo ? pseudo->GetPrimaryFrame() : nullptr;
 }

-#ifdef ACCESSIBILITY
-void nsLayoutUtils::GetMarkerSpokenText(const nsIContent* aContent,
-                                        nsAString& aText) {
-  MOZ_ASSERT(aContent && aContent->IsGeneratedContentContainerForMarker());
-
-  aText.Truncate();
-
-  nsIFrame* frame = aContent->GetPrimaryFrame();
-  if (!frame) {
-    return;
-  }
-
-  if (frame->StyleContent()->ContentCount() > 0) {
-    for (nsIFrame* child : frame->PrincipalChildList()) {
-      nsIFrame::RenderedText text = child->GetRenderedText();
-      aText += text.mString;
-    }
-    return;
-  }
-
-  if (!frame->StyleList()->mListStyleImage.IsNone()) {
-    // ::marker is an image, so use default bullet character.
-    static const char16_t kDiscMarkerString[] = {0x2022, ' ', 0};
-    aText.AssignLiteral(kDiscMarkerString);
-    return;
-  }
-
-  frame->PresContext()
-      ->FrameConstructor()
-      ->CounterManager()
-      ->GetSpokenCounterText(frame, aText);
-}
-#endif
-
 // static
 nsIFrame* nsLayoutUtils::GetClosestFrameOfType(nsIFrame* aFrame,
                                               LayoutFrameType aFrameType,
--- a/layout/base/nsLayoutUtils.h
+++ b/layout/base/nsLayoutUtils.h
@ -273,14 +273,6 @@ class nsLayoutUtils {
   */
  static nsIFrame* GetMarkerFrame(const nsIContent* aContent);

-#ifdef ACCESSIBILITY
-  /**
-   * Set aText to the spoken text for the given ::marker content (aContent)
-   * if it has a frame, or the empty string otherwise.
-   */
-  static void GetMarkerSpokenText(const nsIContent* aContent, nsAString& aText);
-#endif
-
  /**
   * Given a frame, search up the frame tree until we find an
   * ancestor that (or the frame itself) is of type aFrameType, if any.
--- a/layout/generic/FrameClasses.py
+++ b/layout/generic/FrameClasses.py
@ -13,6 +13,7 @@ FRAME_CLASSES = [
    Frame("nsBlockFrame", "Block", NOT_LEAF),
    Frame("nsBox", "None", NOT_LEAF),
    Frame("nsBoxFrame", "Box", NOT_LEAF),
+    Frame("nsBulletFrame", "Bullet", LEAF),
    Frame("nsButtonBoxFrame", "Box", NOT_LEAF),
    Frame("nsCanvasFrame", "Canvas", NOT_LEAF),
    Frame("nsCheckboxRadioFrame", "CheckboxRadio", LEAF),
--- a/layout/generic/moz.build
+++ b/layout/generic/moz.build
@ -31,6 +31,9 @@ with Files("BRFrame.*"):
 with Files("WBRFrame.*"):
    BUG_COMPONENT = ("Core", "Layout: Block and Inline")

+with Files("nsBulletFrame.*"):
+    BUG_COMPONENT = ("Core", "Layout: Block and Inline")
+
 with Files("nsFirstLetterFrame.*"):
    BUG_COMPONENT = ("Core", "Layout: Block and Inline")

@ -170,6 +173,7 @@ UNIFIED_SOURCES += [
    "nsBackdropFrame.cpp",
    "nsBlockFrame.cpp",
    "nsBlockReflowContext.cpp",
+    "nsBulletFrame.cpp",
    "nsCanvasFrame.cpp",
    "nsColumnSetFrame.cpp",
    "nsContainerFrame.cpp",
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@ -7395,11 +7395,6 @@ void nsBlockFrame::SetMarkerFrameForListItem(nsIFrame* aMarkerFrame) {
    SetProperty(InsideMarkerProperty(), aMarkerFrame);
    AddStateBits(NS_BLOCK_FRAME_HAS_INSIDE_MARKER);
  } else {
-    if (nsBlockFrame* marker = do_QueryFrame(aMarkerFrame)) {
-      // An outside ::marker needs to be an independent formatting context
-      // to avoid being influenced by the float manager etc.
-      marker->AddStateBits(NS_BLOCK_FORMATTING_CONTEXT_STATE_BITS);
-    }
    SetProperty(OutsideMarkerProperty(),
                new (PresShell()) nsFrameList(aMarkerFrame, aMarkerFrame));
    AddStateBits(NS_BLOCK_FRAME_HAS_OUTSIDE_MARKER);
--- a/layout/generic/nsBulletFrame.cpp
+++ b/layout/generic/nsBulletFrame.cpp
--- a/layout/generic/nsBulletFrame.h
+++ b/layout/generic/nsBulletFrame.h
@ -0,0 +1,121 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* rendering object for list-item bullets */
+
+#ifndef nsBulletFrame_h___
+#define nsBulletFrame_h___
+
+#include "mozilla/Attributes.h"
+#include "nsIFrame.h"
+
+class imgIContainer;
+class nsBulletFrame;
+class nsFontMetrics;
+class BulletRenderer;
+class nsFontMetrics;
+
+/**
+ * A simple class that manages the layout and rendering of html bullets.
+ * This class also supports the CSS list-style properties.
+ */
+class nsBulletFrame final : public nsIFrame {
+  typedef mozilla::image::ImgDrawResult ImgDrawResult;
+
+ public:
+  NS_DECL_FRAMEARENA_HELPERS(nsBulletFrame)
+#ifdef DEBUG
+  NS_DECL_QUERYFRAME
+#endif
+
+  explicit nsBulletFrame(ComputedStyle* aStyle, nsPresContext* aPresContext)
+      : nsIFrame(aStyle, aPresContext, kClassID), mPadding(GetWritingMode()) {}
+
+  virtual ~nsBulletFrame();
+
+  // nsIFrame
+  void BuildDisplayList(nsDisplayListBuilder*,
+                        const nsDisplayListSet&) override;
+  void DidSetComputedStyle(ComputedStyle* aOldStyle) override;
+#ifdef DEBUG_FRAME_DUMP
+  nsresult GetFrameName(nsAString& aResult) const override;
+#endif
+
+  void Reflow(nsPresContext* aPresContext, ReflowOutput& aMetrics,
+              const ReflowInput&, nsReflowStatus&) override;
+  nscoord GetMinISize(gfxContext*) override;
+  nscoord GetPrefISize(gfxContext*) override;
+  void AddInlineMinISize(gfxContext*, nsIFrame::InlineMinISizeData*) override;
+  void AddInlinePrefISize(gfxContext*, nsIFrame::InlinePrefISizeData*) override;
+
+  bool IsFrameOfType(uint32_t aFlags) const override {
+    if (aFlags & (eSupportsCSSTransforms | eSupportsContainLayoutAndPaint)) {
+      return false;
+    }
+    return nsIFrame::IsFrameOfType(aFlags & ~nsIFrame::eLineParticipant);
+  }
+
+  // nsBulletFrame
+
+  /* get list item text, with prefix & suffix */
+  static void GetListItemText(mozilla::CounterStyle*, mozilla::WritingMode,
+                              int32_t aOrdinal, nsAString& aResult);
+
+#ifdef ACCESSIBILITY
+  void GetSpokenText(nsAString& aText);
+#endif
+
+  Maybe<BulletRenderer> CreateBulletRenderer(gfxContext& aRenderingContext,
+                                             nsDisplayListBuilder* aBuilder,
+                                             nsPoint aPt,
+                                             ImgDrawResult* aOutDrawResult);
+  ImgDrawResult PaintBullet(gfxContext& aRenderingContext,
+                            nsDisplayListBuilder* aBuilder, nsPoint aPt,
+                            const nsRect& aDirtyRect, bool aDisableSubpixelAA);
+
+  bool IsEmpty() override;
+  bool IsSelfEmpty() override;
+
+  // XXXmats note that this method returns a non-standard baseline that includes
+  // the ::marker block-start margin.  New code should probably use
+  // GetNaturalBaselineBOffset instead, which returns a normal baseline offset
+  // as documented in nsIFrame.h.
+  nscoord GetLogicalBaseline(mozilla::WritingMode aWritingMode) const override;
+
+  bool GetNaturalBaselineBOffset(mozilla::WritingMode aWM,
+                                 BaselineSharingGroup aBaselineGroup,
+                                 nscoord* aBaseline) const override;
+
+  float GetFontSizeInflation() const;
+  bool HasFontSizeInflation() const {
+    return HasAnyStateBits(BULLET_FRAME_HAS_FONT_INFLATION);
+  }
+  void SetFontSizeInflation(float aInflation);
+
+  int32_t Ordinal() const { return mOrdinal; }
+  void SetOrdinal(int32_t aOrdinal, bool aNotify);
+
+  already_AddRefed<imgIContainer> GetImage() const;
+
+ protected:
+  void AppendSpacingToPadding(nsFontMetrics* aFontMetrics,
+                              mozilla::LogicalMargin* aPadding);
+  void GetDesiredSize(nsPresContext* aPresContext,
+                      gfxContext* aRenderingContext, ReflowOutput& aMetrics,
+                      float aFontSizeInflation,
+                      mozilla::LogicalMargin* aPadding);
+
+  mozilla::LogicalMargin mPadding;
+
+ private:
+  mozilla::CounterStyle* ResolveCounterStyle();
+  nscoord GetListStyleAscent() const;
+
+  // Requires being set via SetOrdinal.
+  int32_t mOrdinal = 0;
+};
+
+#endif /* nsBulletFrame_h___ */
--- a/layout/generic/nsContainerFrame.cpp
+++ b/layout/generic/nsContainerFrame.cpp
@ -36,6 +36,7 @@
 #include "nsBoxLayoutState.h"
 #include "nsCSSFrameConstructor.h"
 #include "nsBlockFrame.h"
+#include "nsBulletFrame.h"
 #include "nsPlaceholderFrame.h"
 #include "mozilla/AutoRestore.h"
 #include "nsIFrameInlines.h"
--- a/layout/generic/nsFrameState.cpp
+++ b/layout/generic/nsFrameState.cpp
@ -10,6 +10,7 @@

 #include "nsBlockFrame.h"
 #include "nsBoxFrame.h"
+#include "nsBulletFrame.h"
 #include "nsFlexContainerFrame.h"
 #include "nsGridContainerFrame.h"
 #include "nsGfxScrollFrame.h"
--- a/layout/generic/nsFrameStateBits.h
+++ b/layout/generic/nsFrameStateBits.h
@ -606,6 +606,13 @@ FRAME_STATE_BIT(Block, 62, NS_BLOCK_FRAME_INTRINSICS_INFLATED)
 // bit is not set. This bit is set on the first continuation only.
 FRAME_STATE_BIT(Block, 63, NS_BLOCK_HAS_FIRST_LETTER_CHILD)

+// == Frame state bits that apply to bullet frames ============================
+
+FRAME_STATE_GROUP(Bullet, nsBulletFrame)
+
+FRAME_STATE_BIT(Bullet, 62, BULLET_FRAME_HAS_FONT_INFLATION)
+FRAME_STATE_BIT(Bullet, 63, BULLET_FRAME_IMAGE_LOADING)
+
 // == Frame state bits that apply to image frames =============================

 FRAME_STATE_GROUP(Image, nsImageFrame)
--- a/layout/generic/nsHTMLParts.h
+++ b/layout/generic/nsHTMLParts.h
@ -159,6 +159,8 @@ nsIFrame* NS_NewSearchControlFrame(mozilla::PresShell* aPresShell,
                                   mozilla::ComputedStyle* aStyle);
 nsBlockFrame* NS_NewDetailsFrame(mozilla::PresShell* aPresShell,
                                 mozilla::ComputedStyle* aStyle);
+nsIFrame* NS_NewBulletFrame(mozilla::PresShell* aPresShell,
+                            mozilla::ComputedStyle* aStyle);

 // Table frame factories
 class nsTableWrapperFrame;
--- a/layout/generic/nsIFrame.cpp
+++ b/layout/generic/nsIFrame.cpp
@ -586,6 +586,8 @@ static bool IsFontSizeInflationContainer(nsIFrame* aFrame,
                   aFrame->IsBrFrame() ||
                   aFrame->IsFrameOfType(nsIFrame::eMathML),
               "line participants must not be containers");
+  NS_ASSERTION(!aFrame->IsBulletFrame() || isInline,
+               "bullets should not be containers");
  return !isInline;
 }

@ -12111,6 +12113,7 @@ DR_FrameTypeInfo* DR_State::GetFrameTypeInfo(char* aFrameName) {
 void DR_State::InitFrameTypeTable() {
  AddFrameTypeInfo(LayoutFrameType::Block, "block", "block");
  AddFrameTypeInfo(LayoutFrameType::Br, "br", "br");
+  AddFrameTypeInfo(LayoutFrameType::Bullet, "bullet", "bullet");
  AddFrameTypeInfo(LayoutFrameType::ColorControl, "color", "colorControl");
  AddFrameTypeInfo(LayoutFrameType::GfxButtonControl, "button",
                   "gfxButtonControl");
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@ -39,7 +39,6 @@
 #include "nsFontMetrics.h"
 #include "nsIImageLoadingContent.h"
 #include "nsImageLoadingContent.h"
-#include "nsImageRenderer.h"
 #include "nsString.h"
 #include "nsPrintfCString.h"
 #include "nsPresContext.h"
@ -99,89 +98,6 @@ using namespace mozilla::layers;

 using mozilla::layout::TextDrawTarget;

-class nsDisplayGradient final : public nsPaintedDisplayItem {
- public:
-  nsDisplayGradient(nsDisplayListBuilder* aBuilder, nsImageFrame* aFrame)
-      : nsPaintedDisplayItem(aBuilder, aFrame) {
-    MOZ_COUNT_CTOR(nsDisplayGradient);
-  }
-  ~nsDisplayGradient() final { MOZ_COUNT_DTOR(nsDisplayGradient); }
-
-  nsDisplayItemGeometry* AllocateGeometry(
-      nsDisplayListBuilder* aBuilder) final {
-    return new nsDisplayItemGenericImageGeometry(this, aBuilder);
-  }
-
-  nsRect GetBounds(bool* aSnap) const {
-    *aSnap = true;
-
-    auto* imageFrame = static_cast<nsImageFrame*>(mFrame);
-    return imageFrame->GetInnerArea() + ToReferenceFrame();
-  }
-
-  nsRect GetBounds(nsDisplayListBuilder*, bool* aSnap) const final {
-    return GetBounds(aSnap);
-  }
-
-  void Paint(nsDisplayListBuilder*, gfxContext* aCtx) final;
-
-  bool CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&,
-                               mozilla::wr::IpcResourceUpdateQueue&,
-                               const StackingContextHelper&,
-                               mozilla::layers::RenderRootStateManager*,
-                               nsDisplayListBuilder*) final;
-
-  NS_DISPLAY_DECL_NAME("Gradient", TYPE_GRADIENT)
-};
-
-void nsDisplayGradient::Paint(nsDisplayListBuilder* aBuilder,
-                              gfxContext* aCtx) {
-  auto* frame = static_cast<nsImageFrame*>(Frame());
-  nsImageRenderer imageRenderer(frame, frame->GetImageFromStyle(),
-                                aBuilder->GetImageRendererFlags());
-  nsSize size = frame->GetSize();
-  imageRenderer.SetPreferredSize({}, size);
-
-  ImgDrawResult result;
-  if (!imageRenderer.PrepareImage()) {
-    result = imageRenderer.PrepareResult();
-  } else {
-    nsRect dest(ToReferenceFrame(), size);
-    result = imageRenderer.DrawLayer(frame->PresContext(), *aCtx, dest, dest,
-                                     dest.TopLeft(), GetPaintRect(),
-                                     dest.Size(), /* aOpacity = */ 1.0f);
-  }
-  nsDisplayItemGenericImageGeometry::UpdateDrawResult(this, result);
-}
-
-bool nsDisplayGradient::CreateWebRenderCommands(
-    wr::DisplayListBuilder& aBuilder, wr::IpcResourceUpdateQueue& aResources,
-    const StackingContextHelper& aSc,
-    mozilla::layers::RenderRootStateManager* aManager,
-    nsDisplayListBuilder* aDisplayListBuilder) {
-  auto* frame = static_cast<nsImageFrame*>(Frame());
-  nsImageRenderer imageRenderer(frame, frame->GetImageFromStyle(),
-                                aDisplayListBuilder->GetImageRendererFlags());
-  nsSize size = frame->GetSize();
-  imageRenderer.SetPreferredSize({}, size);
-
-  ImgDrawResult result;
-  if (!imageRenderer.PrepareImage()) {
-    result = imageRenderer.PrepareResult();
-  } else {
-    nsRect dest(ToReferenceFrame(), size);
-    result = imageRenderer.BuildWebRenderDisplayItemsForLayer(
-        frame->PresContext(), aBuilder, aResources, aSc, aManager, this, dest,
-        dest, dest.TopLeft(), dest, dest.Size(),
-        /* aOpacity = */ 1.0f);
-    if (result == ImgDrawResult::NOT_SUPPORTED) {
-      return false;
-    }
-  }
-  nsDisplayItemGenericImageGeometry::UpdateDrawResult(this, result);
-  return true;
-}
-
 // sizes (pixels) for image icon, padding and border frame
 #define ICON_SIZE (16)
 #define ICON_PADDING (3)
@ -262,12 +178,6 @@ nsIFrame* NS_NewImageFrameForGeneratedContentIndex(PresShell* aPresShell,
                   nsImageFrame::Kind::ContentPropertyAtIndex);
 }

-nsIFrame* NS_NewImageFrameForListStyleImage(PresShell* aPresShell,
-                                            ComputedStyle* aStyle) {
-  return new (aPresShell) nsImageFrame(aStyle, aPresShell->GetPresContext(),
-                                       nsImageFrame::Kind::ListStyleImage);
-}
-
 bool nsImageFrame::ShouldShowBrokenImageIcon() const {
  // NOTE(emilio, https://github.com/w3c/csswg-drafts/issues/2832): WebKit and
  // Blink behave differently here for content: url(..), for now adapt to
@ -331,11 +241,6 @@ NS_QUERYFRAME_TAIL_INHERITING(nsAtomicContainerFrame)

 #ifdef ACCESSIBILITY
 a11y::AccType nsImageFrame::AccessibleType() {
-  if (mKind == Kind::ListStyleImage) {
-    // This is an HTMLListBulletAccessible.
-    return a11y::eNoType;
-  }
-
  // Don't use GetImageMap() to avoid reentrancy into accessibility.
  if (HasImageMap()) {
    return a11y::eHTMLImageMapType;
@ -422,12 +327,6 @@ void nsImageFrame::DidSetComputedStyle(ComputedStyle* aOldStyle) {

  MaybeRecordContentUrlOnImageTelemetry();

-  // A ::marker's default size is calculated from the font's em-size.
-  if (IsForMarkerPseudo()) {
-    mIntrinsicSize = IntrinsicSize(0, 0);
-    UpdateIntrinsicSize();
-  }
-
  auto newOrientation = StyleVisibility()->mImageOrientation;

  // We need to update our orientation either if we had no ComputedStyle before
@ -462,15 +361,8 @@ static bool SizeIsAvailable(imgIRequest* aRequest) {

 const StyleImage* nsImageFrame::GetImageFromStyle() const {
  if (mKind == Kind::ImageElement) {
-    MOZ_ASSERT_UNREACHABLE("Don't call me");
    return nullptr;
  }
-  if (mKind == Kind::ListStyleImage) {
-    MOZ_ASSERT(
-        GetParent()->GetContent()->IsGeneratedContentContainerForMarker());
-    MOZ_ASSERT(mContent->IsHTMLElement(nsGkAtoms::mozgeneratedcontentimage));
-    return &StyleList()->mListStyleImage;
-  }
  uint32_t contentIndex = 0;
  const nsStyleContent* styleContent = StyleContent();
  if (mKind == Kind::ContentPropertyAtIndex) {
@ -522,14 +414,12 @@ void nsImageFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
    imageLoader->FrameCreated(this);
  } else {
    const StyleImage* image = GetImageFromStyle();
-    MOZ_ASSERT(mKind == Kind::ListStyleImage || image->IsImageRequestType(),
+    MOZ_ASSERT(image->IsImageRequestType(),
               "Content image should only parse url() type");
-    if (image->IsImageRequestType()) {
-      if (imgRequestProxy* proxy = image->GetImageRequest()) {
-        proxy->Clone(mListener, PresContext()->Document(),
-                     getter_AddRefs(mContentURLRequest));
-        SetupForContentURLRequest();
-      }
+    Document* doc = PresContext()->Document();
+    if (imgRequestProxy* proxy = image->GetImageRequest()) {
+      proxy->Clone(mListener, doc, getter_AddRefs(mContentURLRequest));
+      SetupForContentURLRequest();
    }
  }

@ -601,22 +491,6 @@ static void ScaleIntrinsicSizeForDensity(imgIContainer* aImage,
  ScaleIntrinsicSizeForDensity(aSize, resolution);
 }

-static nscoord ListImageDefaultLength(const nsImageFrame& aFrame) {
-  // https://drafts.csswg.org/css-lists-3/#image-markers
-  // The spec says we should use 1em x 1em, but that seems too large.
-  // See disussion in https://github.com/w3c/csswg-drafts/issues/4207
-  auto* pc = aFrame.PresContext();
-  RefPtr<nsFontMetrics> fm =
-      nsLayoutUtils::GetFontMetricsForComputedStyle(aFrame.Style(), pc);
-  auto emAU = fm->GetThebesFontGroup()
-                  ->GetFirstValidFont()
-                  ->GetMetrics(fm->Orientation())
-                  .emHeight *
-              pc->AppUnitsPerDevPixel();
-  return std::max(NSToCoordRound(0.4f * emAU),
-                  nsPresContext::CSSPixelsToAppUnits(1));
-}
-
 static IntrinsicSize ComputeIntrinsicSize(imgIContainer* aImage,
                                          bool aUseMappedRatio,
                                          nsImageFrame::Kind aKind,
@ -631,17 +505,6 @@ static IntrinsicSize ComputeIntrinsicSize(imgIContainer* aImage,
    IntrinsicSize intrinsicSize;
    intrinsicSize.width = size.width == -1 ? Nothing() : Some(size.width);
    intrinsicSize.height = size.height == -1 ? Nothing() : Some(size.height);
-    if (aKind == nsImageFrame::Kind::ListStyleImage) {
-      if (intrinsicSize.width.isNothing() || intrinsicSize.height.isNothing()) {
-        nscoord defaultLength = ListImageDefaultLength(aFrame);
-        if (intrinsicSize.width.isNothing()) {
-          intrinsicSize.width = Some(defaultLength);
-        }
-        if (intrinsicSize.height.isNothing()) {
-          intrinsicSize.height = Some(defaultLength);
-        }
-      }
-    }
    if (aKind == nsImageFrame::Kind::ImageElement) {
      ScaleIntrinsicSizeForDensity(aImage, *aFrame.GetContent(), intrinsicSize);
    } else {
@ -651,12 +514,6 @@ static IntrinsicSize ComputeIntrinsicSize(imgIContainer* aImage,
    return intrinsicSize;
  }

-  if (aKind == nsImageFrame::Kind::ListStyleImage) {
-    // Note: images are handled above, this handles gradients etc.
-    nscoord defaultLength = ListImageDefaultLength(aFrame);
-    return IntrinsicSize(defaultLength, defaultLength);
-  }
-
  if (aFrame.ShouldShowBrokenImageIcon()) {
    nscoord edgeLengthToUse = nsPresContext::CSSPixelsToAppUnits(
        ICON_SIZE + (2 * (ICON_PADDING + ALT_BORDER_WIDTH)));
@ -923,13 +780,6 @@ void nsImageFrame::UpdateImage(imgIRequest* aRequest, imgIContainer* aImage) {
  } else {
    // We no longer have a valid image, so release our stored image container.
    mImage = mPrevImage = nullptr;
-    if (mKind == Kind::ListStyleImage) {
-      auto* genContent = static_cast<GeneratedImageContent*>(GetContent());
-      genContent->NotifyLoadFailed();
-      // No need to continue below since the above state change will destroy
-      // this frame.
-      return;
-    }
  }
  // NOTE(emilio): Intentionally using `|` instead of `||` to avoid
  // short-circuiting.
@ -946,10 +796,8 @@ void nsImageFrame::UpdateImage(imgIRequest* aRequest, imgIContainer* aImage) {
    // already gotten the initial reflow.
    if (!(mState & IMAGE_SIZECONSTRAINED)) {
 #ifdef ACCESSIBILITY
-      if (mKind != Kind::ListStyleImage) {
-        if (nsAccessibilityService* accService = GetAccService()) {
-          accService->NotifyOfImageSizeAvailable(PresShell(), mContent);
-        }
+      if (nsAccessibilityService* accService = GetAccService()) {
+        accService->NotifyOfImageSizeAvailable(PresShell(), mContent);
      }
 #endif
      PresShell()->FrameNeedsReflow(this, IntrinsicDirty::StyleChange,
@ -1107,14 +955,6 @@ nsRect nsImageFrame::PredictedDestRect(const nsRect& aFrameContentBox) {
                                              mIntrinsicRatio, StylePosition());
 }

-bool nsImageFrame::IsForMarkerPseudo() const {
-  if (mKind == Kind::ImageElement) {
-    return false;
-  }
-  auto* subtreeRoot = GetContent()->GetClosestNativeAnonymousSubtreeRoot();
-  return subtreeRoot && subtreeRoot->IsGeneratedContentContainerForMarker();
-}
-
 void nsImageFrame::EnsureIntrinsicSizeAndRatio() {
  if (StyleDisplay()->IsContainSize()) {
    // If we have 'contain:size', then our intrinsic size and ratio are 0,0
@ -1125,9 +965,8 @@ void nsImageFrame::EnsureIntrinsicSizeAndRatio() {
  }

  // If mIntrinsicSize.width and height are 0, then we need to update from the
-  // image container.  Note that we handle ::marker intrinsic size/ratio in
-  // DidSetComputedStyle.
-  if (mIntrinsicSize != IntrinsicSize(0, 0) && !IsForMarkerPseudo()) {
+  // image container.
+  if (mIntrinsicSize != IntrinsicSize(0, 0)) {
    return;
  }

@ -2349,9 +2188,7 @@ void nsImageFrame::BuildDisplayList(nsDisplayListBuilder* aBuilder,
    // XXX(seth): The SizeIsAvailable check here should not be necessary - the
    // intention is that a non-null mImage means we have a size, but there is
    // currently some code that violates this invariant.
-    if ((mKind == Kind::ImageElement ||
-         GetImageFromStyle()->IsImageRequestType()) &&
-        (!imageOK || !mImage || !SizeIsAvailable(currentRequest))) {
+    if (!imageOK || !mImage || !SizeIsAvailable(currentRequest)) {
      // No image yet, or image load failed. Draw the alt-text and an icon
      // indicating the status
      aLists.Content()->AppendNewToTop<nsDisplayAltFeedback>(aBuilder, this);
@ -2371,12 +2208,8 @@ void nsImageFrame::BuildDisplayList(nsDisplayListBuilder* aBuilder,
        }
      }
    } else {
-      if (mImage) {
-        aLists.Content()->AppendNewToTop<nsDisplayImage>(aBuilder, this, mImage,
-                                                         mPrevImage);
-      } else if (mKind != Kind::ImageElement) {
-        aLists.Content()->AppendNewToTop<nsDisplayGradient>(aBuilder, this);
-      }
+      aLists.Content()->AppendNewToTop<nsDisplayImage>(aBuilder, this, mImage,
+                                                       mPrevImage);

      // If we were previously displaying an icon, we're not anymore
      if (mDisplayingIcon) {
--- a/layout/generic/nsImageFrame.h
+++ b/layout/generic/nsImageFrame.h
@ -187,8 +187,6 @@ class nsImageFrame : public nsAtomicContainerFrame, public nsIReflowCallback {
    // For a child of a ::before / ::after pseudo-element that had an url() item
    // for the content property.
    ContentPropertyAtIndex,
-    // For a list-style-image ::marker.
-    ListStyleImage,
  };

  // Creates a suitable continuing frame for this frame.
@ -201,8 +199,6 @@ class nsImageFrame : public nsAtomicContainerFrame, public nsIReflowCallback {
                                                      ComputedStyle*);
  friend nsIFrame* NS_NewImageFrameForGeneratedContentIndex(mozilla::PresShell*,
                                                            ComputedStyle*);
-  friend nsIFrame* NS_NewImageFrameForListStyleImage(mozilla::PresShell*,
-                                                     ComputedStyle*);

  nsImageFrame(ComputedStyle* aStyle, nsPresContext* aPresContext, Kind aKind)
      : nsImageFrame(aStyle, aPresContext, kClassID, aKind) {}
@ -264,11 +260,6 @@ class nsImageFrame : public nsAtomicContainerFrame, public nsIReflowCallback {
   */
  void MaybeDecodeForPredictedSize();

-  /**
-   * Is this frame part of a ::marker pseudo?
-   */
-  bool IsForMarkerPseudo() const;
-
 protected:
  friend class nsImageListener;
  friend class nsImageLoadingContent;
@ -362,7 +353,7 @@ class nsImageFrame : public nsAtomicContainerFrame, public nsIReflowCallback {

  RefPtr<nsImageListener> mListener;

-  // An image request created for content: url(..) or list-style-image.
+  // An image request created for content: url(..).
  RefPtr<imgRequestProxy> mContentURLRequest;

  nsCOMPtr<imgIContainer> mImage;
@ -435,7 +426,6 @@ class nsImageFrame : public nsAtomicContainerFrame, public nsIReflowCallback {
  static mozilla::StaticRefPtr<IconLoad> gIconLoad;

  friend class nsDisplayImage;
-  friend class nsDisplayGradient;
 };

 /**
--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@ -5027,15 +5027,6 @@ void nsTextFrame::GetTextDecorations(
      break;
    }

-    if (context->GetPseudoType() == PseudoStyleType::marker &&
-        (context->StyleList()->mListStylePosition ==
-             NS_STYLE_LIST_STYLE_POSITION_OUTSIDE ||
-         !context->StyleDisplay()->IsInlineOutsideStyle())) {
-      // Outside ::marker pseudos, and inside markers that aren't inlines, don't
-      // have text decorations.
-      break;
-    }
-
    const nsStyleTextReset* const styleTextReset = context->StyleTextReset();
    const StyleTextDecorationLine textDecorations =
        styleTextReset->mTextDecorationLine;
--- a/layout/painting/nsDisplayItemTypesList.h
+++ b/layout/painting/nsDisplayItemTypesList.h
@ -18,6 +18,7 @@ DECLARE_DISPLAY_ITEM_TYPE(BLEND_MODE,
 DECLARE_DISPLAY_ITEM_TYPE(BORDER, 0)
 DECLARE_DISPLAY_ITEM_TYPE(BOX_SHADOW_INNER, TYPE_RENDERS_NO_IMAGES)
 DECLARE_DISPLAY_ITEM_TYPE(BOX_SHADOW_OUTER, TYPE_RENDERS_NO_IMAGES)
+DECLARE_DISPLAY_ITEM_TYPE(BULLET, TYPE_IS_CONTENTFUL)
 DECLARE_DISPLAY_ITEM_TYPE(BUTTON_BORDER_BACKGROUND, TYPE_IS_CONTENTFUL)
 DECLARE_DISPLAY_ITEM_TYPE(BUTTON_BOX_SHADOW_OUTER,
                          TYPE_RENDERS_NO_IMAGES | TYPE_IS_CONTENTFUL)
@ -47,7 +48,6 @@ DECLARE_DISPLAY_ITEM_TYPE(FOREIGN_OBJECT,
 DECLARE_DISPLAY_ITEM_TYPE(FRAMESET_BLANK, TYPE_RENDERS_NO_IMAGES)
 DECLARE_DISPLAY_ITEM_TYPE(FRAMESET_BORDER, TYPE_RENDERS_NO_IMAGES)
 DECLARE_DISPLAY_ITEM_TYPE(GENERIC, TYPE_RENDERS_NO_IMAGES)
-DECLARE_DISPLAY_ITEM_TYPE(GRADIENT, TYPE_IS_CONTENTFUL)
 DECLARE_DISPLAY_ITEM_TYPE(HEADER_FOOTER, TYPE_RENDERS_NO_IMAGES)
 DECLARE_DISPLAY_ITEM_TYPE(IMAGE, TYPE_IS_CONTENTFUL)
 DECLARE_DISPLAY_ITEM_TYPE(LINK, TYPE_RENDERS_NO_IMAGES)
--- a/layout/reftests/bugs/413840-ltr-offsets-ref.html
+++ b/layout/reftests/bugs/413840-ltr-offsets-ref.html
@ -10,7 +10,6 @@

 	ul, ol, li { margin: 0; padding: 0; }

-	::marker { font-family: inherit; }
 	</style>
 </head>
 <body>
--- a/layout/reftests/bugs/413840-ltr-offsets.html
+++ b/layout/reftests/bugs/413840-ltr-offsets.html
@ -12,7 +12,6 @@

 	ul, ol, li { margin: 0; padding: 0; }

-	::marker { font-family: inherit; }
 	</style>
 </head>
 <body>
--- a/layout/reftests/bugs/413840-rtl-offsets-ref.html
+++ b/layout/reftests/bugs/413840-rtl-offsets-ref.html
@ -11,7 +11,6 @@
 	body { direction: rtl; }
 	ul, ol, li { margin: 0; padding: 0; }

-	::marker { font-family: inherit; }
 	</style>
 </head>
 <body>
--- a/layout/reftests/bugs/413840-rtl-offsets.html
+++ b/layout/reftests/bugs/413840-rtl-offsets.html
@ -13,7 +13,6 @@

 	ul, ol, li { margin: 0; padding: 0; }

-	::marker { font-family: inherit; }
 	</style>
 </head>
 <body>
--- a/layout/reftests/bugs/428810-1-ltr-ref.html
+++ b/layout/reftests/bugs/428810-1-ltr-ref.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 20px"></div>
 <div style="margin-left: 40px; display: list-item;">
--- a/layout/reftests/bugs/428810-1a-ltr.html
+++ b/layout/reftests/bugs/428810-1a-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-1b-ltr.html
+++ b/layout/reftests/bugs/428810-1b-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-1c-ltr-insets.html
+++ b/layout/reftests/bugs/428810-1c-ltr-insets.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: left; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-1c-ltr.html
+++ b/layout/reftests/bugs/428810-1c-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-1c-rtl-insets.html
+++ b/layout/reftests/bugs/428810-1c-rtl-insets.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: right; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-1c-rtl.html
+++ b/layout/reftests/bugs/428810-1c-rtl.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: right; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-1d-ltr-insets.html
+++ b/layout/reftests/bugs/428810-1d-ltr-insets.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: left; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-1d-ltr.html
+++ b/layout/reftests/bugs/428810-1d-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-1d-rtl-insets.html
+++ b/layout/reftests/bugs/428810-1d-rtl-insets.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: right; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-1d-rtl.html
+++ b/layout/reftests/bugs/428810-1d-rtl.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: right; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-2-ltr-ref.html
+++ b/layout/reftests/bugs/428810-2-ltr-ref.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 20px"></div>
 <div style="margin-left: 40px; display: list-item;">
--- a/layout/reftests/bugs/428810-2a-ltr.html
+++ b/layout/reftests/bugs/428810-2a-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-2b-ltr.html
+++ b/layout/reftests/bugs/428810-2b-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-2e-ltr-insets.html
+++ b/layout/reftests/bugs/428810-2e-ltr-insets.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: left; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-2e-ltr.html
+++ b/layout/reftests/bugs/428810-2e-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-2e-rtl-insets.html
+++ b/layout/reftests/bugs/428810-2e-rtl-insets.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: right; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-2e-rtl.html
+++ b/layout/reftests/bugs/428810-2e-rtl.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: right; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-2f-ltr-insets.html
+++ b/layout/reftests/bugs/428810-2f-ltr-insets.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: left; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-2f-ltr.html
+++ b/layout/reftests/bugs/428810-2f-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-2f-rtl-insets.html
+++ b/layout/reftests/bugs/428810-2f-rtl-insets.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: right; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-2f-rtl.html
+++ b/layout/reftests/bugs/428810-2f-rtl.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: right; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-3-ltr-ref.html
+++ b/layout/reftests/bugs/428810-3-ltr-ref.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 40px"></div>
 <div style="margin-left: 40px; display: list-item;">
--- a/layout/reftests/bugs/428810-3a-ltr.html
+++ b/layout/reftests/bugs/428810-3a-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-3b-ltr.html
+++ b/layout/reftests/bugs/428810-3b-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-3e-ltr-insets.html
+++ b/layout/reftests/bugs/428810-3e-ltr-insets.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: left; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-3e-ltr.html
+++ b/layout/reftests/bugs/428810-3e-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-3e-rtl-insets.html
+++ b/layout/reftests/bugs/428810-3e-rtl-insets.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: right; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-3e-rtl.html
+++ b/layout/reftests/bugs/428810-3e-rtl.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: right; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-3f-ltr-insets.html
+++ b/layout/reftests/bugs/428810-3f-ltr-insets.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: left; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-3f-ltr.html
+++ b/layout/reftests/bugs/428810-3f-ltr.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: left; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-3f-rtl-insets.html
+++ b/layout/reftests/bugs/428810-3f-rtl-insets.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 6px">
  <div style="float: right; height: 20px; width: 116px"></div>
--- a/layout/reftests/bugs/428810-3f-rtl.html
+++ b/layout/reftests/bugs/428810-3f-rtl.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px">
  <div style="float: right; height: 20px; width: 100px"></div>
--- a/layout/reftests/bugs/428810-empty-ltr-insets-ref.html
+++ b/layout/reftests/bugs/428810-empty-ltr-insets-ref.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 13px"></div>
 <div style="margin-left: 92px; display: list-item;">
--- a/layout/reftests/bugs/428810-empty-ltr-ref.html
+++ b/layout/reftests/bugs/428810-empty-ltr-ref.html
@ -2,7 +2,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px"></div>
 <div style="margin-left: 100px; display: list-item;">
--- a/layout/reftests/bugs/428810-empty-rtl-insets-ref.html
+++ b/layout/reftests/bugs/428810-empty-rtl-insets-ref.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 13px"></div>
 <div style="margin-right: 92px; display: list-item;">
--- a/layout/reftests/bugs/428810-empty-rtl-ref.html
+++ b/layout/reftests/bugs/428810-empty-rtl-ref.html
@ -3,7 +3,6 @@
 <title>Testcase, bug 428810</title>
 <style type="text/css">
 html, body { margin: 0; padding: 0; }
-::marker { font-family: inherit; }
 </style>
 <div style="height: 10px"></div>
 <div style="margin-right: 100px; display: list-item;">
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@ -1043,66 +1043,66 @@ fuzzy-if(skiaContent,0-1,0-60) == 427370-1.html 427370-1-ref.html
 == 428810-1a-ltr.html 428810-1-ltr-ref.html
 == 428810-1b-ltr.html 428810-1-ltr-ref.html
 == 428810-1c-ltr.html 428810-empty-ltr-ref.html
-== 428810-1d-ltr.html 428810-empty-ltr-ref.html
+fails == 428810-1d-ltr.html 428810-empty-ltr-ref.html # bug 179596
 != 428810-1-ltr-ref.html about:blank
 == 428810-2a-ltr.html 428810-2-ltr-ref.html
 == 428810-2b-ltr.html 428810-2-ltr-ref.html
-== 428810-2e-ltr.html 428810-empty-ltr-ref.html
+fails == 428810-2e-ltr.html 428810-empty-ltr-ref.html # bug 179596
 == 428810-2f-ltr.html 428810-empty-ltr-ref.html
 != 428810-2-ltr-ref.html about:blank
 == 428810-3a-ltr.html 428810-3-ltr-ref.html
 == 428810-3b-ltr.html 428810-3-ltr-ref.html
-== 428810-3e-ltr.html 428810-empty-ltr-ref.html
+fails == 428810-3e-ltr.html 428810-empty-ltr-ref.html # bug 179596
 == 428810-3f-ltr.html 428810-empty-ltr-ref.html
 != 428810-3-ltr-ref.html about:blank
 == 428810-1a-rtl.html 428810-1-rtl-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-1b-rtl.html 428810-1-rtl-ref.html # bug 179596
+== 428810-1b-rtl.html 428810-1-rtl-ref.html
 == 428810-1c-rtl.html 428810-empty-rtl-ref.html
-== 428810-1d-rtl.html 428810-empty-rtl-ref.html
+fails == 428810-1d-rtl.html 428810-empty-rtl-ref.html # bug 179596
 != 428810-1-rtl-ref.html about:blank
 != 428810-1-rtl-ref.html 428810-1-ltr-ref.html
 == 428810-2a-rtl.html 428810-2-rtl-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-2b-rtl.html 428810-2-rtl-ref.html # bug 179596
-== 428810-2e-rtl.html 428810-empty-rtl-ref.html
+== 428810-2b-rtl.html 428810-2-rtl-ref.html
+fails == 428810-2e-rtl.html 428810-empty-rtl-ref.html # bug 179596
 == 428810-2f-rtl.html 428810-empty-rtl-ref.html
 != 428810-2-rtl-ref.html about:blank
 != 428810-2-rtl-ref.html 428810-2-ltr-ref.html
 == 428810-3a-rtl.html 428810-3-rtl-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-3b-rtl.html 428810-3-rtl-ref.html # bug 179596
-== 428810-3e-rtl.html 428810-empty-rtl-ref.html
+== 428810-3b-rtl.html 428810-3-rtl-ref.html
+fails == 428810-3e-rtl.html 428810-empty-rtl-ref.html # bug 179596
 == 428810-3f-rtl.html 428810-empty-rtl-ref.html
 != 428810-3-rtl-ref.html about:blank
 != 428810-3-rtl-ref.html 428810-3-ltr-ref.html
 == 428810-1a-ltr-insets.html 428810-1-ltr-insets-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-1b-ltr-insets.html 428810-1-ltr-insets-ref.html # bug 179596
+== 428810-1b-ltr-insets.html 428810-1-ltr-insets-ref.html
 == 428810-1c-ltr-insets.html 428810-empty-ltr-insets-ref.html
-== 428810-1d-ltr-insets.html 428810-empty-ltr-insets-ref.html
+fails == 428810-1d-ltr-insets.html 428810-empty-ltr-insets-ref.html # bug 179596
 != 428810-1-ltr-insets-ref.html about:blank
 == 428810-2a-ltr-insets.html 428810-2-ltr-insets-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-2b-ltr-insets.html 428810-2-ltr-insets-ref.html # bug 179596
-== 428810-2e-ltr-insets.html 428810-empty-ltr-insets-ref.html
+== 428810-2b-ltr-insets.html 428810-2-ltr-insets-ref.html
+fails == 428810-2e-ltr-insets.html 428810-empty-ltr-insets-ref.html # bug 179596
 == 428810-2f-ltr-insets.html 428810-empty-ltr-insets-ref.html
 != 428810-2-ltr-insets-ref.html about:blank
 == 428810-3a-ltr-insets.html 428810-3-ltr-insets-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-3b-ltr-insets.html 428810-3-ltr-insets-ref.html # bug 179596
-== 428810-3e-ltr-insets.html 428810-empty-ltr-insets-ref.html
+== 428810-3b-ltr-insets.html 428810-3-ltr-insets-ref.html
+fails == 428810-3e-ltr-insets.html 428810-empty-ltr-insets-ref.html # bug 179596
 == 428810-3f-ltr-insets.html 428810-empty-ltr-insets-ref.html
 != 428810-3-ltr-insets-ref.html about:blank
 == 428810-1a-rtl-insets.html 428810-1-rtl-insets-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-1b-rtl-insets.html 428810-1-rtl-insets-ref.html # bug 179596
+== 428810-1b-rtl-insets.html 428810-1-rtl-insets-ref.html
 == 428810-1c-rtl-insets.html 428810-empty-rtl-insets-ref.html
-== 428810-1d-rtl-insets.html 428810-empty-rtl-insets-ref.html
+fails == 428810-1d-rtl-insets.html 428810-empty-rtl-insets-ref.html # bug 179596
 != 428810-1-rtl-insets-ref.html about:blank
 != 428810-1-rtl-insets-ref.html 428810-1-ltr-insets-ref.html
 == 428810-2a-rtl-insets.html 428810-2-rtl-insets-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-2b-rtl-insets.html 428810-2-rtl-insets-ref.html # bug 179596
-== 428810-2e-rtl-insets.html 428810-empty-rtl-insets-ref.html
+== 428810-2b-rtl-insets.html 428810-2-rtl-insets-ref.html
+fails == 428810-2e-rtl-insets.html 428810-empty-rtl-insets-ref.html # bug 179596
 == 428810-2f-rtl-insets.html 428810-empty-rtl-insets-ref.html
 != 428810-2-rtl-insets-ref.html about:blank
 != 428810-2-rtl-insets-ref.html 428810-2-ltr-insets-ref.html
 == 428810-3a-rtl-insets.html 428810-3-rtl-insets-ref.html
-fails-if(winWidget||cocoaWidget) == 428810-3b-rtl-insets.html 428810-3-rtl-insets-ref.html # bug 179596
-== 428810-3e-rtl-insets.html 428810-empty-rtl-insets-ref.html
+== 428810-3b-rtl-insets.html 428810-3-rtl-insets-ref.html
+fails == 428810-3e-rtl-insets.html 428810-empty-rtl-insets-ref.html # bug 179596
 == 428810-3f-rtl-insets.html 428810-empty-rtl-insets-ref.html
 != 428810-3-rtl-insets-ref.html about:blank
 != 428810-3-rtl-insets-ref.html 428810-3-ltr-insets-ref.html
--- a/layout/reftests/counters/counter-reset-integer-range-ref.html
+++ b/layout/reftests/counters/counter-reset-integer-range-ref.html
@ -5,3 +5,5 @@
 2147483647
 2147483647
 -2147483647
+0
+0
--- a/layout/reftests/counters/counter-reset-integer-range.html
+++ b/layout/reftests/counters/counter-reset-integer-range.html
@ -11,7 +11,5 @@ span::after { content: counter(c); }
 <span style="counter-reset: c 2147483649"></span>
 <span style="counter-reset: c -2147483647"></span>
 <!-- The next two computes to std::numeric_limits<int32_t>::min() which we use as the "magic" number for the content based <ol reversed> start value.  See https://drafts.csswg.org/css-lists-3/#ua-stylesheet -->
-<!-- TODO: bug 1706346
 <span style="counter-reset: c -2147483648"></span>
 <span style="counter-reset: c -2147483649"></span>
-->
--- a/layout/reftests/counters/reftest.list
+++ b/layout/reftests/counters/reftest.list
@ -67,7 +67,7 @@ random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counters-hebrew-test.htm
 == counter-ua-limits-list-00.html counter-ua-limits-list-00-ref.html
 == counter-ua-limits-list-01.html counter-ua-limits-list-01-ref.html
 == multiple-thai-counters.html multiple-thai-counters-ref.html
-random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-suffix.html counter-suffix-ref.html # Bug 1392106
+fuzzy-if(webrender&&cocoaWidget,76-76,5-5) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-suffix.html counter-suffix-ref.html # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-cjk-decimal.html counter-cjk-decimal-ref.html # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-japanese-informal.html counter-japanese-informal-ref.html # Bug 1392106
 random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-japanese-formal.html counter-japanese-formal-ref.html # Bug 1392106
--- a/layout/reftests/counters/t1202-counter-04-b-reference.html
+++ b/layout/reftests/counters/t1202-counter-04-b-reference.html
@ -10,18 +10,18 @@
 <body>

 <div>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
-   <span>&#x25AA;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
+   <span>&#x25FE;</span>
 </div>

 </body>
--- a/layout/reftests/counters/t1202-counters-04-b-reference.html
+++ b/layout/reftests/counters/t1202-counters-04-b-reference.html
@ -11,18 +11,18 @@
 <p></p>

 <div>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
-   <span>&#x25AA;.&#x25AA;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
+   <span>&#x25FE;.&#x25FE;</span>
 </div>

 </body>
--- a/layout/reftests/list-item/bullet-space-1-ref.html
+++ b/layout/reftests/list-item/bullet-space-1-ref.html
@ -24,17 +24,18 @@
  .L {
    width:40px;
    text-align:right;
-    white-space: pre;
  }
  .R {
    width:40px;
    text-align:left;
-    white-space: pre;
  }
  .bullet {
    background:yellow;
+    padding:0 2px;
+  }
+  .spacer {
+    width:calc(0.5em - 2px);
  }
-  ::marker { font-family:inherit; }
 </style>
 </head>

@ -61,11 +62,11 @@
     should match. -->
 <div class="outer">
 <div>
- <span class="L"><span class="bullet">&#x2022;</span> </span>foo
+ <span class="L"><span class="bullet">&#x2022;</span><span class="spacer"></span></span>foo
 </div>

 <div dir="rtl">
- <span class="R"><span class="bullet">&#x2022;</span> </span>bar
+ <span class="R"><span class="bullet">&#x2022;</span><span class="spacer"></span></span>bar
 </div>
 </div>

--- a/layout/reftests/list-item/bullet-space-1.html
+++ b/layout/reftests/list-item/bullet-space-1.html
@ -24,17 +24,18 @@
  .L {
    width:40px;
    text-align:right;
-    white-space: pre;
  }
  .R {
    width:40px;
    text-align:left;
-    white-space: pre;
  }
  .bullet {
    background:yellow;
+    padding:0 2px;
+  }
+  .spacer {
+    width:calc(0.5em - 2px);
  }
-  ::marker { font-family:inherit; }
 </style>
 </head>

@ -61,11 +62,11 @@
     should match. -->
 <div class="outer">
 <div>
- <span class="L"><span class="bullet">&#x2022;</span> </span>foo
+ <span class="L"><span class="bullet">&#x2022;</span><span class="spacer"></span></span>foo
 </div>

 <div dir="rtl">
- <span class="R"><span class="bullet">&#x2022;</span> </span>bar
+ <span class="R"><span class="bullet">&#x2022;</span><span class="spacer"></span></span>bar
 </div>
 </div>

--- a/layout/reftests/list-item/bullet-space-2-ref.html
+++ b/layout/reftests/list-item/bullet-space-2-ref.html
@ -20,18 +20,20 @@
    width:40px;
    text-align:left;
  }
-  .L,.R { white-space:pre; }
+  .spacer {
+    width:0.5em;
+  }
 </style>
 </head>

 <body>

 <div>
- <span class="L"><span><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAQMAAAAlPW0iAAAABlBMVEUAAAD///+l2Z/dAAAAM0lEQVR4nGP4/5/h/1+G/58ZDrAz3D/McH8yw83NDDeNGe4Ug9C9zwz3gVLMDA/A6P9/AFGGFyjOXZtQAAAAAElFTkSuQmCC"> </span></span>foo
+ <span class="L"><span><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAQMAAAAlPW0iAAAABlBMVEUAAAD///+l2Z/dAAAAM0lEQVR4nGP4/5/h/1+G/58ZDrAz3D/McH8yw83NDDeNGe4Ug9C9zwz3gVLMDA/A6P9/AFGGFyjOXZtQAAAAAElFTkSuQmCC"></span><span class="spacer"></span></span>foo
 </div>

 <div dir="rtl">
- <span class="R"><span><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAQMAAAAlPW0iAAAABlBMVEUAAAD///+l2Z/dAAAAM0lEQVR4nGP4/5/h/1+G/58ZDrAz3D/McH8yw83NDDeNGe4Ug9C9zwz3gVLMDA/A6P9/AFGGFyjOXZtQAAAAAElFTkSuQmCC"> </span></span>bar
+ <span class="R"><span><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAQMAAAAlPW0iAAAABlBMVEUAAAD///+l2Z/dAAAAM0lEQVR4nGP4/5/h/1+G/58ZDrAz3D/McH8yw83NDDeNGe4Ug9C9zwz3gVLMDA/A6P9/AFGGFyjOXZtQAAAAAElFTkSuQmCC"></span><span class="spacer"></span></span>bar
 </div>

 </body>
--- a/layout/reftests/list-item/bullet-space-2.html
+++ b/layout/reftests/list-item/bullet-space-2.html
@ -11,10 +11,8 @@
  }
  ul {
    margin:0;
-    list-style-type: none; /* to ensure we use the same font metrics as the reference for the trailing space */
    list-style-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAQMAAAAlPW0iAAAABlBMVEUAAAD///+l2Z/dAAAAM0lEQVR4nGP4/5/h/1+G/58ZDrAz3D/McH8yw83NDDeNGe4Ug9C9zwz3gVLMDA/A6P9/AFGGFyjOXZtQAAAAAElFTkSuQmCC");
  }
-  ::marker { font-family: inherit; }
 </style>
 </head>

--- a/layout/reftests/list-item/numbering-1.html
+++ b/layout/reftests/list-item/numbering-1.html
@ -2,10 +2,6 @@
 <html><head>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
    <title>Testcase #1 for bug 614969</title>
-    <style>
-      .col {column-width:1em}
-      .col::marker {white-space:initial}
-    </style>
 </head>
 <body>

@ -20,9 +16,9 @@
 </ol>

 <ol style="list-style: decimal inside;">
-    <li class="col">item1</li>
-    <li class="col">item2</li>
-    <li class="col">item3</li>
+    <li style="column-width:1em;">item1</li>
+    <li style="column-width:1em;">item2</li>
+    <li style="column-width:1em;">item3</li>
 </ol>

 </body>
--- a/layout/style/CounterStyleManager.cpp
+++ b/layout/style/CounterStyleManager.cpp
@ -585,7 +585,7 @@ void BuiltinCounterStyle::GetSuffix(nsAString& aResult) {

 static const char16_t kDiscCharacter = 0x2022;
 static const char16_t kCircleCharacter = 0x25e6;
-static const char16_t kSquareCharacter = 0x25aa;
+static const char16_t kSquareCharacter = 0x25fe;
 static const char16_t kRightPointingCharacter = 0x25b8;
 static const char16_t kLeftPointingCharacter = 0x25c2;
 static const char16_t kDownPointingCharacter = 0x25be;
--- a/layout/style/FontFaceSet.cpp
+++ b/layout/style/FontFaceSet.cpp
@ -518,11 +518,7 @@ FontFace* FontFaceSet::GetFontFaceAt(uint32_t aIndex) {
  FlushUserFontSet();

  if (aIndex < mRuleFaces.Length()) {
-    auto& entry = mRuleFaces[aIndex];
-    if (entry.mOrigin.value() != StyleOrigin::Author) {
-      return nullptr;
-    }
-    return entry.mFontFace;
+    return mRuleFaces[aIndex].mFontFace;
  }

  aIndex -= mRuleFaces.Length();
@ -538,20 +534,6 @@ uint32_t FontFaceSet::Size() {

  // Web IDL objects can only expose array index properties up to INT32_MAX.

-  size_t total = mNonRuleFaces.Length();
-  for (const auto& entry : mRuleFaces) {
-    if (entry.mOrigin.value() == StyleOrigin::Author) {
-      ++total;
-    }
-  }
-  return std::min<size_t>(total, INT32_MAX);
-}
-
-uint32_t FontFaceSet::SizeIncludingNonAuthorOrigins() {
-  FlushUserFontSet();
-
-  // Web IDL objects can only expose array index properties up to INT32_MAX.
-
  size_t total = mRuleFaces.Length() + mNonRuleFaces.Length();
  return std::min<size_t>(total, INT32_MAX);
 }
@ -569,13 +551,8 @@ already_AddRefed<FontFaceSetIterator> FontFaceSet::Values() {
 void FontFaceSet::ForEach(JSContext* aCx, FontFaceSetForEachCallback& aCallback,
                          JS::Handle<JS::Value> aThisArg, ErrorResult& aRv) {
  JS::Rooted<JS::Value> thisArg(aCx, aThisArg);
-  for (size_t i = 0; i < SizeIncludingNonAuthorOrigins(); i++) {
+  for (size_t i = 0; i < Size(); i++) {
    RefPtr<FontFace> face = GetFontFaceAt(i);
-    if (!face) {
-      // The font at index |i| is a non-Author origin font, which we shouldn't
-      // expose per spec.
-      continue;
-    }
    aCallback.Call(thisArg, *face, *face, *this, aRv);
    if (aRv.Failed()) {
      return;
@ -1344,10 +1321,6 @@ bool FontFaceSet::IsFontLoadAllowed(const gfxFontFaceSrc& aSrc) {
    return false;
  }

-  if (aSrc.mUseOriginPrincipal) {
-    return true;
-  }
-
  gfxFontSrcPrincipal* gfxPrincipal = aSrc.mURI->InheritsSecurityContext()
                                          ? nullptr
                                          : aSrc.LoadPrincipal(*mUserFontSet);
@ -1405,8 +1378,7 @@ nsresult FontFaceSet::SyncLoadFontData(gfxUserFontEntry* aFontToLoad,
      getter_AddRefs(channel), aFontFaceSrc->mURI->get(), mDocument,
      principal ? principal->NodePrincipal() : nullptr,
      nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_INHERITS_SEC_CONTEXT,
-      aFontFaceSrc->mUseOriginPrincipal ? nsIContentPolicy::TYPE_UA_FONT
-                                        : nsIContentPolicy::TYPE_FONT);
+      nsIContentPolicy::TYPE_FONT);

  NS_ENSURE_SUCCESS(rv, rv);

--- a/layout/style/FontFaceSet.h
+++ b/layout/style/FontFaceSet.h
@ -158,6 +158,8 @@ class FontFaceSet final : public DOMEventTargetHelper,
  NS_IMETHOD StyleSheetLoaded(StyleSheet* aSheet, bool aWasDeferred,
                              nsresult aStatus) override;

+  FontFace* GetFontFaceAt(uint32_t aIndex);
+
  void FlushUserFontSet();

  static nsPresContext* GetPresContextFor(gfxUserFontSet* aUserFontSet) {
@ -186,10 +188,6 @@ class FontFaceSet final : public DOMEventTargetHelper,
  void Clear();
  bool Delete(FontFace& aFontFace);
  bool Has(FontFace& aFontFace);
-  /**
-   * This returns the number of Author origin fonts only.
-   * (see also SizeIncludingNonAuthorOrigins() below)
-   */
  uint32_t Size();
  already_AddRefed<dom::FontFaceSetIterator> Entries();
  already_AddRefed<dom::FontFaceSetIterator> Values();
@ -202,14 +200,7 @@ class FontFaceSet final : public DOMEventTargetHelper,

  void MarkUserFontSetDirty();

-  /**
-   * Unlike Size(), this returns the size including non-Author origin fonts.
-   */
-  uint32_t SizeIncludingNonAuthorOrigins();
-
 private:
-  friend mozilla::dom::FontFaceSetIterator;  // needs GetFontFaceAt()
-
  ~FontFaceSet();

  /**
@ -248,12 +239,6 @@ class FontFaceSet final : public DOMEventTargetHelper,
   */
  void CheckLoadingFinishedAfterDelay();

-  /**
-   * Returns the font at aIndex if it's an Author origin font, or nullptr
-   * otherwise.
-   */
-  FontFace* GetFontFaceAt(uint32_t aIndex);
-
  /**
   * Dispatches a FontFaceSetLoadEvent to this object.
   */
--- a/layout/style/FontFaceSetIterator.cpp
+++ b/layout/style/FontFaceSetIterator.cpp
@ -42,14 +42,7 @@ void FontFaceSetIterator::Next(JSContext* aCx,
    return;
  }

-  // Skip over non-Author origin fonts (GetFontFaceAt returns nullptr
-  // for those).
-  FontFace* face;
-  while (!(face = mFontFaceSet->GetFontFaceAt(mNextIndex++))) {
-    if (mNextIndex >= mFontFaceSet->SizeIncludingNonAuthorOrigins()) {
-      break;  // this iterator is done
-    }
-  }
+  FontFace* face = mFontFaceSet->GetFontFaceAt(mNextIndex++);

  if (!face) {
    aResult.mValue.setUndefined();
--- a/layout/style/ServoStyleSet.cpp
+++ b/layout/style/ServoStyleSet.cpp
@ -677,13 +677,6 @@ bool ServoStyleSet::GeneratedContentPseudoExists(
    if (!aParentStyle.StyleDisplay()->IsListItem()) {
      return false;
    }
-    // ::marker only exist if we have 'content' or at least one of
-    // 'list-style-type' or 'list-style-image'.
-    if (aPseudoStyle.StyleList()->mCounterStyle.IsNone() &&
-        aPseudoStyle.StyleList()->mListStyleImage.IsNone() &&
-        aPseudoStyle.StyleContent()->ContentCount() == 0) {
-      return false;
-    }
    // display:none is equivalent to not having the pseudo-element at all.
    if (aPseudoStyle.StyleDisplay()->mDisplay == StyleDisplay::None) {
      return false;
--- a/Показать больше
+++ b/Показать больше