Bug 1588486 - Don't generate frames for children display: contents is used within SVG text. r=mats

The TextNodeCorrespondenceRecorder stuff doesn't handle display: contents or
Shadow DOM at all. This causes a failure with an upcoming patch.

This patch fixes it and fixes related crashes like bug 1563779. This is the same
wallpaper as bug 1421807.

Differential Revision: https://phabricator.services.mozilla.com/D49138

--HG--
extra : moz-landing-system : lando

layout/base/nsCSSFrameConstructor.cpp

@@ -3291,9 +3291,9 @@ nsCSSFrameConstructor::FindTextData(const Text& aTextContent,
       return nullptr;
     }
 
-    // Don't render stuff in display: contents / Shadow DOM subtrees, because
-    // TextCorrespondenceRecorder in the SVG text code doesn't really know how
-    // to deal with it. This kinda sucks. :(
+    // FIXME(bug 1588477) Don't render stuff in display: contents / Shadow DOM
+    // subtrees, because TextCorrespondenceRecorder in the SVG text code doesn't
+    // really know how to deal with it. This kinda sucks. :(
     if (aParentFrame->GetContent() != aTextContent.GetParent()) {
       return nullptr;
     }
@@ -5121,6 +5121,13 @@ nsCSSFrameConstructor::FindSVGData(const Element& aElement,
   if (aIsWithinSVGText) {
     // If aIsWithinSVGText is true, then we know that the "SVG text uses
     // CSS frames" pref was true when this SVG fragment was first constructed.
+    //
+    // FIXME(bug 1588477) Don't render stuff in display: contents / Shadow DOM
+    // subtrees, because TextCorrespondenceRecorder in the SVG text code doesn't
+    // really know how to deal with it. This kinda sucks. :(
+    if (aParentFrame && aParentFrame->GetContent() != aElement.GetParent()) {
+      return nullptr;
+    }
 
     // We don't use ConstructInline because we want different behavior
     // for generated content.
@@ -5529,12 +5536,16 @@ void nsCSSFrameConstructor::AddFrameConstructionItemsInternal(
     MOZ_ASSERT(!aContent->AsElement()->IsRootOfNativeAnonymousSubtree(),
                "display:contents on anonymous content is unsupported");
 
-    if (!withinSVGText) {
-      CreateGeneratedContentItem(aState, aParentFrame, *aContent->AsElement(),
-                                 *aComputedStyle, PseudoStyleType::before,
-                                 aItems);
+    // FIXME(bug 1588477): <svg:text>'s TextNodeCorrespondenceRecorder has
+    // trouble with everything that looks like display: contents.
+    if (withinSVGText) {
+      return;
     }
 
+    CreateGeneratedContentItem(aState, aParentFrame, *aContent->AsElement(),
+                               *aComputedStyle, PseudoStyleType::before,
+                               aItems);
+
     FlattenedChildIterator iter(aContent);
     InsertionPoint insertion(aParentFrame, aContent);
     for (nsIContent* child = iter.GetNextChild(); child;
@@ -5544,11 +5555,9 @@ void nsCSSFrameConstructor::AddFrameConstructionItemsInternal(
     }
     aItems.SetParentHasNoXBLChildren(!iter.XBLInvolved());
 
-    if (!withinSVGText) {
-      CreateGeneratedContentItem(aState, aParentFrame, *aContent->AsElement(),
-                                 *aComputedStyle, PseudoStyleType::after,
-                                 aItems);
-    }
+    CreateGeneratedContentItem(aState, aParentFrame, *aContent->AsElement(),
+                               *aComputedStyle, PseudoStyleType::after,
+                               aItems);
     return;
   }
 

layout/svg/crashtests/1563779.html

@@ -0,0 +1,19 @@
+<script id="a">
+let count = 0;
+function go() {
+  if (count++ == 3)
+    return;
+  try { a.appendChild(c) } catch(e) { }
+  try { window.getSelection().getRangeAt(0).insertNode(b) } catch(e) { }
+  try { d.selectSubString(0,-1) } catch(e) { }
+  document.documentElement.style.display = "none"
+  document.documentElement.getBoundingClientRect()
+  document.documentElement.style.display = ""
+}
+</script>
+<pre id="b" style="display:contents">a</pre>
+<span id="c">
+<style onload="go()"></style>
+</span>
+<svg>
+<text id="d"><textPath xml:space="preserve">

layout/svg/crashtests/crashtests.list

@@ -231,3 +231,4 @@ load 1548985-1.html
 load 1548985-2.svg
 load 1555851.html
 load invalidation-of-opacity-0.html
+load 1563779.html