Bug 1455108: Don't reparent first-line stuff in display: none subtrees. r?heycam
We may no longer know what the right parent style is, and it's not like it
matters anyway, the frame tree under us is dead, including placeholders and such
holding from us.
MozReview-Commit-ID: 1RHTwvKy0zQ
--- a/layout/base/RestyleManager.cpp
+++ b/layout/base/RestyleManager.cpp
@@ -3517,24 +3517,30 @@ RestyleManager::DoReparentComputedStyleF
// updated as a child). And given how this method ends up getting called, if
// we reach here for a table frame, we are already in the middle of
// reparenting the table wrapper frame. So no need to
// UpdateStyleOfOwnedAnonBoxes() here.
ReparentFrameDescendants(aFrame, providerChild, aStyleSet);
// We do not need to do the equivalent of UpdateFramePseudoElementStyles,
- // because those are hadled by our descendant walk.
+ // because those are handled by our descendant walk.
}
void
RestyleManager::ReparentFrameDescendants(nsIFrame* aFrame,
nsIFrame* aProviderChild,
ServoStyleSet& aStyleSet)
{
+ if (aFrame->GetContent()->IsElement() &&
+ !aFrame->GetContent()->AsElement()->HasServoData()) {
+ // We're getting into a display: none subtree, avoid reparenting into stuff
+ // that is going to go away anyway in seconds.
+ return;
+ }
nsIFrame::ChildListIterator lists(aFrame);
for (; !lists.IsDone(); lists.Next()) {
for (nsIFrame* child : lists.CurrentList()) {
// only do frames that are in flow
if (!(child->GetStateBits() & NS_FRAME_OUT_OF_FLOW) &&
child != aProviderChild) {
DoReparentComputedStyleForFirstLine(child, aStyleSet);
}
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1455108.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<style>
+ div::first-line {
+ color: yellow:
+ }
+ .foo span {
+ display: none;
+ }
+ .foo::first-line {
+ color: red;
+ }
+</style>
+<div><span>Yo, I'm a first-line<span> really</span></span>
+<script>
+ document.body.offsetTop;
+ document.querySelector('div').classList.add('foo');
+</script>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -268,8 +268,9 @@ test-pref(dom.animations-api.core.enable
pref(dom.webcomponents.shadowdom.enabled,true) load 1419554.html
load 1426312.html
load 1439793.html
load 1409183.html
pref(dom.webcomponents.shadowdom.enabled,true) load 1445682.html
load 1450691.html
pref(dom.webcomponents.shadowdom.enabled,true) load 1453206.html
load 1454140.html
+load 1455108.html
