fune/testing/web-platform/tests/css/css-pseudo/first-line-float-mapped-attribute-crash.html
Emilio Cobos Álvarez 0d753c2a94 Bug 1841128 - Simplify first-line reparenting a bit. r=TYLin
The TLDR is that our first-line implementation is complete madness, but
I'm not fixing bug 1465474 yet.

The guarantee that first-line style reparenting relies on is that
reparenting shouldn't change reset properties (that's why we had all
this "style to inherit ignoring first-line" to inherit reset
properties). Bug 1839223 broke this guarantee in the case the mapped
attribute declarations are reused / mutated (which is something we want
to do for performance).

What's going on in the test-case is that the old style's rule-node
declarations are mutated by the mapped attributes code. Re-cascading the
old styles yields a different `float` property value.

When a style change that causes a reframe like this one happens, we
don't update the frame tree styles with the new styles: it'd be wrong
and also useless work.

First-line reparenting happens after we've recomputed the styles, but
before we've reframed as needed. In this intermediate state, the frame
remains with the old (floated) style, but the ::first-line reparenting
code isn't aware that this frame is going away, so it happily
re-cascades and updates the style anyways, creating a floated
frame that has float: none in its computed style information.

This causes the frame destruction code to crash.

This patch restores that guarantee that ::first-line doesn't change
reset properties by re-using the "reset properties cache" code-path.
This is also simpler since it avoids us having to compute the "parent
ignoring ::first-line" style.

The code is also more explicit with the new enum rather than just an
Option.

Differential Revision: https://phabricator.services.mozilla.com/D182769
2023-07-07 16:46:52 +00:00

18 lines
304 B
HTML

<style>
* {
column-count: 16384;
}
*::first-line {}
</style>
<script>
function go() {
a.vspace = 425
a.align = "left"
b.scrollBy(0, 66)
document.fgColor = "rgba(134,30,31,208)"
a.align = "middle"
}
</script>
<body onload="go()">
<object id="a" height="94"></object>
<option id="b">