Verified Commit 2c620a58 authored by Ting-Yu Lin's avatar Ting-Yu Lin Committed by ma1
Browse files

Bug 2053578 - Update first-in-flow cache when a continuation is changing from... 

Bug 2053578 - Update first-in-flow cache when a continuation is changing from fluid to non-fluid. r=layout-reviewers,jfkthame

The original case in bug 2053578 comment 5 can reproduce an ASAN
use-after-poison with the patch bug 2053578 comment 6 applied. However, with
unpatched code, the best we can do is using a DEBUG-only assertion to catch the
error condition that detect a stale first-in-flow cache in next-in-flow.

`bidi-inline-continuation-first-in-flow.html` is generated with the help of
Claude code, and it can trigger the assertion without other fix in this patch.

Differential Revision: https://phabricator.services.mozilla.com/D315158
parent 0b475830

layout/generic/nsSplittableFrame.cpp

+19 −0
Original line number Diff line number Diff line
@@ -243,6 +243,18 @@ void nsSplittableFrame::UpdateFirstContinuationAndFirstInFlowCache() { 
        f->mFirstInFlow = newFirstInFlow;

      }

    }

  } else {

    if (GetPrevContinuation()) {

      // We become the new first-in-flow after changing from fluid to non-fluid.

      // Update the stale first-in-flow cache for us and all next-in-flows.

      //

      // Note that this has no counterpart in the above mFirstContinuation cache

      // since GetPrevContinuation() does not depend on the

      // NS_FRAME_IS_FLUID_CONTINUATION bit.

      for (nsSplittableFrame* f = this; f;

           f = static_cast<nsSplittableFrame*>(f->GetNextInFlow())) {

        f->mFirstInFlow = this;

      }

    } else {

      // We become the new first-in-flow due to our prev-in-flow being removed.

      if (oldCachedFirstInFlow) {
@@ -256,6 +268,13 @@ void nsSplittableFrame::UpdateFirstContinuationAndFirstInFlowCache() { 
        }

      }

    }



    DebugOnly<nsSplittableFrame*> nextInFlow =

        static_cast<nsSplittableFrame*>(GetNextInFlow());

    MOZ_ASSERT(!nextInFlow || !nextInFlow->mFirstInFlow ||

                   nextInFlow->mFirstInFlow == this,

               "Our next-in-flow caches a stale first-in-flow!");

  }

}



NS_DECLARE_FRAME_PROPERTY_SMALL_VALUE(ConsumedBSizeProperty, nscoord);

testing/web-platform/tests/css/css-writing-modes/crashtests/bidi-inline-continuation-first-in-flow.html

0 → 100644
+194 −0
Original line number Diff line number Diff line 
<!DOCTYPE html>

<meta charset="utf-8">

<link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">

<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2053578">



<!-- The operations in <script> are generated from one of the runs from

     the original testcase (Bug 2053578 Comment 5) that triggers

     the assertion. -->



<body></body>



<script>

var n1 = document.createElement("div");

n1.style.width = "50px";

var n2 = document.createElement("bdo");

n2.setAttribute("dir", "rtl");

var n3 = document.createTextNode("كلمة");

n2.appendChild(n3);

n1.appendChild(n2);

var n4 = document.createElement("em");

var n5 = document.createElement("span");

var n6 = document.createElement("bdo");

var n7 = document.createTextNode("word m mix");

n6.appendChild(n7);

n5.appendChild(n6);

var n8 = document.createTextNode("מלל");

n5.appendChild(n8);

var n9 = document.createElement("b");

n9.setAttribute("dir", "ltr");

n9.style.unicodeBidi = "bidi-override";

var n10 = document.createTextNode("alpha");

n9.appendChild(n10);

var n11 = document.createTextNode("نص مرحبا كلمة");

n9.appendChild(n11);

var n12 = document.createTextNode("مرحبا نص نص");

n9.appendChild(n12);

n5.appendChild(n9);

n4.appendChild(n5);

var n13 = document.createElement("span");

n13.style.unicodeBidi = "bidi-override";

var n14 = document.createElement("bdi");

var n15 = document.createTextNode("اختبار");

n14.appendChild(n15);

n13.appendChild(n14);

var n16 = document.createElement("em");

var n17 = document.createTextNode("בדיקה מלל m نص");

n16.appendChild(n17);

var n18 = document.createTextNode("كلمة");

n16.appendChild(n18);

var n19 = document.createTextNode("نص مرحبا كلمة");

n16.appendChild(n19);

n13.appendChild(n16);

var n20 = document.createElement("span");

var n21 = document.createTextNode("שלום מלל בדיקה שלום");

n20.appendChild(n21);

n13.appendChild(n20);

n4.appendChild(n13);

n1.appendChild(n4);

document.body.appendChild(n1);

var n22 = document.createElement("bdo");

n22.style.unicodeBidi = "plaintext";

var n23 = document.createElement("span");

var n24 = document.createTextNode("עברית שלום مرحبا alpha");

n23.appendChild(n24);

n22.appendChild(n23);

n14.style.direction = "ltr";

var n25 = document.createTextNode("كلمة שלום");

n2.insertBefore(n25, n3);

n21.remove();

n9.setAttribute("dir", "ltr");

var n26 = document.createTextNode("בדיקה mm");

n4.appendChild(n26);

n12.data = "שלום עברית שלום עברית";

n7.remove();

n2.style.direction = "ltr";

n1.style.width = "102px";

var n27 = document.createTextNode("עברית mm m");

n22.appendChild(n27);

n22.setAttribute("dir", "rtl");

n4.style.direction = "";

n14.style.direction = "rtl";

n22.insertBefore(n9, n23);

var n28 = document.createElement("br");

n9.insertBefore(n28, n12);

n14.style.unicodeBidi = "embed";

n5.insertBefore(n22, n6);

n9.style.direction = "";

n9.style.unicodeBidi = "bidi-override";

n22.remove();

var n29 = document.createTextNode("עברית שלום");

n5.insertBefore(n29, n6);

n18.data = "mix";

n19.data = "alpha m word";

n20.style.direction = "ltr";

var n30 = document.createTextNode("mm עברית עברית نص");

n6.appendChild(n30);

n6.style.unicodeBidi = "isolate";

n20.style.unicodeBidi = "embed";

n16.setAttribute("dir", "rtl");

n2.insertBefore(n20, n25);

var n31 = document.createTextNode("שלום مرحبا mix mm");

n2.insertBefore(n31, n20);

var n32 = document.createTextNode("m בדיקה word mix");

n20.appendChild(n32);

n16.removeAttribute("dir");

n16.setAttribute("dir", "auto");

n5.remove();

n17.remove();

n31.data = "בדיקה mm";

n14.style.unicodeBidi = "isolate";

n4.remove();

n20.style.direction = "";

n20.style.direction = "rtl";

n3.data = "בדיקה שלום word";

n25.data = "mm";

n25.data = "m mix word";

n1.style.direction = "rtl";

n31.data = "كلمة اختبار";

n20.remove();

n3.data = "שלום نص";

n31.remove();

n2.setAttribute("dir", "ltr");

n2.removeAttribute("dir");

n1.insertBefore(n4, n2);

n19.data = "מלל word";

n15.remove();

n13.setAttribute("dir", "ltr");

n25.remove();

n2.setAttribute("dir", "ltr");

n14.appendChild(n2);

n3.data = "مرحبا اختبار مرحبا";

n18.data = "שלום";

n16.insertBefore(n20, n18);

var n33 = document.createTextNode("كلمة نص mm");

n2.appendChild(n33);

n19.data = "اختبار مرحبا كلمة كلمة";

n18.data = "mm mix mix";

var n34 = document.createElement("br");

n4.insertBefore(n34, n13);

n13.style.unicodeBidi = "isolate-override";

n13.remove();

n34.remove();

n26.data = "كلمة كلمة مرحبا";

n4.setAttribute("dir", "rtl");

n26.data = "mm word m mm";

n26.data = "اختبار نص";

n4.setAttribute("dir", "auto");

var n35 = document.createTextNode("مرحبا מלל كلمة שלום");

n4.insertBefore(n35, n26);

n4.style.unicodeBidi = "embed";

n4.style.direction = "";

var n36 = document.createTextNode("كلمة mix בדיקה نص");

n4.insertBefore(n36, n35);

n36.remove();

n4.removeAttribute("dir");

n4.style.unicodeBidi = "";

n1.style.width = "87px";

n26.data = "שלום מלל מלל עברית";

var n37 = document.createElement("br");

n4.insertBefore(n37, n35);

n35.data = "مرحبا نص اختبار";

n4.setAttribute("dir", "rtl");

n33.data = "word alpha mm";

var n38 = document.createTextNode("שלום word");

n16.insertBefore(n38, n20);

n2.setAttribute("dir", "auto");

n2.remove();

n37.remove();

var n39 = document.createTextNode("עברית اختبار בדיקה");

n13.appendChild(n39);

var n40 = document.createTextNode("בדיקה m نص نص");

n13.insertBefore(n40, n14);

var n41 = document.createElement("br");

n20.appendChild(n41);

n35.data = "alpha";

n16.remove();

n39.data = "نص mm בדיקה اختبار";

n40.data = "mix mix word m";

n35.data = "שלום בדיקה";

n35.data = "m mix mm m";

n40.data = "مرحبا اختبار";

n13.style.unicodeBidi = "embed";

n4.insertBefore(n16, n26);

var n42 = document.createTextNode("نص");

n13.insertBefore(n42, n40);

n41.remove();

n20.insertBefore(n2, n32);

document.body.offsetHeight;

n39.data = "مرحبا alpha עברית word";

n18.data = "שלום";

n2.setAttribute("dir", "auto");

document.body.offsetHeight;

n20.style.direction = "ltr";

</script>