tor-browser

commit 36bc0130df259f5507b64003ac7a6a874aec1d4b
parent 6f5b97c94f0e18e6fc9698b7fe7a9bcfe3a248fe
Author: Eitan Isaacson <eitan@monotonous.org>
Date:   Mon,  6 Oct 2025 21:18:12 +0000

Bug 1992304 - Check for AnchorPosReferences property before using it. r=morgan

Differential Revision: https://phabricator.services.mozilla.com/D267645

Diffstat:
M
accessible/base/nsCoreUtils.cpp
 | 
6
++++++
M
accessible/tests/browser/relations/browser_anchor_positioning.js
 | 
49
+++++++++++++++++++++++++++++++++++++++++++++++++

2 files changed, 55 insertions(+), 0 deletions(-)
diff --git a/accessible/base/nsCoreUtils.cpp b/accessible/base/nsCoreUtils.cpp
@@ -725,6 +725,12 @@ nsIFrame* nsCoreUtils::GetPositionedFrameForAnchor(
         // from anchor to positioned frame.
         const auto* referencedAnchors =
             frame->GetProperty(nsIFrame::AnchorPosReferences());
+        if (!referencedAnchors) {
+          // Depending on where we are in the reflow, this property may or may
+          // not be set. If it isn't set, a future reflow will set it, so we can
+          // just skip this frame for now.
+          continue;
+        }
         const auto* data = referencedAnchors->Lookup(name.AsAtom());
         if (data && *data && data->ref().mOrigin) {
           if (aAnchorFrame ==
diff --git a/accessible/tests/browser/relations/browser_anchor_positioning.js b/accessible/tests/browser/relations/browser_anchor_positioning.js
@@ -567,3 +567,52 @@ addAccessibleTask(
   },
   { chrome: true, topLevel: true }
 );
+
+/**
+ * Test multi columns colspan
+ */
+addAccessibleTask(
+  `
+<style>
+  .columns {
+    column-count: 2;
+    column-fill: auto;
+  }
+
+  .colspan {
+    column-span: all;
+  }
+
+  .spacer {
+    height: 10px;
+  }
+
+  #anchor {
+    anchor-name: --a1;
+    margin-left: 10px;
+    width: 40px;
+  }
+
+  #target {
+    position: absolute;
+    left: anchor(--a1 left);
+    top: anchor(--a1 top);
+    width: 150px;
+    height: 60px;
+  }
+</style>
+
+<div class="columns">
+  <div id="target" role="group"></div>
+  <div id="anchor" role="group">
+    <div class="spacer"></div>
+    <div class="colspan" style="height: 20px"></div>
+  </div>
+</div>`,
+  async function testTooltipPositionAnchor(browser, docAcc) {
+    const anchor = findAccessibleChildByID(docAcc, "anchor");
+    const target = findAccessibleChildByID(docAcc, "target");
+    await testDetailsRelations(anchor, target);
+  },
+  { chrome: true, topLevel: true }
+);