tor-browser

commit 538edbdc2c0bbddb47975b263dee52796c17e276
parent 27d0a49f8248b13b6c9833ea4d0e0b91e43e7c14
Author: Timothy Nikkel <tnikkel@gmail.com>
Date:   Fri,  5 Dec 2025 11:20:35 +0000

Bug 2004160. Return the first continuation of sticky frames from GetASRAncestorFrame. r=layout-reviewers,emilio

The ASR always uses the first continuation in the case of sticky frames.

Differential Revision: https://phabricator.services.mozilla.com/D275195

Diffstat:
M
layout/base/nsLayoutUtils.cpp
 | 
2
+-
A
testing/web-platform/tests/css/css-position/sticky/sticky-continuation-crash.html
 | 
17
+++++++++++++++++

2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
@@ -1410,7 +1410,7 @@ static nsIFrame* GetNearestScrollableOrOverflowClipFrame(
       if (f->StyleDisplay()->mPosition == StylePositionProperty::Sticky) {
         auto* ssc = StickyScrollContainer::GetOrCreateForFrame(f);
         if (ssc && ssc->ScrollContainer()->IsMaybeAsynchronouslyScrolled()) {
-          return f;
+          return f->FirstContinuation();
         }
       }
     }
diff --git a/testing/web-platform/tests/css/css-position/sticky/sticky-continuation-crash.html b/testing/web-platform/tests/css/css-position/sticky/sticky-continuation-crash.html
@@ -0,0 +1,17 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  a.appendChild(b)
+  b.style.cssFloat = "left"
+})
+</script>
+<style>
+:root {
+  column-width: 0px;
+}
+</style>
+<sub id="b">a</sub>
+<ul style="position: sticky">
+<input>
+<li>
+<section id="a">a</section>
+<font>a</font>