commit 7b20ce3fa33b12ad9625b0e232aa447294c90761
parent 8cdcc8296e7e243555779297728a29376c1f7816
Author: David Shin <dshin@mozilla.com>
Date: Mon, 10 Nov 2025 23:41:08 +0000
Bug 1998445: Relax assertion that implying fixed or abspos elements are NS_FRAME_OUT_OF_FLOW. r=layout-reviewers,dholbert
Differential Revision: https://phabricator.services.mozilla.com/D271631
Diffstat:
2 files changed, 17 insertions(+), 3 deletions(-)
diff --git a/layout/base/AnchorPositioningUtils.cpp b/layout/base/AnchorPositioningUtils.cpp
@@ -496,13 +496,16 @@ Maybe<AnchorPosInfo> AnchorPositioningUtils::ResolveAnchorPosRect(
const nsIFrame* aPositioned, const nsIFrame* aAbsoluteContainingBlock,
const nsAtom* aAnchorName, bool aCBRectIsvalid,
AnchorPosResolutionCache* aResolutionCache) {
- MOZ_ASSERT(aPositioned->HasAnyStateBits(NS_FRAME_OUT_OF_FLOW));
- MOZ_ASSERT(aPositioned->GetParent() == aAbsoluteContainingBlock);
-
if (!aPositioned) {
return Nothing{};
}
+ if (!aPositioned->HasAnyStateBits(NS_FRAME_OUT_OF_FLOW)) {
+ return Nothing{};
+ }
+
+ MOZ_ASSERT(aPositioned->GetParent() == aAbsoluteContainingBlock);
+
const auto* anchorName = GetUsedAnchorName(aPositioned, aAnchorName);
if (!anchorName) {
return Nothing{};
diff --git a/testing/web-platform/tests/css/css-anchor-position/anchor-mathml-crash.html b/testing/web-platform/tests/css/css-anchor-position/anchor-mathml-crash.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<style>
+semantics {
+ position: fixed;
+ top: anchor(start);
+}
+</style>
+<script>
+const semantics = document.createElementNS("http://www.w3.org/1998/Math/MathML", "semantics");
+document.documentElement.appendChild(semantics);
+</script>
