tor-browser

commit 970c575eb94342ff9be2de11fece3b77f814767e
parent e79fdbf7b43db5428e457a4e675a6b0421054dd2
Author: Ting-Yu Lin <tlin@mozilla.com>
Date:   Tue, 28 Oct 2025 20:17:08 +0000

Bug 1996677 Part 4 - Fix a potential writing-mode misuse when initializing abspos child's ReflowInput. r=layout-reviewers,emilio

In the old code, `availISize` and `availBSize` are both in the absCB's
writing-mode, but it uses a `LogicalSize` with the kid's writing-mode when
constructing the kid's `ReflowInput`, which doesn't seem correct in a orthogonal
reflow. However, I didn't spend time crafting a testcase, since our abspos
fragmentation is somewhat broken.

Also, with the previous part introducing a logical containing-block
size (`cbSize`) in `ReflowAbsoluteFrame()`. This patch simplifies the code by
removing `logicalCBSize` (which is in the kid's writing-mode).

Differential Revision: https://phabricator.services.mozilla.com/D270251

Diffstat:
M
layout/generic/AbsoluteContainingBlock.cpp
 | 
23
++++++++++-------------

1 file changed, 10 insertions(+), 13 deletions(-)
diff --git a/layout/generic/AbsoluteContainingBlock.cpp b/layout/generic/AbsoluteContainingBlock.cpp
@@ -992,12 +992,9 @@ void AbsoluteContainingBlock::ReflowAbsoluteFrame(
     }();
 
     const WritingMode outerWM = aReflowInput.GetWritingMode();
+    const WritingMode wm = aKidFrame->GetWritingMode();
     const LogicalSize cbSize(outerWM, usedCb.Size());
 
-    WritingMode wm = aKidFrame->GetWritingMode();
-    LogicalSize logicalCBSize(wm, usedCb.Size());
-    nscoord availISize = logicalCBSize.ISize(wm);
-
     ReflowInput::InitFlags initFlags;
     const bool staticPosIsCBOrigin = [&] {
       if (aFlags.contains(AbsPosReflowFlag::IsGridContainerCB)) {
@@ -1050,16 +1047,16 @@ void AbsoluteContainingBlock::ReflowAbsoluteFrame(
     // Get the border values
     const LogicalMargin border =
         aDelegatingFrame->GetLogicalUsedBorder(outerWM);
-
-    const nscoord availBSize =
-        kidFrameMaySplit ? aReflowInput.AvailableBSize() -
-                               border.ConvertTo(wm, outerWM).BStart(wm)
-                         : NS_UNCONSTRAINEDSIZE;
+    const LogicalSize availSize(
+        outerWM, cbSize.ISize(outerWM),
+        kidFrameMaySplit
+            ? aReflowInput.AvailableBSize() - border.BStart(outerWM)
+            : NS_UNCONSTRAINEDSIZE);
 
     ReflowInput kidReflowInput(aPresContext, aReflowInput, aKidFrame,
-                               LogicalSize(wm, availISize, availBSize),
-                               Some(logicalCBSize), initFlags, {}, {},
-                               aAnchorPosReferenceData);
+                               availSize.ConvertTo(wm, outerWM),
+                               Some(cbSize.ConvertTo(wm, outerWM)), initFlags,
+                               {}, {}, aAnchorPosReferenceData);
 
     if (nscoord kidAvailBSize = kidReflowInput.AvailableBSize();
         kidAvailBSize != NS_UNCONSTRAINEDSIZE) {
@@ -1183,7 +1180,7 @@ void AbsoluteContainingBlock::ReflowAbsoluteFrame(
                            margin.StartOffset(outerWM),
                        kidSize);
       nsRect r = rect.GetPhysicalRect(
-          outerWM, logicalCBSize.GetPhysicalSize(wm) +
+          outerWM, cbSize.GetPhysicalSize(outerWM) +
                        border.Size(outerWM).GetPhysicalSize(outerWM));
 
       // Offset the frame rect by the given origin of the absolute CB.