tor-browser

commit bc28ca1f46e39e71d041386a78e0845e97c4b236
parent 28d9430d98fd61857b635fde3e443658e60130e7
Author: Timothy Nikkel <tnikkel@gmail.com>
Date:   Wed,  5 Nov 2025 01:24:09 +0000

Bug 1995207. Stay within the widget in GetEventCoordinatesRelativeTo if the destination space is also within the widget. r=layout-reviewers,emilio

Differential Revision: https://phabricator.services.mozilla.com/D270634

Diffstat:
M
layout/base/nsLayoutUtils.cpp
 | 
14
+++++++++++---

1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
@@ -1480,16 +1480,24 @@ nsPoint GetEventCoordinatesRelativeTo(nsIWidget* aWidget,
     return nsPoint(NS_UNCONSTRAINEDSIZE, NS_UNCONSTRAINEDSIZE);
   }
 
-  if (nsView* view = frame->GetView()) {
-    nsIWidget* frameWidget = view->GetWidget();
+  nsView* view = frame->GetView();
+  if (view || frame->IsMenuPopupFrame()) {
+    nsIWidget* frameWidget =
+        view ? view->GetWidget()
+             : static_cast<const nsMenuPopupFrame*>(frame)->GetWidget();
     if (frameWidget == aWidget) {
+      MOZ_ASSERT_IF(!view, frameWidget->GetPopupFrame() ==
+                               static_cast<const nsMenuPopupFrame*>(frame));
       // Special case this cause it happens a lot.
       // This also fixes bug 664707, events in the extra-special case of select
       // dropdown popups that are transformed.
       nsPresContext* presContext = frame->PresContext();
       nsPoint pt(presContext->DevPixelsToAppUnits(aPoint.x),
                  presContext->DevPixelsToAppUnits(aPoint.y));
-      return pt - view->ViewToWidgetOffset();
+      if (view) {
+        pt -= view->ViewToWidgetOffset();
+      }
+      return pt;
     }
   }