tor-browser

commit fe9df1719205b7da963d2dba6f4de8b437f41786
parent c48029d8e4d80f32b441bf6c7c0d5978c74f08df
Author: Botond Ballo <botond@mozilla.com>
Date:   Fri, 14 Nov 2025 22:10:08 +0000

Bug 2000121 - Ensure that a fixed item's scroll target ASR is always ASRKind::Scroll. r=mstange

Differential Revision: https://phabricator.services.mozilla.com/D272700

Diffstat:
A
layout/base/crashtests/2000121.html
 | 
7
+++++++
M
layout/base/crashtests/crashtests.list
 | 
1
+
M
layout/generic/nsCanvasFrame.cpp
 | 
4
+++-
M
layout/generic/nsIFrame.cpp
 | 
4
+++-
M
layout/painting/nsDisplayList.cpp
 | 
9
++++++++-

5 files changed, 22 insertions(+), 3 deletions(-)
diff --git a/layout/base/crashtests/2000121.html b/layout/base/crashtests/2000121.html
@@ -0,0 +1,7 @@
+<style>
+dialog {
+  position: sticky;
+  background: url(#x) fixed;
+}
+</style>
+<dialog open="true">
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
@@ -567,3 +567,4 @@ load 1849898-1.html
 load 1929445.html
 asserts(1-3) load 1931933.html
 load 1984507.html
+load 2000121.html
diff --git a/layout/generic/nsCanvasFrame.cpp b/layout/generic/nsCanvasFrame.cpp
@@ -347,9 +347,11 @@ void nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder* aBuilder,
         }
       }
       if (bgItem) {
+        const ActiveScrolledRoot* scrollTargetASR =
+            asr ? asr->GetNearestScrollASR() : nullptr;
         thisItemList.AppendToTop(
             nsDisplayFixedPosition::CreateForFixedBackground(
-                aBuilder, this, nullptr, bgItem, i, asr));
+                aBuilder, this, nullptr, bgItem, i, scrollTargetASR));
       }
 
     } else {
diff --git a/layout/generic/nsIFrame.cpp b/layout/generic/nsIFrame.cpp
@@ -3905,9 +3905,11 @@ void nsIFrame::BuildDisplayListForStackingContext(
     // item as well.
     const ActiveScrolledRoot* fixedASR = ActiveScrolledRoot::PickAncestor(
         containerItemASR, aBuilder->CurrentActiveScrolledRoot());
+    const ActiveScrolledRoot* scrollTargetASR =
+        containerItemASR ? containerItemASR->GetNearestScrollASR() : nullptr;
     resultList.AppendNewToTop<nsDisplayFixedPosition>(
         aBuilder, this, &resultList, fixedASR,
-        nsDisplayItem::ContainerASRType::AncestorOfContained, containerItemASR,
+        nsDisplayItem::ContainerASRType::AncestorOfContained, scrollTargetASR,
         ShouldForceIsolation());
     createdContainer = true;
   } else if (useStickyPosition && !capturedByViewTransition) {
diff --git a/layout/painting/nsDisplayList.cpp b/layout/painting/nsDisplayList.cpp
@@ -3456,9 +3456,12 @@ AppendedBackgroundType nsDisplayBackgroundImage::AppendBackgroundItemsToTop(
                                        aSecondaryReferenceFrame, bgData);
       }
       if (bgItem) {
+        const ActiveScrolledRoot* scrollTargetASR =
+            asr ? asr->GetNearestScrollASR() : nullptr;
         thisItemList.AppendToTop(
             nsDisplayFixedPosition::CreateForFixedBackground(
-                aBuilder, aFrame, aSecondaryReferenceFrame, bgItem, i, asr));
+                aBuilder, aFrame, aSecondaryReferenceFrame, bgItem, i,
+                scrollTargetASR));
       }
     } else {  // bgData.shouldFixToViewport == false
       nsDisplayBackgroundImage* bgItem = CreateBackgroundImage(
@@ -5733,6 +5736,8 @@ nsDisplayFixedPosition::nsDisplayFixedPosition(
       mIsFixedBackground(false),
       mForceIsolation(aForceIsolation) {
   MOZ_COUNT_CTOR(nsDisplayFixedPosition);
+  MOZ_ASSERT_IF(mScrollTargetASR,
+                mScrollTargetASR->mKind == ActiveScrolledRoot::ASRKind::Scroll);
 }
 
 nsDisplayFixedPosition::nsDisplayFixedPosition(
@@ -5746,6 +5751,8 @@ nsDisplayFixedPosition::nsDisplayFixedPosition(
       mIsFixedBackground(true),
       mForceIsolation(false) {
   MOZ_COUNT_CTOR(nsDisplayFixedPosition);
+  MOZ_ASSERT_IF(mScrollTargetASR,
+                mScrollTargetASR->mKind == ActiveScrolledRoot::ASRKind::Scroll);
 }
 
 ScrollableLayerGuid::ViewID nsDisplayFixedPosition::GetScrollTargetId() const {