Bug 1982701: Exclude element-backed pseudos from NAC ancestor-traversal in GetCorrectedParent. r=emilio,layout-reviewers

dholbert · dholbert · commit 056dd5e03f5a · 2025-08-15T17:34:19.000Z
Differential Revision: https://phabricator.services.mozilla.com/D261209
diff --git a/layout/generic/nsIFrame.cpp b/layout/generic/nsIFrame.cpp
@@ -11257,12 +11257,14 @@ static nsIFrame* GetCorrectedParent(const nsIFrame* aFrame) {
   }
 
   // Prevent a NAC pseudo-element from inheriting from its NAC parent, and
-  // inherit from the NAC generator element instead.
-  if (pseudo != PseudoStyleType::NotPseudo) {
+  // inherit from the NAC generator element instead. (We exclude element-backed
+  // pseudos from this check, since they're not NAC.)
+  if (pseudo != PseudoStyleType::NotPseudo &&
+      !PseudoStyle::IsElementBackedPseudo(pseudo)) {
     MOZ_ASSERT(aFrame->GetContent());
     Element* element = Element::FromNode(aFrame->GetContent());
-    // Make sure to avoid doing the fixup for non-element-backed pseudos like
-    // ::first-line and such.
+    // Make sure to only do the fixup for anonymous content pseudos (i.e. avoid
+    // fixup for ::first-line and such).
     if (element && !element->IsRootOfNativeAnonymousSubtree() &&
         element->GetPseudoElementType() == aFrame->Style()->GetPseudoType()) {
       while (parent->GetContent() &&
diff --git a/testing/web-platform/tests/html/rendering/the-details-element/firefox-bug-1928736-1-crash.html b/testing/web-platform/tests/html/rendering/the-details-element/firefox-bug-1928736-1-crash.html
@@ -0,0 +1,11 @@
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1982701">
+<style>
+*::first-line {}
+</style>
+<script>
+window.addEventListener("DOMContentLoaded", () => {
+  a.showModal()
+})
+</script>
+<dialog id="a">
+<details>
diff --git a/testing/web-platform/tests/html/rendering/the-details-element/firefox-bug-1928736-2-crash.html b/testing/web-platform/tests/html/rendering/the-details-element/firefox-bug-1928736-2-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1982701">
+<style>
+  .wrapper::first-line { background: cyan }
+</style>
+<div class="wrapper">
+  WrapperFirstLine<br>
+  WrapperSecondLine<br>
+  <dialog id="a" open>
+    <details>
+      <summary>This is the summary</summary>
+      These are the details
+    </details>
+  </dialog>
+</div>
