Bug 1974382: Avoid short-circuit evaluation on frame ancestor lookup. r=layout-anchor-positioning-reviewers,dshin

Differential Revision: https://phabricator.services.mozilla.com/D255501

Author: jjjalkanen

layout/base/PresShell.cpp

@@ -12040,7 +12040,7 @@ void PresShell::AddAnchorPosAnchor(const nsAtom* aName, nsIFrame* aFrame) {
     nsIFrame* mFrame;
 
     int32_t operator()(nsIFrame* aOther) const {
-      return nsLayoutUtils::CompareTreePosition(aOther, mFrame, nullptr);
+      return nsLayoutUtils::CompareTreePosition(mFrame, aOther, nullptr);
     }
   };
 

layout/base/nsLayoutUtils.cpp

@@ -1161,8 +1161,9 @@ int32_t nsLayoutUtils::DoCompareTreePosition(
   }
 
   AutoTArray<const nsIFrame*, 20> frame1Ancestors;
-  if (aCommonAncestor &&
-      !FillAncestors(aFrame1, aCommonAncestor, &frame1Ancestors)) {
+  const nsIFrame* frame1CommonAncestor =
+      FillAncestors(aFrame1, aCommonAncestor, &frame1Ancestors);
+  if (aCommonAncestor && !frame1CommonAncestor) {
     // We reached the root of the frame tree ... if aCommonAncestor was set,
     // it is wrong
     return DoCompareTreePosition(aFrame1, aFrame2, nullptr);

testing/web-platform/meta/css/css-anchor-position/anchor-getComputedStyle-001.html.ini

@@ -1,4 +1,5 @@
 [anchor-getComputedStyle-001.html]
+  expected: CRASH
   [Basic case]
     expected: FAIL
 

testing/web-platform/meta/css/css-anchor-position/anchor-getComputedStyle-002.html.ini

@@ -1,4 +1,5 @@
 [anchor-getComputedStyle-002.html]
+  expected: CRASH
   [getComputedStyle() with fragmented containing block in multicolumn layout]
     expected: FAIL
 

testing/web-platform/meta/css/css-anchor-position/anchor-name-in-shadow.html.ini

@@ -3,6 +3,3 @@
     if (os == "android") and fission: [TIMEOUT, OK]
   [anchor() in shadow tree should not match host anchor-name]
     expected: FAIL
-
-  [anchor-name should not leak out of a shadow tree]
-    expected: FAIL

testing/web-platform/meta/css/css-anchor-position/anchor-position-003.html.ini

@@ -1,5 +1,3 @@
 [anchor-position-003.html]
   expected:
     if (os == "android") and fission: [OK, TIMEOUT]
-  [.target 1]
-    expected: FAIL

testing/web-platform/meta/css/css-anchor-position/anchor-position-circular.html.ini

@@ -20,8 +20,8 @@
   [Sibling can not anchor into anchor-scope, even when anchor-name present]
     expected: FAIL
 
-  [anchor-scope:all on common ancestor]
+  [anchor-scope:all scopes multiple names]
     expected: FAIL
 
-  [anchor-scope:--a on common ancestor]
+  [anchor-scope:--a,--b scopes --a and --b]
     expected: FAIL

testing/web-platform/meta/css/css-anchor-position/anchor-scope-basic.html.ini

@@ -7,6 +7,3 @@
 
   [anchor-scope:--a appearing dynamically scopes only --a]
     expected: FAIL
-
-  [anchor-scope:--b appearing dynamically (--b never referenced)]
-    expected: FAIL

testing/web-platform/meta/css/css-anchor-position/anchor-scope-dynamic.html.ini

@@ -1,3 +1,4 @@
 [anchor-scope-shadow-names.html]
+  expected: CRASH
   [anchor-scope in ::part() affects slotted-in element]
     expected: FAIL