1727431 - Replace GetCrossDocParentFrame in nsIFrame::GetOffsetToCrossDoc with GetCrossDocParentFrameInProcess

Status: RESOLVED FIXED

(Core :: Layout, task)

Comment 1

[Hiroyuki Ikezoe (:hiro)]

Attachment: Bug 1727431 - Replace GetCrossDocParentFrame in nsIFrame::GetOffsetToCrossDoc with GetCrossDocParentFrameInProcess. r?tnikkel

GetOffsetToCrossDoc takes a valid non null pointer of nsIFrame, so it will not
walk up the frame tree across process boundaries.

If the call site needed the offset up to a frame in a different process, which
means the function call used for obtaining the nsIFrame needs to be audited such
as bug 1727229, which is for auditing GetReferenceFrame call sites
(GetOffsetToCrossDoc is often used with GetReferenceFrame, something like
GetOffsetToCrossDoc(GetReferenceFrame()).

FWIW, I did skim all GetOffsetToCrossDoc call sites [1], all look okay to me,
they are in auto scrolling, event handling, display list building, in the parent
process (i.e. XUL), etc. etc. Those features have been addressed in Fission.

[1] https://searchfox.org/mozilla-central/search?q=nsIFrame%3A%3AGetOffsetToCrossDoc&path=&case=true&regexp=false

Comment 2

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/3cd3ed5bd269