Bug 1498873 - Pass the right frame to PushAbsoluteContainingBlock to determine whether we're a fixed-pos containing block. r=bzbarsky

When we're creating a scrollframe with let's say, display: flex or grid, the
containing block is the grid container itself, but the transformed frame is the
scroll frame.

This is the only caller that (incorrectly) passes the same frame to
PushAbsoluteContainingBlock.

Our painting code deals with it, mostly, because it starts from the placeholder
to paint fixed items, and it hits the scrollframe, but it gets confused
sometimes causing the issue described here.

I'll find a way to add a crashtest for this, and maybe a reftest, though this
works in non-WR.

We should probably add a few more assertions to the frame constructor...

Differential Revision: https://phabricator.services.mozilla.com/D8724

layout/base/nsCSSFrameConstructor.cpp

@@ -3927,9 +3927,8 @@ nsCSSFrameConstructor::ConstructFrameFromItemInternal(FrameConstructionItem& aIt
              maybeAbsoluteContainingBlockDisplay->IsFixedPosContainingBlock(
                  maybeAbsoluteContainingBlockStyleFrame)) &&
             !nsSVGUtils::IsInSVGTextSubtree(maybeAbsoluteContainingBlockStyleFrame)) {
-          nsContainerFrame* cf = static_cast<nsContainerFrame*>(
-              maybeAbsoluteContainingBlock);
-          aState.PushAbsoluteContainingBlock(cf, cf, absoluteSaveState);
+          auto* cf = static_cast<nsContainerFrame*>(maybeAbsoluteContainingBlock);
+          aState.PushAbsoluteContainingBlock(cf, maybeAbsoluteContainingBlockStyleFrame, absoluteSaveState);
         }
       }