From c35c146cbd31cbba1259e04cf6b4578bad4855b5 Mon Sep 17 00:00:00 2001
From: David Shin <dshin@mozilla.com>
Date: Wed, 13 Nov 2024 20:29:13 +0000
Subject: [PATCH] Bug 1768921 - Ensure that padding inflated bounds of in-flow
 children are included in the scrollable element's overflow area. r=dholbert

This means that when users scroll to the inline-end of a scroller, they will
see that the inline-end padding of that scroller is added in.

This is achieved by unioning an additional rect into the scrollable element's
overflow area (Which is an accumulation of the recursive overflow-area
contributions from its subtree).

This additional rect is calculated as follows:
- In-flow children and float's margin boxes are unioned (including zero-size boxes)
- The unioned rect is then inflated by the scrollable element's padding

Note: The bounds of zero-area in-flow-child rects are included in this rect,
in both block- and inline- directions. This is a change in behavior; Divs of
huge inline size and zero block size used to not affect the scrollable overflow,
where divs with huge block size and zero inline size did, as a side effect of now
removed `nsBlockFrame::ConsiderBlockEndEdgeOfChildren`.

Note on WPT change sizing-orthog-(vlr|vrl)-in-htb-(008|020)-ref.xht - the padding existed
to force empty space below `p#sentence-after`. However, this only applies to previous
Firefox. Any combination of browser + default font (+ its default size) causing a scroll
would cause the test to fail as false positive (According to wpt.fyi, this is what happens
with sizing-orthog-(vlr|vrl)-008.xht tests). This change brings Firefox's scroll behaviour
inline with other browsers.

Differential Revision: https://phabricator.services.mozilla.com/D151310
---
 dom/html/test/test_bug375003-2.html           |  28 +-
 layout/generic/ScrollContainerFrame.cpp       |  21 --
 layout/generic/crashtests/crashtests.list     |   4 +-
 layout/generic/nsBlockFrame.cpp               | 309 ++++++++++++------
 layout/generic/nsBlockFrame.h                 |  14 +-
 layout/generic/nsLineBox.cpp                  |  35 +-
 layout/generic/nsLineBox.h                    |  16 +
 layout/reftests/bugs/458296-1c.html           |  10 -
 layout/reftests/bugs/825999-ref.html          |  14 +-
 layout/reftests/bugs/825999.html              |   6 +
 layout/reftests/bugs/966992-1-ref.html        |  16 +-
 layout/reftests/bugs/966992-1.html            |  26 --
 layout/reftests/bugs/reftest.list             |   1 -
 .../scrollable-horizontal-margin-ref.html     |   6 +-
 .../scrollable-horizontal-margin.html         |   6 +-
 .../position-sticky/padding-3-ref.html        |   2 +-
 layout/tables/crashtests/crashtests.list      |   4 +-
 .../inline-block-replaced-width-008.xht.ini   |   3 -
 .../inline-replaced-width-009.xht.ini         |   3 -
 .../content-visibility-090.html.ini           |   3 +
 .../margin-block-end-scroll-area-001.html.ini |   2 +
 ...gonal-flow-with-inline-end-margin.html.ini |   3 -
 .../overflow-clip-margin-002.html.ini         |   2 +-
 .../overflow-clip-margin-005.html.ini         |   2 +-
 .../overflow-clip-margin-007.html.ini         |   3 -
 .../overflow-clip-margin-012.html.ini         |   3 -
 .../css-overflow/overflow-padding.html.ini    |   5 -
 .../scrollable-overflow-padding.html.ini      | 118 ++++---
 .../css/cssom-view/scrollWidthHeight.xht.ini  |   6 -
 .../sizing-orthog-vlr-in-htb-008-ref.xht      |   1 -
 .../sizing-orthog-vlr-in-htb-020-ref.xht      |   1 -
 .../sizing-orthog-vrl-in-htb-008-ref.xht      |   1 -
 .../sizing-orthog-vrl-in-htb-020-ref.xht      |   1 -
 33 files changed, 387 insertions(+), 288 deletions(-)
 delete mode 100644 layout/reftests/bugs/458296-1c.html
 delete mode 100644 testing/web-platform/meta/css/CSS2/normal-flow/inline-block-replaced-width-008.xht.ini
 delete mode 100644 testing/web-platform/meta/css/CSS2/normal-flow/inline-replaced-width-009.xht.ini
 create mode 100644 testing/web-platform/meta/css/css-contain/content-visibility/content-visibility-090.html.ini
 create mode 100644 testing/web-platform/meta/css/css-overflow/margin-block-end-scroll-area-001.html.ini
 delete mode 100644 testing/web-platform/meta/css/css-overflow/orthogonal-flow-with-inline-end-margin.html.ini
 delete mode 100644 testing/web-platform/meta/css/css-overflow/overflow-clip-margin-007.html.ini
 delete mode 100644 testing/web-platform/meta/css/css-overflow/overflow-clip-margin-012.html.ini
 delete mode 100644 testing/web-platform/meta/css/css-overflow/overflow-padding.html.ini
 delete mode 100644 testing/web-platform/meta/css/cssom-view/scrollWidthHeight.xht.ini

diff --git a/dom/html/test/test_bug375003-2.html b/dom/html/test/test_bug375003-2.html
index b8b985846ca5..037bb75174a3 100644
--- a/dom/html/test/test_bug375003-2.html
+++ b/dom/html/test/test_bug375003-2.html
@@ -18,7 +18,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=375003
         body {
             color:black; background-color:white; font-size:12px; padding:10px; margin:0;
         }
-	
+
         #div1,#abs1,#table1 {
           border: 20px solid lime;
           padding: 30px;
@@ -47,28 +47,38 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=375003
 
 <script type="text/javascript">
 var x = [ 'Left','Top','Width','Height' ];
-function test(id,s,expected) {
+function test(id,s,expected, fuzzy) {
   var el = document.getElementById(id);
   for(var i = 0; i < x.length; ++i) {
     // eslint-disable-next-line no-eval
     var actual = eval('el.'+s+x[i]);
-    if (expected[i] != -1 && s+x[i]!='scrollHeight')
-      is(actual, expected[i], id+"."+s+x[i]);
+    if (expected[i] != -1 && s+x[i]!='scrollHeight') {
+      let check = fuzzy ?
+        (actual, expected, desc) => isfuzzy(actual, expected, 1, desc) :
+        is;
+      check(actual, expected[i], id+"."+s+x[i]);
+    }
   }
 }
-function t3(id,c,o,s,pid) {
+function t3(id,c,o,s,pid,fuzzy) {
   test(id,'client',c);
   test(id,'offset',o);
-  test(id,'scroll',s);
-  var p = document.getElementById(id).offsetParent; 
+  test(id,'scroll',s,fuzzy);
+  var p = document.getElementById(id).offsetParent;
   is(p.id, pid, id+".offsetParent");
 }
 
 function run_test() {
+   // Due to how the document is rendered and then scaled to viewport,
+   // rounding errors are introduced that we need to account for.
+   // This is propagated to only tests that we observed failures attributed
+   // to the cause above, to prevent false negatives.
+   // TODO(dshin, Bug 1930223): Perhaps the test runner should handle this.
+   const fuzzy = navigator.appVersion.includes("Android");
    // XXX how test clientWidth/clientHeight (the -1 below) in cross-platform manner
    // without hard-coding the scrollbar width?
-   t3('div1',[20,20,-1,-1],[10,10,200,160],[0,0,230,20],'body');
-   t3('abs1',[20,20,-1,-1],[500,170,200,160],[0,0,230,20],'body');
+   t3('div1',[20,20,-1,-1],[10,10,200,160],[0,0,260,20],'body',fuzzy);
+   t3('abs1',[20,20,-1,-1],[500,170,200,160],[0,0,260,20],'body',fuzzy);
    t3('table1',[0,0,306,306],[10,170,306,306],[0,0,306,306],'body');
    t3('table2',[0,0,206,206],[0,0,206,206],[0,0,206,20],'table2parent');
    t3('table3',[0,0,228,228],[0,0,228,228],[0,0,228,228],'table3parent');
diff --git a/layout/generic/ScrollContainerFrame.cpp b/layout/generic/ScrollContainerFrame.cpp
index 2246c62efd00..1147acfdbafc 100644
--- a/layout/generic/ScrollContainerFrame.cpp
+++ b/layout/generic/ScrollContainerFrame.cpp
@@ -949,27 +949,6 @@ void ScrollContainerFrame::ReflowScrolledFrame(ScrollReflowInput& aState,
   // overflow area doesn't include the frame bounds.
   aMetrics->UnionOverflowAreasWithDesiredBounds();
 
-  auto* disp = StyleDisplay();
-  if (MOZ_UNLIKELY(disp->mOverflowClipBoxInline ==
-                   StyleOverflowClipBox::ContentBox)) {
-    // The scrolled frame is scrollable in the inline axis with
-    // `overflow-clip-box:content-box`. To prevent its content from being
-    // clipped at the scroll container's padding edges, we inflate its
-    // children's scrollable overflow area with its inline padding, and union
-    // its scrollable overflow area with its children's inflated scrollable
-    // overflow area.
-    OverflowAreas childOverflow;
-    mScrolledFrame->UnionChildOverflow(childOverflow);
-    nsRect childScrollableOverflow = childOverflow.ScrollableOverflow();
-
-    const LogicalMargin inlinePadding =
-        padding.ApplySkipSides(LogicalSides(wm, LogicalSides::BBoth));
-    childScrollableOverflow.Inflate(inlinePadding.GetPhysicalMargin(wm));
-
-    nsRect& so = aMetrics->ScrollableOverflow();
-    so = so.UnionEdges(childScrollableOverflow);
-  }
-
   aState.mContentsOverflowAreas = aMetrics->mOverflowAreas;
   aState.mScrollbarGutterFromLastReflow = scrollbarGutter;
   aState.mReflowedContentsWithHScrollbar = aAssumeHScroll;
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index c2db73c81fbd..c3742bfcf27a 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -325,7 +325,7 @@ load 476241-1.html
 load 477731-1.html
 load 477928.html
 load 478131-1.html
-asserts(4) load 478170-1.html # Big sizes
+load 478170-1.html # Big sizes
 pref(layout.css.letter-spacing.model,2) load 478185-1.html
 load 478504.html
 asserts-if(!Android,0-1) load 479938-1.html # Bug 575011
@@ -631,7 +631,7 @@ load text-overflow-form-elements.html
 load text-overflow-iframe.html
 asserts(1-4) load 1225005.html # bug 682647 and bug 448083
 load 1230378.xhtml
-asserts(7) load 1231692-1.html
+asserts(3) load 1231692-1.html
 load 1233191.html
 load 1233607.html
 load 1234701-1.html
diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index 8571dac572bc..79766c71cf5b 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -17,6 +17,7 @@
 #include "mozilla/Baseline.h"
 #include "mozilla/ComputedStyle.h"
 #include "mozilla/DebugOnly.h"
+#include "mozilla/Likely.h"
 #include "mozilla/Maybe.h"
 #include "mozilla/PresShell.h"
 #include "mozilla/ScrollContainerFrame.h"
@@ -59,6 +60,7 @@
 #include "mozilla/RestyleManager.h"
 #include "mozilla/ServoStyleSet.h"
 #include "nsFlexContainerFrame.h"
+#include "nsTextControlFrame.h"
 
 #include "nsBidiPresUtils.h"
 
@@ -260,6 +262,11 @@ static nscolor GetBackplateColor(nsIFrame* aFrame) {
   return NS_ComposeColors(backgroundColor, currentBackgroundColor);
 }
 
+static nsRect GetNormalMarginRect(nsIFrame* aFrame) {
+  auto rect = aFrame->GetMarginRectRelativeToSelf();
+  return rect + aFrame->GetNormalPosition();
+}
+
 #ifdef DEBUG
 #  include "nsBlockDebugFlags.h"
 
@@ -422,7 +429,6 @@ NS_DECLARE_FRAME_PROPERTY_FRAMELIST(FloatsProperty)
 NS_DECLARE_FRAME_PROPERTY_FRAMELIST(PushedFloatsProperty)
 NS_DECLARE_FRAME_PROPERTY_FRAMELIST(OutsideMarkerProperty)
 NS_DECLARE_FRAME_PROPERTY_WITHOUT_DTOR(InsideMarkerProperty, nsIFrame)
-NS_DECLARE_FRAME_PROPERTY_SMALL_VALUE(BlockEndEdgeOfChildrenProperty, nscoord)
 
 //----------------------------------------------------------------------
 
@@ -1699,9 +1705,7 @@ void nsBlockFrame::Reflow(nsPresContext* aPresContext, ReflowOutput& aMetrics,
   }
 
   aMetrics.SetOverflowAreasToDesiredBounds();
-  ComputeOverflowAreas(aMetrics.mOverflowAreas,
-                       trialState.mBlockEndEdgeOfChildren,
-                       aReflowInput.mStyleDisplay);
+  ComputeOverflowAreas(aMetrics.mOverflowAreas, aReflowInput.mStyleDisplay);
   // Factor overflow container child bounds into the overflow area
   aMetrics.mOverflowAreas.UnionWith(trialState.mOcBounds);
   // Factor pushed float child bounds into the overflow area
@@ -2382,13 +2386,6 @@ nscoord nsBlockFrame::ComputeFinalSize(const ReflowInput& aReflowInput,
 
   // Screen out negative block sizes --- can happen due to integer overflows :-(
   finalSize.BSize(wm) = std::max(0, finalSize.BSize(wm));
-
-  if (blockEndEdgeOfChildren != finalSize.BSize(wm) - borderPadding.BEnd(wm)) {
-    SetProperty(BlockEndEdgeOfChildrenProperty(), blockEndEdgeOfChildren);
-  } else {
-    RemoveProperty(BlockEndEdgeOfChildrenProperty());
-  }
-
   aMetrics.SetSize(wm, finalSize);
 
   return blockEndEdgeOfChildren;
@@ -2465,69 +2462,7 @@ void nsBlockFrame::AlignContent(BlockReflowState& aState,
   }
 }
 
-void nsBlockFrame::ConsiderBlockEndEdgeOfChildren(
-    OverflowAreas& aOverflowAreas, nscoord aBEndEdgeOfChildren,
-    const nsStyleDisplay* aDisplay) const {
-  const auto wm = GetWritingMode();
-
-  // Factor in the block-end edge of the children.  Child frames will be added
-  // to the overflow area as we iterate through the lines, but their margins
-  // won't, so we need to account for block-end margins here.
-  // REVIEW: For now, we do this for both visual and scrollable area,
-  // although when we make scrollable overflow area not be a subset of
-  // visual, we can change this.
-
-  if (Style()->GetPseudoType() == PseudoStyleType::scrolledContent) {
-    // If we are a scrolled inner frame, add our block-end padding to our
-    // children's block-end edge.
-    //
-    // Note: aBEndEdgeOfChildren already includes our own block-start padding
-    // because it is relative to our block-start edge of our border-box, which
-    // is the same as our padding-box here.
-    MOZ_ASSERT(GetLogicalUsedBorderAndPadding(wm) == GetLogicalUsedPadding(wm),
-               "A scrolled inner frame shouldn't have any border!");
-    aBEndEdgeOfChildren += GetLogicalUsedPadding(wm).BEnd(wm);
-  }
-
-  // XXX Currently, overflow areas are stored as physical rects, so we have
-  // to handle writing modes explicitly here. If we change overflow rects
-  // to be stored logically, this can be simplified again.
-  if (wm.IsVertical()) {
-    if (wm.IsVerticalLR()) {
-      for (const auto otype : AllOverflowTypes()) {
-        if (!(aDisplay->IsContainLayout() &&
-              otype == OverflowType::Scrollable)) {
-          // Layout containment should force all overflow to be ink (visual)
-          // overflow, so if we're layout-contained, we only add our children's
-          // block-end edge to the ink (visual) overflow -- not to the
-          // scrollable overflow.
-          nsRect& o = aOverflowAreas.Overflow(otype);
-          o.width = std::max(o.XMost(), aBEndEdgeOfChildren) - o.x;
-        }
-      }
-    } else {
-      for (const auto otype : AllOverflowTypes()) {
-        if (!(aDisplay->IsContainLayout() &&
-              otype == OverflowType::Scrollable)) {
-          nsRect& o = aOverflowAreas.Overflow(otype);
-          nscoord xmost = o.XMost();
-          o.x = std::min(o.x, xmost - aBEndEdgeOfChildren);
-          o.width = xmost - o.x;
-        }
-      }
-    }
-  } else {
-    for (const auto otype : AllOverflowTypes()) {
-      if (!(aDisplay->IsContainLayout() && otype == OverflowType::Scrollable)) {
-        nsRect& o = aOverflowAreas.Overflow(otype);
-        o.height = std::max(o.YMost(), aBEndEdgeOfChildren) - o.y;
-      }
-    }
-  }
-}
-
 void nsBlockFrame::ComputeOverflowAreas(OverflowAreas& aOverflowAreas,
-                                        nscoord aBEndEdgeOfChildren,
                                         const nsStyleDisplay* aDisplay) const {
   // XXX_perf: This can be done incrementally.  It is currently one of
   // the things that makes incremental reflow O(N^2).
@@ -2540,22 +2475,57 @@ void nsBlockFrame::ComputeOverflowAreas(OverflowAreas& aOverflowAreas,
   // We rely here on our caller having called SetOverflowAreasToDesiredBounds().
   nsRect frameBounds = aOverflowAreas.ScrollableOverflow();
 
+  const auto wm = GetWritingMode();
+  const auto borderPadding =
+      GetLogicalUsedBorderAndPadding(wm).GetPhysicalMargin(wm);
+  // Compute content-box by subtracting borderPadding off of frame rect.
+  // This gives us a reasonable starting-rect for the child-rect-unioning
+  // below, which we can then inflate by our padding (without needing to
+  // worry about having double-counted our padding or anything).
+  auto frameContentBounds = frameBounds;
+  frameContentBounds.Deflate(borderPadding);
+  // Margin rects (Zero-area rects included) of in-flow children (And floats,
+  // as discussed later) are unioned (starting with the scroller's own
+  // content-box), then inflated by the scroll container's padding...
+  auto inFlowChildBounds = frameContentBounds;
+  // ... While scrollable overflow rects contributed from further descendants
+  // (Regardless of if they're in-flow or out-of-flow) are unioned separately
+  // and their union does not get inflated by the scroll container's padding.
+  auto inFlowScrollableOverflow = frameContentBounds;
+
   for (const auto& line : Lines()) {
+    aOverflowAreas.InkOverflow() =
+        aOverflowAreas.InkOverflow().Union(line.InkOverflowRect());
     if (aDisplay->IsContainLayout()) {
       // If we have layout containment, we should only consider our child's
       // ink overflow, leaving the scrollable regions of the parent
       // unaffected.
-      // Note: scrollable overflow is a subset of ink overflow,
-      // so this has the same affect as unioning the child's visual and
-      // scrollable overflow with its parent's ink overflow.
-      nsRect childVisualRect = line.InkOverflowRect();
-      OverflowAreas childVisualArea = OverflowAreas(childVisualRect, nsRect());
-      aOverflowAreas.UnionWith(childVisualArea);
-    } else {
-      aOverflowAreas.UnionWith(line.GetOverflowAreas());
+      // Note: Any overflow must be treated as ink overflow (As per
+      // https://drafts.csswg.org/css-contain/#containment-layout part 3).
+      // However, by unioning the children's ink overflow, we've already
+      // incorporated its scrollable overflow, since scrollable overflow
+      // is a subset of ink overflow.
+      continue;
     }
+
+    auto lineInFlowChildBounds = line.GetInFlowChildBounds();
+    if (lineInFlowChildBounds) {
+      inFlowChildBounds = inFlowChildBounds.UnionEdges(*lineInFlowChildBounds);
+    }
+    inFlowScrollableOverflow =
+        inFlowScrollableOverflow.Union(line.ScrollableOverflowRect());
   }
 
+  if (Style()->GetPseudoType() == PseudoStyleType::scrolledContent) {
+    // Padding inflation only applies to scrolled containers.
+    const auto paddingInflatedOverflow =
+        ComputePaddingInflatedScrollableOverflow(inFlowChildBounds);
+    aOverflowAreas.UnionAllWith(paddingInflatedOverflow);
+  }
+  // Note: we're using UnionAllWith so as to maintain the invariant of
+  // ink overflow being a superset of scrollable overflow.
+  aOverflowAreas.UnionAllWith(inFlowScrollableOverflow);
+
   // Factor an outside ::marker in; normally the ::marker will be factored
   // into the line-box's overflow areas. However, if the line is a block
   // line then it won't; if there are no lines, it won't. So just
@@ -2565,8 +2535,6 @@ void nsBlockFrame::ComputeOverflowAreas(OverflowAreas& aOverflowAreas,
     aOverflowAreas.UnionAllWith(outsideMarker->GetRect());
   }
 
-  ConsiderBlockEndEdgeOfChildren(aOverflowAreas, aBEndEdgeOfChildren, aDisplay);
-
   if (!overflowClipAxes.isEmpty()) {
     aOverflowAreas.ApplyClipping(frameBounds, overflowClipAxes,
                                  overflowClipMargin);
@@ -2579,12 +2547,113 @@ void nsBlockFrame::ComputeOverflowAreas(OverflowAreas& aOverflowAreas,
 #endif
 }
 
+// Is this scrolled frame part of textarea?
+// This assumes that the passed-in frame is a scrolled frame.
+static bool IsScrolledFrameForTextArea(const nsIFrame* aFrame) {
+  MOZ_ASSERT(aFrame && aFrame->Style()->GetPseudoType() ==
+                           PseudoStyleType::scrolledContent,
+             "expecting a scrolled frame");
+  // If we're `textarea`, our grandparent element must be the text control
+  // element that we can query.
+  const auto* parent = aFrame->GetParent();
+  if (!parent) {
+    return false;
+  }
+  MOZ_ASSERT(parent->IsScrollContainerOrSubclass(), "Not a scrolled frame?");
+  // `textarea` is guaranteed to have one of these pseudoelements:
+  // ::placeholder, the ::-moz-text-control-editing-root and the preview.
+  if (!parent->Style()->IsPseudoElement()) {
+    return false;
+  }
+  const auto* grandParent = parent->GetParent();
+  if (!grandParent) {
+    return false;
+  }
+  const auto* textControlElement =
+      mozilla::TextControlElement::FromNodeOrNull(grandParent->GetContent());
+  if (!textControlElement) {
+    return false;
+  }
+  return textControlElement->IsTextArea();
+}
+
+nsRect nsBlockFrame::ComputePaddingInflatedScrollableOverflow(
+    const nsRect& aInFlowChildBounds) const {
+  MOZ_ASSERT(Style()->GetPseudoType() == PseudoStyleType::scrolledContent,
+             "Expected scrolled frame");
+  auto result = aInFlowChildBounds;
+  const auto wm = GetWritingMode();
+  auto padding = GetLogicalUsedPadding(wm);
+  MOZ_ASSERT(GetLogicalUsedBorderAndPadding(wm) == padding,
+             "A scrolled inner frame shouldn't have any border!");
+  // HACK(dshin): Reaching out and querying the type like this isn't ideal.
+  // However, we use `textarea` as a special case of a div, but based on
+  // web-platform-tests, different rules apply for it - namely, no inline
+  // padding inflation. See
+  // `textarea-padding-iend-overlaps-content-001.tentative.html`.
+  if (MOZ_UNLIKELY(IsScrolledFrameForTextArea(this))) {
+    padding.IStart(wm) = padding.IEnd(wm) = 0;
+  }
+  result.Inflate(padding.GetPhysicalMargin(wm));
+  return result;
+}
+
+Maybe<nsRect> nsBlockFrame::GetLineFrameInFlowBounds(
+    const nsLineBox& aLine, const nsIFrame& aLineChildFrame) const {
+  MOZ_ASSERT(aLineChildFrame.GetParent() == this,
+             "Line's frame doesn't belong to this block frame?");
+  if (aLineChildFrame.IsPlaceholderFrame()) {
+    return Nothing{};
+  }
+  if (aLine.IsInline()) {
+    return Some(aLineChildFrame.GetMarginRectRelativeToSelf() +
+                aLineChildFrame.GetNormalPosition());
+  }
+  const auto wm = GetWritingMode();
+  // Ensure we use the margin we actually carried out.
+  auto logicalMargin = aLineChildFrame.GetLogicalUsedMargin(wm);
+  logicalMargin.BEnd(wm) = aLine.GetCarriedOutBEndMargin().Get();
+
+  const auto linePoint = aLine.GetPhysicalBounds().TopLeft();
+  // Special handling is required for boxes of zero block size, which carry
+  // out margin collapsing with themselves. We end up "rewinding" the line
+  // position after carrying out the block start margin. This is not reflected
+  // in the zero-sized frame's own frame-position.
+  const auto normalPosition = aLineChildFrame.GetLogicalSize(wm).BSize(wm) == 0
+                                  ? linePoint
+                                  : aLineChildFrame.GetNormalPosition();
+  const auto margin = logicalMargin.GetPhysicalMargin(wm).ApplySkipSides(
+      aLineChildFrame.GetSkipSides());
+  auto rect = aLineChildFrame.GetRectRelativeToSelf();
+  rect.Inflate(margin);
+  return Some(rect + normalPosition);
+}
+
 void nsBlockFrame::UnionChildOverflow(OverflowAreas& aOverflowAreas,
                                       bool aAsIfScrolled) {
   // We need to update the overflow areas of lines manually, as they
   // get cached and re-used otherwise. Lines aren't exposed as normal
   // frame children, so calling UnionChildOverflow alone will end up
   // using the old cached values.
+  const auto wm = GetWritingMode();
+  const auto borderPadding =
+      GetLogicalUsedBorderAndPadding(wm).GetPhysicalMargin(wm);
+  // Overflow area computed here should agree with one computed in
+  // `ComputeOverflowAreas` (See bug 1800939 and bug 1800719). So the
+  // documentation in that function applies here as well.
+  const bool isScrolled =
+      Style()->GetPseudoType() == PseudoStyleType::scrolledContent;
+
+  // Relying on aOverflowAreas having been set to frame border rect.
+  auto frameContentBounds = aOverflowAreas.ScrollableOverflow();
+  frameContentBounds.Deflate(borderPadding);
+  // We need to take in-flow children's margin rect into account, and inflate
+  // it by the padding.
+  auto inFlowChildBounds = frameContentBounds;
+  auto inFlowScrollableOverflow = frameContentBounds;
+
+  const auto inkOverflowOnly = StyleDisplay()->IsContainLayout();
+
   for (auto& line : Lines()) {
     nsRect bounds = line.GetPhysicalBounds();
     OverflowAreas lineAreas(bounds, bounds);
@@ -2592,20 +2661,46 @@ void nsBlockFrame::UnionChildOverflow(OverflowAreas& aOverflowAreas,
     int32_t n = line.GetChildCount();
     for (nsIFrame* lineFrame = line.mFirstChild; n > 0;
          lineFrame = lineFrame->GetNextSibling(), --n) {
+      // Ensure this is called for each frame in the line
       ConsiderChildOverflow(lineAreas, lineFrame);
+
+      if (inkOverflowOnly || !isScrolled) {
+        continue;
+      }
+
+      if (auto lineFrameBounds = GetLineFrameInFlowBounds(line, *lineFrame)) {
+        inFlowChildBounds = inFlowChildBounds.UnionEdges(*lineFrameBounds);
+      }
     }
 
     // Consider the overflow areas of the floats attached to the line as well
     if (line.HasFloats()) {
       for (nsIFrame* f : line.Floats()) {
         ConsiderChildOverflow(lineAreas, f);
+        if (inkOverflowOnly || !isScrolled) {
+          continue;
+        }
+        inFlowChildBounds =
+            inFlowChildBounds.UnionEdges(GetNormalMarginRect(f));
       }
     }
 
     line.SetOverflowAreas(lineAreas);
-    aOverflowAreas.UnionWith(lineAreas);
+    aOverflowAreas.InkOverflow() =
+        aOverflowAreas.InkOverflow().Union(lineAreas.InkOverflow());
+    if (!inkOverflowOnly) {
+      inFlowScrollableOverflow =
+          inFlowScrollableOverflow.Union(lineAreas.ScrollableOverflow());
+    }
   }
 
+  if (isScrolled) {
+    const auto paddingInflatedOverflow =
+        ComputePaddingInflatedScrollableOverflow(inFlowChildBounds);
+    aOverflowAreas.UnionAllWith(paddingInflatedOverflow);
+  }
+  aOverflowAreas.UnionAllWith(inFlowScrollableOverflow);
+
   // Union with child frames, skipping the principal and float lists
   // since we already handled those using the line boxes.
   nsLayoutUtils::UnionChildOverflow(
@@ -2614,14 +2709,6 @@ void nsBlockFrame::UnionChildOverflow(OverflowAreas& aOverflowAreas,
 }
 
 bool nsBlockFrame::ComputeCustomOverflow(OverflowAreas& aOverflowAreas) {
-  bool found;
-  nscoord blockEndEdgeOfChildren =
-      GetProperty(BlockEndEdgeOfChildrenProperty(), &found);
-  if (found) {
-    ConsiderBlockEndEdgeOfChildren(aOverflowAreas, blockEndEdgeOfChildren,
-                                   StyleDisplay());
-  }
-
   // Line cursor invariants depend on the overflow areas of the lines, so
   // we must clear the line cursor since those areas may have changed.
   ClearLineCursors();
@@ -4573,6 +4660,15 @@ void nsBlockFrame::ReflowBlockFrame(BlockReflowState& aState,
         }
       }
 
+      if (Style()->GetPseudoType() == PseudoStyleType::scrolledContent) {
+        auto lineFrameBounds = GetLineFrameInFlowBounds(*aLine, *frame);
+        MOZ_ASSERT(aLine->GetChildCount() == 1,
+                   "More than one child in block line?");
+        // Inline-line (i.e. Multiple frames in one line) handled in one of
+        // other callsites.
+        aLine->SetInFlowChildBounds(lineFrameBounds);
+      }
+
       aLine->SetOverflowAreas(overflowAreas);
       if (*aKeepReflowGoing) {
         // Some of the child block fit
@@ -5555,6 +5651,23 @@ bool nsBlockFrame::PlaceLine(BlockReflowState& aState,
   // might have moved frames around!
   OverflowAreas overflowAreas;
   aLineLayout.RelativePositionFrames(overflowAreas);
+  if (Style()->GetPseudoType() == PseudoStyleType::scrolledContent) {
+    Maybe<nsRect> inFlowBounds;
+    int32_t n = aLine->GetChildCount();
+    for (nsIFrame* lineFrame = aLine->mFirstChild; n > 0;
+         lineFrame = lineFrame->GetNextSibling(), --n) {
+      auto lineFrameBounds = GetLineFrameInFlowBounds(*aLine, *lineFrame);
+      if (!lineFrameBounds) {
+        continue;
+      }
+      if (inFlowBounds) {
+        *inFlowBounds = inFlowBounds->UnionEdges(*lineFrameBounds);
+      } else {
+        inFlowBounds = Some(*lineFrameBounds);
+      }
+    }
+    aLine->SetInFlowChildBounds(inFlowBounds);
+  }
   aLine->SetOverflowAreas(overflowAreas);
   if (addedMarker) {
     aLineLayout.RemoveMarkerFrame(GetOutsideMarker());
@@ -5631,6 +5744,18 @@ bool nsBlockFrame::PlaceLine(BlockReflowState& aState,
     OverflowAreas lineOverflowAreas = aState.mFloatOverflowAreas;
     lineOverflowAreas.UnionWith(aLine->GetOverflowAreas());
     aLine->SetOverflowAreas(lineOverflowAreas);
+    if (Style()->GetPseudoType() == PseudoStyleType::scrolledContent) {
+      auto itr = aLine->Floats().begin();
+      // Guaranteed to have at least 1 element since `HasFloats()` is true.
+      auto floatRect = GetNormalMarginRect(*itr);
+      ++itr;
+      for (; itr != aLine->Floats().end(); ++itr) {
+        floatRect = floatRect.UnionEdges(GetNormalMarginRect(*itr));
+      }
+      auto inFlowBounds = aLine->GetInFlowChildBounds();
+      aLine->SetInFlowChildBounds(
+          Some(inFlowBounds ? inFlowBounds->UnionEdges(floatRect) : floatRect));
+    }
 
 #ifdef NOISY_OVERFLOW_AREAS
     printf("%s: Line %p, InkOverflowRect=%s, ScrollableOverflowRect=%s\n",
diff --git a/layout/generic/nsBlockFrame.h b/layout/generic/nsBlockFrame.h
index 031d541fe625..58bc1fe1ea77 100644
--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -268,6 +268,11 @@ class nsBlockFrame : public nsContainerFrame {
 
   void CheckIntrinsicCacheAgainstShrinkWrapState();
 
+  nsRect ComputePaddingInflatedScrollableOverflow(
+      const nsRect& aInFlowChildBounds) const;
+  Maybe<nsRect> GetLineFrameInFlowBounds(const nsLineBox& aLine,
+                                         const nsIFrame& aLineChildFrame) const;
+
   template <typename LineIteratorType>
   Maybe<nscoord> GetBaselineBOffset(LineIteratorType aStart,
                                     LineIteratorType aEnd,
@@ -503,17 +508,8 @@ class nsBlockFrame : public nsContainerFrame {
    * children, and includes them into aOverflowAreas.
    */
   void ComputeOverflowAreas(mozilla::OverflowAreas& aOverflowAreas,
-                            nscoord aBEndEdgeOfChildren,
                             const nsStyleDisplay* aDisplay) const;
 
-  /**
-   * Helper method for ComputeOverflowAreas(). Incorporates aBEndEdgeOfChildren
-   * into the aOverflowAreas.
-   */
-  void ConsiderBlockEndEdgeOfChildren(mozilla::OverflowAreas& aOverflowAreas,
-                                      nscoord aBEndEdgeOfChildren,
-                                      const nsStyleDisplay* aDisplay) const;
-
   /**
    * Add the frames in aFrameList to this block after aPrevSibling.
    * This block thinks in terms of lines, but the frame construction code
diff --git a/layout/generic/nsLineBox.cpp b/layout/generic/nsLineBox.cpp
index d3787edc5003..e3085a810a17 100644
--- a/layout/generic/nsLineBox.cpp
+++ b/layout/generic/nsLineBox.cpp
@@ -243,6 +243,12 @@ void nsLineBox::List(FILE* out, const char* aPrefix,
                              nsIFrame::ConvertToString(vo, aFlags).c_str(),
                              nsIFrame::ConvertToString(so, aFlags).c_str());
     }
+    if (mData->mInFlowChildBounds) {
+      str += nsPrintfCString(
+          "in-flow-scr-overflow=%s ",
+          nsIFrame::ConvertToString(*mData->mInFlowChildBounds, aFlags)
+              .c_str());
+    }
   }
   fprintf_stderr(out, "%s<\n", str.get());
 
@@ -450,7 +456,10 @@ bool nsLineBox::SetCarriedOutBEndMargin(CollapsingMargin aValue) {
 
 void nsLineBox::MaybeFreeData() {
   nsRect bounds = GetPhysicalBounds();
-  if (mData && mData->mOverflowAreas == OverflowAreas(bounds, bounds)) {
+  // If we have space allocated for additional data but no additional data to
+  // represent, just delete it.
+  if (mData && mData->mOverflowAreas == OverflowAreas(bounds, bounds) &&
+      !mData->mInFlowChildBounds) {
     if (IsInline()) {
       if (mInlineData->mFloats.IsEmpty()) {
         delete mInlineData;
@@ -546,6 +555,30 @@ void nsLineBox::SetOverflowAreas(const OverflowAreas& aOverflowAreas) {
   }
 }
 
+void nsLineBox::SetInFlowChildBounds(const Maybe<nsRect>& aInFlowChildBounds) {
+  if (aInFlowChildBounds) {
+    if (!mData) {
+      nsRect bounds = GetPhysicalBounds();
+      if (IsInline()) {
+        mInlineData = new ExtraInlineData(bounds);
+      } else {
+        mBlockData = new ExtraBlockData(bounds);
+      }
+    }
+    mData->mInFlowChildBounds = aInFlowChildBounds;
+  } else if (mData) {
+    mData->mInFlowChildBounds = Nothing{};
+    MaybeFreeData();
+  }
+}
+
+Maybe<nsRect> nsLineBox::GetInFlowChildBounds() const {
+  if (!mData) {
+    return Nothing{};
+  }
+  return mData->mInFlowChildBounds;
+}
+
 //----------------------------------------------------------------------
 
 Result<nsILineIterator::LineInfo, nsresult> nsLineIterator::GetLine(
diff --git a/layout/generic/nsLineBox.h b/layout/generic/nsLineBox.h
index 226f41393e60..86d3ff47a07e 100644
--- a/layout/generic/nsLineBox.h
+++ b/layout/generic/nsLineBox.h
@@ -306,6 +306,10 @@ class nsLineBox final : public nsLineLink {
     return GetOverflowArea(mozilla::OverflowType::Scrollable);
   }
 
+  // See comment on `mInFlowChildBounds`.
+  void SetInFlowChildBounds(const mozilla::Maybe<nsRect>& aInFlowChildBounds);
+  mozilla::Maybe<nsRect> GetInFlowChildBounds() const;
+
   void SlideBy(nscoord aDBCoord, const nsSize& aContainerSize) {
     NS_ASSERTION(
         aContainerSize == mContainerSize || mContainerSize == nsSize(-1, -1),
@@ -321,6 +325,9 @@ class nsLineBox final : public nsLineLink {
       for (const auto otype : mozilla::AllOverflowTypes()) {
         mData->mOverflowAreas.Overflow(otype) += physicalDelta;
       }
+      if (mData->mInFlowChildBounds) {
+        *mData->mInFlowChildBounds += physicalDelta;
+      }
     }
   }
 
@@ -338,6 +345,9 @@ class nsLineBox final : public nsLineLink {
       for (const auto otype : mozilla::AllOverflowTypes()) {
         mData->mOverflowAreas.Overflow(otype) += physicalDelta;
       }
+      if (mData->mInFlowChildBounds) {
+        *mData->mInFlowChildBounds += physicalDelta;
+      }
     }
     return delta;
   }
@@ -524,6 +534,12 @@ class nsLineBox final : public nsLineLink {
     explicit ExtraData(const nsRect& aBounds)
         : mOverflowAreas(aBounds, aBounds) {}
     mozilla::OverflowAreas mOverflowAreas;
+    // Union of the margin-boxes of our in-flow children (only children,
+    // *not* their descendants). This is part of a special contribution to
+    // the scrollable overflow of a scrolled block; as such, this is only
+    // emplaced if our block is a scrolled frame (and we have in-flow children,
+    // and floats, which are considered in-flow for scrollable overflow).
+    mozilla::Maybe<nsRect> mInFlowChildBounds;
   };
 
   struct ExtraBlockData : public ExtraData {
diff --git a/layout/reftests/bugs/458296-1c.html b/layout/reftests/bugs/458296-1c.html
deleted file mode 100644
index 98bbf4bdeee0..000000000000
--- a/layout/reftests/bugs/458296-1c.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<body>
-<div style="overflow:auto; width:300px; height:300px; background:green;">
-  <div style="height:100px; margin-top:100px;">
-    <div style="height:200px; margin-left:100px; width:100px; margin-bottom:100px; margin-right:100px; background:yellow;"></div>
-  </div>
-</div>
-</body>
-</html>
diff --git a/layout/reftests/bugs/825999-ref.html b/layout/reftests/bugs/825999-ref.html
index 057d13192848..8bc2903881df 100644
--- a/layout/reftests/bugs/825999-ref.html
+++ b/layout/reftests/bugs/825999-ref.html
@@ -29,6 +29,18 @@
                 vertical-align:top;
                 background:lime;
                 width:36px;
+                position: relative;
+            }
+            x > span ~ div {
+                /* See the test file - we sized the span to ensure that <span>
+                   fits within <x>'s content box, so we need to occlude the
+                   part visible in the padding area. */
+                position: absolute;
+                right: 0px;
+                top: 0px;
+                width: 1px;
+                height: 100%;
+                background: lime;
             }
             .bb * {
                 box-sizing: border-box;
@@ -66,7 +78,7 @@
       </div>
       <div class="cb">
         <p>testing</p>
-        <x><span>testing</span></x>
+        <x><span>testing</span><div class="padding-inflation"></div></x>
         <button>testing</button>
         <select size=1><option>testing</select>
         <select size=3><option>testing<option>testing<option>testing</select>
diff --git a/layout/reftests/bugs/825999.html b/layout/reftests/bugs/825999.html
index eef708f888f3..1c9f494a116b 100644
--- a/layout/reftests/bugs/825999.html
+++ b/layout/reftests/bugs/825999.html
@@ -30,6 +30,12 @@
                 background:lime;
                 width:36px;
             }
+            x > span {
+                /* As of bug 1768921, <x>'s padding on right contributes to the
+                   scroller, so pull back on <span>'s right side padding by that
+                   of <x>'s. */
+                padding-right: 16px;
+            }
             .bb * {
                 box-sizing: border-box;
             }
diff --git a/layout/reftests/bugs/966992-1-ref.html b/layout/reftests/bugs/966992-1-ref.html
index 7d9234fa839b..0a0058dcf846 100644
--- a/layout/reftests/bugs/966992-1-ref.html
+++ b/layout/reftests/bugs/966992-1-ref.html
@@ -28,7 +28,7 @@ p {
 }
 .rel { position:relative; }
 .mask1 { position:absolute; width:20px; background:white; top:0; bottom:0; right:0; }
-.mask2 { position:absolute; width:20px; background:white; top:0px; bottom:-15px; right:220px; z-index:99; }
+.mask2 { position:absolute; width:20px; background:white; top:0px; bottom:-15px; right:200px; z-index:99; }
 .mask3 { position:absolute; width:20px; background:white; top:0; bottom:0; left:200px; }
 .mask4 { position:absolute; height:40px; background:white; top:4px; left:3px; width:210px; z-index:99; }
 .mask5 { position:absolute; height:40px; background:white; top:3px; right:3px; width:50px; }
@@ -37,20 +37,6 @@ p {
 </head>
 <body>
 
-<div class="rel block">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<p style="padding-right:20px"></p><div class=mask1></div></div>
-<div style="float:right">
-
-<div class="rel block" style="box-sizing:border-box;height:90px"><span style="padding-right:20px">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</span><div class=mask1></div></div>
-
-</div>
-
-<div class="rel block"><span style="padding-right:20px">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</span><p></p><div class=mask1></div></div>
-<div id="d1" class="rel block"><span style="padding-right:20px">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</span><span style="position:relative;"><div class=mask2></div><div class=mask1></div></span><p></p></div>
-<script>
-document.getElementById("d1").scrollLeft = "100000";
-</script>
-<div class="block"><span style="padding-right:20px"><span style="position:relative;"><div class=mask3></div>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</span></span><p></p></div>
-
 <span style="position:relative"><input spellcheck=false type="text" placeholder="someveryveryveryveryverylongvalue"><div class=mask5></div></span>
 <span style="position:relative"><input spellcheck=false type="text" value="someveryveryveryveryverylongvalue"><div class=mask5></div></span><br>
 <span style="position:relative"><input spellcheck=false type="password" value="someveryveryveryveryverylongpassword"><div class=mask5></div></span>
diff --git a/layout/reftests/bugs/966992-1.html b/layout/reftests/bugs/966992-1.html
index 2038c613ed58..44a84fa3afde 100644
--- a/layout/reftests/bugs/966992-1.html
+++ b/layout/reftests/bugs/966992-1.html
@@ -14,19 +14,6 @@ input {
   font-family: monospace;
 }
 
-p {
- position:absolute;
- margin:0;
- width:70%;
- height: 1px;
- background:magenta;
-}
-.rel p { width:200%; }
-.block {
-  border:1px solid grey; height:50px; width:200px; padding:20px;
-  overflow:auto; overflow-clip-box:content-box;
-}
-.rel { position:relative; }
 .button { width:0px; padding:0 50px; overflow:hidden; }
 .pb { overflow-clip-box:padding-box; }
 .cb { overflow-clip-box:content-box; }
@@ -34,19 +21,6 @@ p {
 </head>
 <body>
 
-<div class="rel block">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<p></p></div>
-<div style="float:right">
-
-<div class="block" style="-moz-box-sizing:border-box;height:90px">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</div>
-</div>
-
-<div class="rel block">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<p></p></div>
-<div id="d1" class="rel block">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<p></p></div>
-<script>
-document.getElementById("d1").scrollLeft = "100000";
-</script>
-<div class="block">XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<p></p></div>
-
 <input spellcheck=false type="text" placeholder="someveryveryveryveryverylongvalue">
 <input spellcheck=false type="text" value="someveryveryveryveryverylongvalue"><br>
 <input spellcheck=false type="password" value="someveryveryveryveryverylongpassword">
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index b0b0c1179b90..e43e7eeebe12 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -1167,7 +1167,6 @@ fuzzy(0-10,0-8) == 456219-2.html 456219-2-ref.html
 == 457398-2.html 457398-2-ref.html
 == 458296-1a.html 458296-1-ref.html
 == 458296-1b.html 458296-1-ref.html
-== 458296-1c.html 458296-1-ref.html
 == 458296-1d.html 458296-1-ref.html
 == 458487-1a.html 458487-1-ref.html
 == 458487-1b.html 458487-1-ref.html
diff --git a/layout/reftests/margin-collapsing/scrollable-horizontal-margin-ref.html b/layout/reftests/margin-collapsing/scrollable-horizontal-margin-ref.html
index 358c1f2bbc49..1ffd1f6f58b0 100644
--- a/layout/reftests/margin-collapsing/scrollable-horizontal-margin-ref.html
+++ b/layout/reftests/margin-collapsing/scrollable-horizontal-margin-ref.html
@@ -1,17 +1,17 @@
 <!DOCTYPE HTML>
 <html><head>
     <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
-    <title>Testcase for bug 724352</title>
+    <title>Testcase for bug 1768921</title>
     <style type="text/css">
 
         html,body {
             color:black; background-color:white; font-size:16px; padding:0; margin:0;
         }
-	
+
 x1,x2,x3,x4,x5,x6 { display:block; }
 x2 { overflow:auto; width:100px; background:grey; }
 x4 { width: 70px; }
-x3 { width: 70px; padding-left: 20px; padding-right: 10px; }
+x3 { width: 70px; padding-left: 20px; padding-right: 20px; }
     </style>
 </head>
 <body>
diff --git a/layout/reftests/margin-collapsing/scrollable-horizontal-margin.html b/layout/reftests/margin-collapsing/scrollable-horizontal-margin.html
index 5616b36fca54..9bd02800b002 100644
--- a/layout/reftests/margin-collapsing/scrollable-horizontal-margin.html
+++ b/layout/reftests/margin-collapsing/scrollable-horizontal-margin.html
@@ -1,13 +1,15 @@
 <!DOCTYPE HTML>
 <html><head>
     <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
-    <title>Testcase for bug 724352</title>
+    <title>Testcase for bug 1768921</title>
+    <!-- Previously for bug 724352, but bug 1768921 flips the expectation to ensure that
+    margin rect is accounted into scrollable overflow. -->
     <style type="text/css">
 
         html,body {
             color:black; background-color:white; font-size:16px; padding:0; margin:0;
         }
-	
+
 x1,x2,x3,x4,x5,x6 { display:block; }
 x2 { overflow:auto; width:100px; background:grey; }
 x4 { width: 70px; margin: 0 20px; }
diff --git a/layout/reftests/position-sticky/padding-3-ref.html b/layout/reftests/position-sticky/padding-3-ref.html
index 54b81e9b534a..e870d6005349 100644
--- a/layout/reftests/position-sticky/padding-3-ref.html
+++ b/layout/reftests/position-sticky/padding-3-ref.html
@@ -32,7 +32,7 @@
   <body>
     <div id="scroll">
       <div id="inner">
-        <div style="width: 100px; height: 110px"></div>
+        <div style="width: 110px; height: 110px"></div>
         <div id="sticky"></div>
       </div>
     </div>
diff --git a/layout/tables/crashtests/crashtests.list b/layout/tables/crashtests/crashtests.list
index 58bdad5c788b..facb4d4de40d 100644
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -108,8 +108,8 @@ asserts(8) load 420654-1.xhtml # bug 458238, bug 436123, bug 457397
 load 423514-1.xhtml
 load 430374.html
 load 444431-1.html
-asserts(3) load 444702-1.html # nscoord overflow.
-asserts(4) load 448988-1.xhtml # nscoord overflow.
+asserts(1) load 444702-1.html # nscoord overflow.
+load 448988-1.xhtml # nscoord overflow.
 load 450311-1.html
 load 451170.html
 load 451355-1.html
diff --git a/testing/web-platform/meta/css/CSS2/normal-flow/inline-block-replaced-width-008.xht.ini b/testing/web-platform/meta/css/CSS2/normal-flow/inline-block-replaced-width-008.xht.ini
deleted file mode 100644
index 2b1206fe225b..000000000000
--- a/testing/web-platform/meta/css/CSS2/normal-flow/inline-block-replaced-width-008.xht.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[inline-block-replaced-width-008.xht]
-  expected:
-    FAIL
diff --git a/testing/web-platform/meta/css/CSS2/normal-flow/inline-replaced-width-009.xht.ini b/testing/web-platform/meta/css/CSS2/normal-flow/inline-replaced-width-009.xht.ini
deleted file mode 100644
index 28501d3edd1a..000000000000
--- a/testing/web-platform/meta/css/CSS2/normal-flow/inline-replaced-width-009.xht.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[inline-replaced-width-009.xht]
-  expected:
-    FAIL
diff --git a/testing/web-platform/meta/css/css-contain/content-visibility/content-visibility-090.html.ini b/testing/web-platform/meta/css/css-contain/content-visibility/content-visibility-090.html.ini
new file mode 100644
index 000000000000..ea99d97140dc
--- /dev/null
+++ b/testing/web-platform/meta/css/css-contain/content-visibility/content-visibility-090.html.ini
@@ -0,0 +1,3 @@
+[content-visibility-090.html]
+  [Content Visibility: scrollLeft/scrollTop/scrollWidth/scrollHeight measure correctly]
+    expected: FAIL
diff --git a/testing/web-platform/meta/css/css-overflow/margin-block-end-scroll-area-001.html.ini b/testing/web-platform/meta/css/css-overflow/margin-block-end-scroll-area-001.html.ini
new file mode 100644
index 000000000000..95f2fa562b4b
--- /dev/null
+++ b/testing/web-platform/meta/css/css-overflow/margin-block-end-scroll-area-001.html.ini
@@ -0,0 +1,2 @@
+[margin-block-end-scroll-area-001.html]
+  expected: FAIL
diff --git a/testing/web-platform/meta/css/css-overflow/orthogonal-flow-with-inline-end-margin.html.ini b/testing/web-platform/meta/css/css-overflow/orthogonal-flow-with-inline-end-margin.html.ini
deleted file mode 100644
index 36544fb8abb8..000000000000
--- a/testing/web-platform/meta/css/css-overflow/orthogonal-flow-with-inline-end-margin.html.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[orthogonal-flow-with-inline-end-margin.html]
-  [Scrollable container with orthogonal writing-mode child with inline-end margin]
-    expected: FAIL
diff --git a/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-002.html.ini b/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-002.html.ini
index 9ebb94b7e70b..9fd9d496a40a 100644
--- a/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-002.html.ini
+++ b/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-002.html.ini
@@ -1,3 +1,3 @@
 [overflow-clip-margin-002.html]
-  bug: Relies on non-overlay scrollbars so that scrollbars have the same length. Also Android doesn't paint scrollbar track
+  bug: Relies on non-overlay scrollbars so that scrollbars have the same length.
   expected: [PASS, FAIL]
diff --git a/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-005.html.ini b/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-005.html.ini
index 8b664d0303c5..b091720c3936 100644
--- a/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-005.html.ini
+++ b/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-005.html.ini
@@ -1,3 +1,3 @@
 [overflow-clip-margin-005.html]
-  bug: Relies on non-overlay scrollbars so that scrollbars have the same length. Also Android doesn't paint scrollbar track
+  bug: Relies on non-overlay scrollbars so that scrollbars have the same length.
   expected: [PASS, FAIL]
diff --git a/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-007.html.ini b/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-007.html.ini
deleted file mode 100644
index c27eae03e415..000000000000
--- a/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-007.html.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[overflow-clip-margin-007.html]
-  expected: FAIL
-  bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1820266
diff --git a/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-012.html.ini b/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-012.html.ini
deleted file mode 100644
index 56a3788347a1..000000000000
--- a/testing/web-platform/meta/css/css-overflow/overflow-clip-margin-012.html.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[overflow-clip-margin-012.html]
-  expected: FAIL
-  bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1820266
diff --git a/testing/web-platform/meta/css/css-overflow/overflow-padding.html.ini b/testing/web-platform/meta/css/css-overflow/overflow-padding.html.ini
deleted file mode 100644
index b480206798f7..000000000000
--- a/testing/web-platform/meta/css/css-overflow/overflow-padding.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[overflow-padding.html]
-  expected:
-    if (os == "android") and fission: [OK, TIMEOUT]
-  [Container padding is applied approriately to block/inline children.]
-    expected: FAIL
diff --git a/testing/web-platform/meta/css/css-overflow/scrollable-overflow-padding.html.ini b/testing/web-platform/meta/css/css-overflow/scrollable-overflow-padding.html.ini
index c1316ad482ae..a902b1986cda 100644
--- a/testing/web-platform/meta/css/css-overflow/scrollable-overflow-padding.html.ini
+++ b/testing/web-platform/meta/css/css-overflow/scrollable-overflow-padding.html.ini
@@ -1,65 +1,9 @@
 [scrollable-overflow-padding.html]
-  [scrollable-container 2]
-    expected: FAIL
-
-  [scrollable-container 4]
-    expected: FAIL
-
-  [scrollable-container 7]
-    expected: FAIL
-
-  [scrollable-container 9]
-    expected: FAIL
-
-  [scrollable-container 12]
-    expected: FAIL
-
-  [scrollable-container 14]
-    expected: FAIL
-
-  [scrollable-container 17]
-    expected: FAIL
-
-  [scrollable-container 19]
-    expected: FAIL
-
-  [scrollable-container 22]
-    expected: FAIL
-
-  [scrollable-container 24]
-    expected: FAIL
-
-  [scrollable-container 27]
-    expected: FAIL
-
-  [scrollable-container 29]
-    expected: FAIL
-
-  [scrollable-container 6]
-    expected:
-      if os == "android": FAIL
-
   [scrollable-container 1]
     expected:
-      if os == "android": FAIL
+      if os == "android": FAIL # Due to viewport scaling causing rounding error, see Bug 1930227
 
-  [scrollable-container 5]
-    expected:
-      if os == "android": FAIL
-
-  [scrollable-container 28]
-    expected:
-      if os == "android": FAIL
-
-  [scrollable-container 21]
-    expected:
-      if os == "android": FAIL
-
-  [scrollable-container 18]
-    expected:
-      if os == "android": FAIL
-
-  [scrollable-container 8]
+  [scrollable-container 2]
     expected:
       if os == "android": FAIL
 
@@ -67,11 +11,27 @@
     expected:
       if os == "android": FAIL
 
-  [scrollable-container 20]
+  [scrollable-container 4]
     expected:
       if os == "android": FAIL
 
-  [scrollable-container 30]
+  [scrollable-container 5]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 6]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 7]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 8]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 9]
     expected:
       if os == "android": FAIL
 
@@ -79,7 +39,11 @@
     expected:
       if os == "android": FAIL
 
-  [scrollable-container 23]
+  [scrollable-container 12]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 14]
     expected:
       if os == "android": FAIL
 
@@ -87,6 +51,30 @@
     expected:
       if os == "android": FAIL
 
+  [scrollable-container 18]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 20]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 21]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 22]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 23]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 24]
+    expected:
+      if os == "android": FAIL
+
   [scrollable-container 25]
     expected:
       if os == "android": FAIL
@@ -94,3 +82,11 @@
   [scrollable-container 26]
     expected:
       if os == "android": FAIL
+
+  [scrollable-container 28]
+    expected:
+      if os == "android": FAIL
+
+  [scrollable-container 30]
+    expected:
+      if os == "android": FAIL
diff --git a/testing/web-platform/meta/css/cssom-view/scrollWidthHeight.xht.ini b/testing/web-platform/meta/css/cssom-view/scrollWidthHeight.xht.ini
deleted file mode 100644
index b361af7f21c7..000000000000
--- a/testing/web-platform/meta/css/cssom-view/scrollWidthHeight.xht.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[scrollWidthHeight.xht]
-  expected:
-    if (os == "win") and not debug and (processor == "x86_64"): [OK, TIMEOUT]
-    if (os == "android") and fission: [OK, TIMEOUT]
-  [elemOverflow.scrollHeight is the width of its scrolled contents (including padding)]
-    expected: FAIL
diff --git a/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vlr-in-htb-008-ref.xht b/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vlr-in-htb-008-ref.xht
index d41cd933936d..8e2e1df3d623 100644
--- a/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vlr-in-htb-008-ref.xht
+++ b/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vlr-in-htb-008-ref.xht
@@ -52,7 +52,6 @@
   p#sentence-after
     {
       left: 8px;
-      padding-bottom: 16px;
       position: absolute;
       top: calc(136px + 3px + 50ch + 3px);
       /*
diff --git a/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vlr-in-htb-020-ref.xht b/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vlr-in-htb-020-ref.xht
index 603732b7af8f..0386d61be504 100644
--- a/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vlr-in-htb-020-ref.xht
+++ b/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vlr-in-htb-020-ref.xht
@@ -49,7 +49,6 @@
   p#sentence-after
     {
       left: 8px;
-      padding-bottom: 1em;
       position: absolute;
       top: calc(52px + 3px + 50ch + 3px);
       /*
diff --git a/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vrl-in-htb-008-ref.xht b/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vrl-in-htb-008-ref.xht
index 76fc0844c288..ab3953790ff3 100644
--- a/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vrl-in-htb-008-ref.xht
+++ b/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vrl-in-htb-008-ref.xht
@@ -50,7 +50,6 @@
 
   p#sentence-after
     {
-      padding-bottom: 1em;
       top: calc(136px + 3px + 50ch + 3px);
       /*
       50ch means 50 ch unit where each ch is equal to
diff --git a/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vrl-in-htb-020-ref.xht b/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vrl-in-htb-020-ref.xht
index 12f5d4c413e1..d274465d354e 100644
--- a/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vrl-in-htb-020-ref.xht
+++ b/testing/web-platform/tests/css/css-writing-modes/sizing-orthog-vrl-in-htb-020-ref.xht
@@ -48,7 +48,6 @@
 
   p#sentence-after
     {
-      padding-bottom: 1em;
       top: calc(52px + 3px + 50ch + 3px);
       /*
       50ch means 50 ch unit where each ch is equal to