Bug 936988. nsCSSFrameConstructor::IsValidSibling should check for fieldset legends even if the legend also has a table-part display type. r=mats
authorRobert O'Callahan <robert@ocallahan.org>
Sat, 23 Nov 2013 22:48:27 +1300
changeset 158178 66eb2c676db24664993b9e2a2a3b10e887526d92
parent 158177 29f004e4fa778a4fdef5f299b32de7ab57c7ad71
child 158179 56a302c46bece924c6318050397e9ea546748584
push id36943
push userrocallahan@mozilla.com
push dateMon, 02 Dec 2013 01:08:51 +0000
treeherdermozilla-inbound@08fd80f4b2bf [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmats
bugs936988
milestone28.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 936988. nsCSSFrameConstructor::IsValidSibling should check for fieldset legends even if the legend also has a table-part display type. r=mats
layout/base/crashtests/936988-1.html
layout/base/crashtests/crashtests.list
layout/base/nsCSSFrameConstructor.cpp
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/936988-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body onload="document.getElementById('f').appendChild(document.createTextNode('X'));">
+<fieldset id="f"><legend style="display: table-row-group;"></legend></fieldset>
+</body>
+</html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -414,10 +414,11 @@ load 836990-1.html
 load 852293.html
 load 860579-1.html
 pref(layers.force-active,true) load 859526-1.html
 pref(layers.force-active,true) load 859630-1.html
 load 866588.html
 load 897852.html
 asserts(4-6) load 898913.html # bug 847368
 load 931464.html
+load 936988-1.html
 load 931460-1.html
 load 935765-1.html
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5959,20 +5959,22 @@ nsCSSFrameConstructor::IsValidSibling(ns
     if ((siblingDisplay == NS_STYLE_DISPLAY_TABLE_COLUMN_GROUP ||
          siblingDisplay == NS_STYLE_DISPLAY_TABLE_COLUMN) !=
         (aDisplay == NS_STYLE_DISPLAY_TABLE_COLUMN_GROUP ||
          aDisplay == NS_STYLE_DISPLAY_TABLE_COLUMN)) {
       // One's a column or column group and the other is not.  Not valid
       // siblings.
       return false;
     }
-
-    return true;
-  }
-  else if (IsFrameForFieldSet(parentFrame, parentType)) {
+    // Fall through; it's possible that the display type was overridden and
+    // a different sort of frame was constructed, so we may need to return false
+    // below.
+  }
+
+  if (IsFrameForFieldSet(parentFrame, parentType)) {
     // Legends can be sibling of legends but not of other content in the fieldset
     nsIAtom* sibType = aSibling->GetContentInsertionFrame()->GetType();
     bool legendContent = aContent->IsHTML(nsGkAtoms::legend);
 
     if ((legendContent  && (nsGkAtoms::legendFrame != sibType)) ||
         (!legendContent && (nsGkAtoms::legendFrame == sibType)))
       return false;
   }