mozilla-central: changeset 123118:63a6466d8c466a5562c7ec478fc8d557d4723f7e

author	Daniel Holbert <dholbert@cs.stanford.edu>
	Tue, 26 Feb 2013 21:44:55 -0800
changeset 123118	63a6466d8c466a5562c7ec478fc8d557d4723f7e
parent 123117	17d25f2c3c3899e538c026638e2e14fac1ab0ff4
child 123119	ed22faa72a821ccac550b6e821eec34b24611022
push id	24372
push user	emorley@mozilla.com
push date	Wed, 27 Feb 2013 13:22:59 +0000
treeherder	mozilla-central@0a91da5f5eab [default view] [failures only]
perfherder	[talos] [build metrics] [platform microbench] (compared to previous push)
reviewers	bz
bugs	844529
milestone	22.0a1
first release with	nightly linux32 b0e08db3bc2a / 22.0a1 / 20130228030852 / files nightly linux64 b0e08db3bc2a / 22.0a1 / 20130228030852 / files nightly mac b0e08db3bc2a / 22.0a1 / 20130228030852 / files nightly win32 b0e08db3bc2a / 22.0a1 / 20130228030852 / files nightly win64 b0e08db3bc2a / 22.0a1 / 20130228030852 / files
last release without	nightly linux32 73f0c5b00572 / 22.0a1 / 20130226031002 / files nightly linux64 73f0c5b00572 / 22.0a1 / 20130226031002 / files nightly mac 73f0c5b00572 / 22.0a1 / 20130226031002 / files nightly win32 73f0c5b00572 / 22.0a1 / 20130226031002 / files nightly win64 73f0c5b00572 / 22.0a1 / 20130226031002 / files

--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -10085,16 +10085,18 @@ nsCSSFrameConstructor::ProcessChildren(n
     NS_ABORT_IF_FALSE(!content->IsNodeOfType(nsINode::eCOMMENT) &&
                       !content->IsNodeOfType(nsINode::ePROCESSING_INSTRUCTION),
                       "Why is someone creating garbage anonymous content");
 
     nsRefPtr<nsStyleContext> styleContext;
     if (anonymousItems[i].mStyleContext) {
       styleContext = anonymousItems[i].mStyleContext.forget();
     } else {
+      TreeMatchContext::AutoFlexItemStyleFixupSkipper
+        flexItemStyleFixupSkipper(aState.mTreeMatchContext);
       styleContext = ResolveStyleContext(aFrame, content, &aState);
     }
 
     AddFrameConstructionItemsInternal(aState, content, aFrame,
                                       content->Tag(), content->GetNameSpaceID(),
                                       true, styleContext,
                                       ITEM_ALLOW_XBL_BASE | ITEM_ALLOW_PAGE_BREAK,
                                       itemsToConstruct);

new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/844529-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<audio style="display: flex;"></audio>
+</body>

--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -438,8 +438,9 @@ test-pref(layout.css.flexbox.enabled,tru
 test-pref(layout.css.flexbox.enabled,true) load 799207-1.html
 asserts(12) test-pref(layout.css.flexbox.enabled,true) load 799207-2.html
 test-pref(layout.css.flexbox.enabled,true) load 804089-1.xhtml
 test-pref(layout.css.flexbox.enabled,true) load 812822-1.html
 asserts(1) test-pref(layout.css.flexbox.enabled,true) load 824297-1.html # bug 399262
 asserts(1) test-pref(layout.css.flexbox.enabled,true) load 826532-1.html # bug 399262
 test-pref(layout.css.flexbox.enabled,true) load 827168-1.html
 load 842132-1.html
+test-pref(layout.css.flexbox.enabled,true) load 844529-1.html

layout/base/nsCSSFrameConstructor.cpp		file \| annotate \| diff \| comparison \| revisions
layout/generic/crashtests/844529-1.html		file \| annotate \| diff \| comparison \| revisions
layout/generic/crashtests/crashtests.list		file \| annotate \| diff \| comparison \| revisions