Temporarily forget the line container while calculating widths for next-in-flow children. b=477928 r+sr=roc
authorMats Palmgren <mats.palmgren@bredband.net>
Thu, 19 Feb 2009 21:18:52 +0100
changeset 25237 d5aae349d1187b9476beba6dd0a923a14f241d39
parent 25236 9274a021ee67f7b7dbfa28afa78b9bba9d6e8f98
child 25238 4bd7dd7645c209ec5065bab824994739587a7e51
push id5462
push usermpalmgren@mozilla.com
push dateThu, 19 Feb 2009 20:19:29 +0000
treeherdermozilla-central@d5aae349d118 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs477928
milestone1.9.2a1pre
Temporarily forget the line container while calculating widths for next-in-flow children. b=477928 r+sr=roc
layout/generic/crashtests/477928.html
layout/generic/crashtests/crashtests.list
layout/generic/nsContainerFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/477928.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("a").appendChild(document.createTextNode("\n"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="a" style="max-width: -moz-max-content; -moz-column-count: 2;"><span style="white-space: pre-line;"><span>
+</span>
+</span></div>
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -188,8 +188,9 @@ load 455171-1.html
 load 455171-2.html
 load 455171-3.html
 load 457375.html
 load 463741-1.html
 load 465651-1.html
 load 467487-1.html
 load 468207-1.html
 load 472950-1.html
+load 477928.html
--- a/layout/generic/nsContainerFrame.cpp
+++ b/layout/generic/nsContainerFrame.cpp
@@ -712,37 +712,41 @@ nsContainerFrame::DoInlineIntrinsicWidth
   if (!GetPrevContinuation()) {
     aData->currentLine +=
       GetCoord(stylePadding->mPadding.Get(startSide), 0) +
       styleBorder->GetActualBorderWidth(startSide) +
       GetCoord(styleMargin->mMargin.Get(startSide), 0);
   }
 
   const nsLineList_iterator* savedLine = aData->line;
+  nsIFrame* const savedLineContainer = aData->lineContainer;
 
   nsContainerFrame *lastInFlow;
   for (nsContainerFrame *nif = this; nif;
-       nif = (nsContainerFrame*) nif->GetNextInFlow()) {
+       nif = static_cast<nsContainerFrame*>(nif->GetNextInFlow())) {
     for (nsIFrame *kid = nif->mFrames.FirstChild(); kid;
          kid = kid->GetNextSibling()) {
       if (aType == nsLayoutUtils::MIN_WIDTH)
         kid->AddInlineMinWidth(aRenderingContext,
                                static_cast<InlineMinWidthData*>(aData));
       else
         kid->AddInlinePrefWidth(aRenderingContext,
                                 static_cast<InlinePrefWidthData*>(aData));
     }
     
-    // After we advance to our next-in-flow, the stored line may not
-    // longer be the correct line. Just forget it.
+    // After we advance to our next-in-flow, the stored line and line container
+    // may no longer be correct. Just forget them.
     aData->line = nsnull;
+    aData->lineContainer = nsnull;
+
     lastInFlow = nif;
   }
   
   aData->line = savedLine;
+  aData->lineContainer = savedLineContainer;
 
   // This goes at the end no matter how things are broken and how
   // messy the bidi situations are, since per CSS2.1 section 8.6
   // (implemented in bug 328168), the endSide border is always on the
   // last line.
   // We reached the last-in-flow, but it might have a next bidi
   // continuation, in which case that continuation should handle 
   // the endSide border.