Bug 1401739. Make sure to always call UpdateStyleOfChildAnonBox with the first continuation as "this". r=emilio
MozReview-Commit-ID: KhfvBuCeoex
--- a/layout/base/ServoRestyleManager.cpp
+++ b/layout/base/ServoRestyleManager.cpp
@@ -203,25 +203,25 @@ ServoRestyleState::ProcessMaybeNestedWra
}
if (parent->IsLineFrame()) {
parent = parent->GetParent();
}
MOZ_ASSERT(FirstContinuationOrPartOfIBSplit(parent) == aParent ||
(parent->StyleContext()->IsInheritingAnonBox() &&
parent->GetContent() == aParent->GetContent()));
- // Now "this" is a ServoRestyleState for aParent, so if parent is not a prev
+ // Now "this" is a ServoRestyleState for aParent, so if parent is not a next
// continuation (possibly across ib splits) of aParent we need a new
// ServoRestyleState for the kid.
Maybe<ServoRestyleState> parentRestyleState;
- nsIFrame* parentForRestyle = aParent;
- if (nsLayoutUtils::FirstContinuationOrIBSplitSibling(parent) != aParent) {
- parentRestyleState.emplace(*parent, *this, nsChangeHint_Empty,
+ nsIFrame* parentForRestyle =
+ nsLayoutUtils::FirstContinuationOrIBSplitSibling(parent);
+ if (parentForRestyle != aParent) {
+ parentRestyleState.emplace(*parentForRestyle, *this, nsChangeHint_Empty,
Type::InFlow);
- parentForRestyle = parent;
}
ServoRestyleState& curRestyleState =
parentRestyleState ? *parentRestyleState : *this;
// This frame may already have been restyled. Even if it has, we can't just
// return, because the next frame may be a kid of it that does need restyling.
if (cur->IsWrapperAnonBoxNeedingRestyle()) {
parentForRestyle->UpdateStyleOfChildAnonBox(cur, curRestyleState);
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/1401739.html
@@ -0,0 +1,11 @@
+<style>
+html { -moz-column-width:0 }
+</style>
+<script>
+document.documentElement.appendChild(document.createElement("option"))
+document.documentElement.appendChild(document.createElement("th"))
+document.styleSheets[0].insertRule("c{", 0)
+document.documentElement.getBoundingClientRect()
+document.styleSheets[0].deleteRule(0)
+</script>
+<body></body>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -498,9 +498,10 @@ load 1390389.html
load 1395591-1.html
load 1395715-1.html
load 1397398-1.html
load 1397398-2.html
load 1397398-3.html
load 1398500.html
load 1400438-1.html
load 1400599-1.html
+load 1401739.html
load 1401840.html
