Bug 1401739. Make sure to always call UpdateStyleOfChildAnonBox with the first continuation as "this". r=emilio
authorBoris Zbarsky <bzbarsky@mit.edu>
Mon, 25 Sep 2017 10:58:39 -0400
changeset 669908 4b97d4e53e02ffae46ffb3268d95d022509f47ed
parent 669907 e6bf3b8e155b1f749ed4f6033a69164dafb09478
child 669909 9a941556e9399914d1a5bbd0043bed3ab3807fc5
push id81465
push userbmo:dharvey@mozilla.com
push dateMon, 25 Sep 2017 15:46:49 +0000
reviewersemilio
bugs1401739
milestone58.0a1
Bug 1401739. Make sure to always call UpdateStyleOfChildAnonBox with the first continuation as "this". r=emilio MozReview-Commit-ID: KhfvBuCeoex
layout/base/ServoRestyleManager.cpp
layout/base/crashtests/1401739.html
layout/base/crashtests/crashtests.list
--- a/layout/base/ServoRestyleManager.cpp
+++ b/layout/base/ServoRestyleManager.cpp
@@ -203,25 +203,25 @@ ServoRestyleState::ProcessMaybeNestedWra
   }
   if (parent->IsLineFrame()) {
     parent = parent->GetParent();
   }
   MOZ_ASSERT(FirstContinuationOrPartOfIBSplit(parent) == aParent ||
              (parent->StyleContext()->IsInheritingAnonBox() &&
               parent->GetContent() == aParent->GetContent()));
 
-  // Now "this" is a ServoRestyleState for aParent, so if parent is not a prev
+  // Now "this" is a ServoRestyleState for aParent, so if parent is not a next
   // continuation (possibly across ib splits) of aParent we need a new
   // ServoRestyleState for the kid.
   Maybe<ServoRestyleState> parentRestyleState;
-  nsIFrame* parentForRestyle = aParent;
-  if (nsLayoutUtils::FirstContinuationOrIBSplitSibling(parent) != aParent) {
-    parentRestyleState.emplace(*parent, *this, nsChangeHint_Empty,
+  nsIFrame* parentForRestyle =
+    nsLayoutUtils::FirstContinuationOrIBSplitSibling(parent);
+  if (parentForRestyle != aParent) {
+    parentRestyleState.emplace(*parentForRestyle, *this, nsChangeHint_Empty,
                                Type::InFlow);
-    parentForRestyle = parent;
   }
   ServoRestyleState& curRestyleState =
     parentRestyleState ? *parentRestyleState : *this;
 
   // This frame may already have been restyled.  Even if it has, we can't just
   // return, because the next frame may be a kid of it that does need restyling.
   if (cur->IsWrapperAnonBoxNeedingRestyle()) {
     parentForRestyle->UpdateStyleOfChildAnonBox(cur, curRestyleState);
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/1401739.html
@@ -0,0 +1,11 @@
+<style>
+html { -moz-column-width:0 }
+</style>
+<script>
+document.documentElement.appendChild(document.createElement("option"))
+document.documentElement.appendChild(document.createElement("th"))
+document.styleSheets[0].insertRule("c{", 0)
+document.documentElement.getBoundingClientRect()
+document.styleSheets[0].deleteRule(0)
+</script>
+<body></body>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -498,9 +498,10 @@ load 1390389.html
 load 1395591-1.html
 load 1395715-1.html
 load 1397398-1.html
 load 1397398-2.html
 load 1397398-3.html
 load 1398500.html
 load 1400438-1.html
 load 1400599-1.html
+load 1401739.html
 load 1401840.html