Fixed AnonBoxes stylo related crash draft
authorNeerja Pancholi <npancholi@mozilla.com>
Mon, 25 Sep 2017 15:42:42 -0700
changeset 698698 688a4075157c18d2b3238ae2c16117969363e5b3
parent 698697 19cfac8892335208d53353430859e17eca07e594
child 698699 8ff8e91974d48863f466c1059869e54b2402bc76
push id89334
push userbmo:npancholi@mozilla.com
push dateThu, 16 Nov 2017 00:39:30 +0000
milestone59.0a1
Fixed AnonBoxes stylo related crash MozReview-Commit-ID: ISh3ufR5JRZ
layout/base/nsCSSFrameConstructor.cpp
layout/generic/nsColumnSetWrapperFrame.cpp
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -12266,16 +12266,17 @@ nsCSSFrameConstructor::ConstructBlock(ns
       // so just destroy it.
       // Note: An empty column set wrapper is ok to have since it represents
       // the case of an empty multicol element.
       MOZ_ASSERT((*aNewFrame) != blockFrame,
                  "NewFrame and blockFrame must be different here!");
       MOZ_ASSERT(childItems.IsEmpty(),
                  "NewFrame can only be columnSetWrapper when blockFrame's "
                  "childItems are empty!");
+      (*aNewFrame)->RemoveStateBits(NS_FRAME_OWNS_ANON_BOXES);
       blockFrame->Destroy();
     }
     return;
   }
 
   ProcessColumnSpan(aState, blockFrame, aNewFrame, childItems, aFrameItems,
                     aContentParentFrame ? aContentParentFrame : aParentFrame,
                     aPositionedFrameForAbsPosContainer);
--- a/layout/generic/nsColumnSetWrapperFrame.cpp
+++ b/layout/generic/nsColumnSetWrapperFrame.cpp
@@ -68,25 +68,20 @@ nsColumnSetWrapperFrame::BuildDisplayLis
   for (nsIFrame* childFrame : mFrames) {
     BuildDisplayListForChild(aBuilder, childFrame, aLists);
   }
 }
 
 void
 nsColumnSetWrapperFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
 {
-  // All it's children are anon boxes
-  for (nsIFrame* childFrame : mFrames) {
-//    nsIAtom* pseudoStyle = childFrame->StyleContext()->GetPseudo();
-// Cannot assert this since column-spans directly inside a wrapper are never
-// wrapped with the mozColumnSpanWrapper pseudo style
-//    MOZ_ASSERT(pseudoStyle == nsCSSAnonBoxes::mozColumnSet ||
-//               pseudoStyle == nsCSSAnonBoxes::mozColumnSpanWrapper,
-//               "What kind of child is this?");
-    aResult.AppendElement(OwnedAnonBox(childFrame));
+  // xxxneerja
+  // Seems like we only append the first child, is this correct?
+  if (mFrames.NotEmpty()) {
+    aResult.AppendElement(OwnedAnonBox(mFrames.FirstChild()));
   }
 }
 
 void
 nsColumnSetWrapperFrame::Reflow(nsPresContext*     aPresContext,
                                 ReflowOutput&      aDesiredSize,
                                 const ReflowInput& aReflowInput,
                                 nsReflowStatus&    aStatus)