Bug 1373767: Always make nsMathMLmathBlockFrame a block formatting context. r?bz draft
authorDaniel Holbert <dholbert@cs.stanford.edu>
Thu, 13 Jul 2017 15:34:20 -0700
changeset 608735 7641511f5ce500e9fd0ce1d0ccd897b24d2ab4fb
parent 608486 74f6779f45b420f0098e74c6131ad10361224ece
child 637410 fd6ce23b64a59760a47922c2fce2ab8022cf5aa3
push id68398
push userdholbert@mozilla.com
push dateFri, 14 Jul 2017 05:10:33 +0000
reviewersbz
bugs1373767
milestone56.0a1
Bug 1373767: Always make nsMathMLmathBlockFrame a block formatting context. r?bz (This makes it behave a bit more like a normal CSS block, and it ensures that it can provide a float manager to its descendants.) MozReview-Commit-ID: FmnQYjzD2eD
layout/base/nsCSSFrameConstructor.cpp
layout/mathml/crashtests/1373767-1.html
layout/mathml/crashtests/crashtests.list
layout/mathml/nsMathMLContainerFrame.cpp
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5248,17 +5248,16 @@ nsCSSFrameConstructor::FlushAccumulatedB
   blockContext = styleSet->
     ResolveInheritingAnonymousBoxStyle(anonPseudo, parentContext);
 
   // then, create a block frame that will wrap the child frames. Make it a
   // MathML frame so that Get(Absolute/Float)ContainingBlockFor know that this
   // is not a suitable block.
   nsContainerFrame* blockFrame =
     NS_NewMathMLmathBlockFrame(mPresShell, blockContext);
-  blockFrame->AddStateBits(NS_BLOCK_FORMATTING_CONTEXT_STATE_BITS);
 
   InitAndRestoreFrame(aState, aContent, aParentFrame, blockFrame);
   ReparentFrames(this, blockFrame, aBlockItems);
   // abs-pos and floats are disabled in MathML children so we don't have to
   // worry about messing up those.
   blockFrame->SetInitialChildList(kPrincipalList, aBlockItems);
   NS_ASSERTION(aBlockItems.IsEmpty(), "What happened?");
   aBlockItems.Clear();
new file mode 100644
--- /dev/null
+++ b/layout/mathml/crashtests/1373767-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+math {
+  position: fixed;
+}
+div {
+  transform: translateZ(0px);
+}
+body {
+  display: -moz-grid;
+}
+</style>
+</head>
+<body>
+<div>
+<math></math>
+</div>
+</body>
+</html>
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -60,9 +60,10 @@ load 713606-1.html
 load 716349-1.html
 load 767251.xhtml
 load 848725-1.html
 load 848725-2.html
 load 947557-1.html
 load 973322-1.xhtml
 load 1028521-1.xhtml
 load 1061027.html
+load 1373767-1.html
 load 1376158.html
--- a/layout/mathml/nsMathMLContainerFrame.cpp
+++ b/layout/mathml/nsMathMLContainerFrame.cpp
@@ -1545,17 +1545,19 @@ nsMathMLContainerFrame::ReportInvalidChi
   return ReportErrorToConsole("InvalidChild", argv, 2);
 }
 
 //==========================
 
 nsContainerFrame*
 NS_NewMathMLmathBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
-  return new (aPresShell) nsMathMLmathBlockFrame(aContext);
+  auto newFrame = new (aPresShell) nsMathMLmathBlockFrame(aContext);
+  newFrame->AddStateBits(NS_BLOCK_FORMATTING_CONTEXT_STATE_BITS);
+  return newFrame;
 }
 
 NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmathBlockFrame)
 
 NS_QUERYFRAME_HEAD(nsMathMLmathBlockFrame)
   NS_QUERYFRAME_ENTRY(nsMathMLmathBlockFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsBlockFrame)