Don't overshoot the last sibling when iterating frames. Bug 66329, r=roc
authorSimon Montagu <smontagu@smontagu.org>
Wed, 15 Jun 2011 10:45:57 +0300
changeset 71074 a88ea3cd7a4dca9818eaedbb7da9ea562042aedc
parent 71073 f6f801cfdf4c1dd31e275534d2bffa5a63e6c720
child 71075 dcc03e00b32a13d4fad489dedf1b1a4b77830a4f
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersroc
bugs66329
milestone7.0a1
Don't overshoot the last sibling when iterating frames. Bug 66329, r=roc
layout/base/crashtests/663295.html
layout/base/crashtests/crashtests.list
layout/base/nsBidiPresUtils.cpp
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/663295.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html><html style="font-size-adjust: 193373343913878; white-space: pre-line;"><body onload="document.documentElement.style.MozColumnGap='1px';"><span>A B C
+&#x062A;</span></body></html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -326,8 +326,9 @@ load 616495-single-side-composite-color-
 load 629035-1.html
 load 629908-1.html
 load 635329.html
 == 640272.html 640272-ref.html
 load 645193.html
 load 650475.xhtml
 load 650489.xhtml
 load 653133-1.html
+load 663295.html
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -770,17 +770,17 @@ nsBidiPresUtils::TraverseFrames(nsBlockF
                * element.
                */
               ++endLine;
 
               /*
                * If the frame ends before the new line, save the text and move
                * into the next continuation
                */
-              while (end < endLine) {
+              while (end < endLine && nextSibling) {
                 mBuffer.Append(Substring(text, start, end - start));
                 frame = frame->GetNextContinuation();
                 NS_ASSERTION(frame, "Premature end of continuation chain");
                 frame->GetOffsets(start, end);
                 mLogicalFrames.AppendElement(frame);
                 AdvanceLineIteratorToFrame(frame, aLineIter, mPrevFrame);
                 mLinePerFrame.AppendElement(aLineIter->GetLine().get());