Temporarily forget the line container while calculating widths for next-in-flow children. b=477928 r+sr=roc a1.9.1=dbaron
authorMats Palmgren <mats.palmgren@bredband.net>
Thu, 26 Feb 2009 12:50:20 +0100
changeset 23471 39460eaf5d0601dfd93067b44ac7b43a582e4ab2
parent 23470 8fed6a0625cebd6e6542f004ee5616cf1646ee88
child 23472 4ad867d7a548de0e0547f64dd6d18654e2f69645
push id780
push usermpalmgren@mozilla.com
push dateThu, 26 Feb 2009 12:10:14 +0000
bugs477928
milestone1.9.1b3pre
Temporarily forget the line container while calculating widths for next-in-flow children. b=477928 r+sr=roc a1.9.1=dbaron
layout/generic/crashtests/477928.html
layout/generic/crashtests/crashtests.list
layout/generic/nsContainerFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/477928.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("a").appendChild(document.createTextNode("\n"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="a" style="max-width: -moz-max-content; -moz-column-count: 2;"><span style="white-space: pre-line;"><span>
+</span>
+</span></div>
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -166,8 +166,9 @@ load 452157-2.html
 load 452157-3.html
 load 455171-1.html
 load 455171-2.html
 load 455171-3.html
 load 457375.html
 load 467487-1.html
 load 472776-1.html
 load 472950-1.html
+load 477928.html
--- a/layout/generic/nsContainerFrame.cpp
+++ b/layout/generic/nsContainerFrame.cpp
@@ -712,37 +712,41 @@ nsContainerFrame::DoInlineIntrinsicWidth
   if (!GetPrevContinuation()) {
     aData->currentLine +=
       GetCoord(stylePadding->mPadding.Get(startSide), 0) +
       styleBorder->GetActualBorderWidth(startSide) +
       GetCoord(styleMargin->mMargin.Get(startSide), 0);
   }
 
   const nsLineList_iterator* savedLine = aData->line;
+  nsIFrame* const savedLineContainer = aData->lineContainer;
 
   nsContainerFrame *lastInFlow;
   for (nsContainerFrame *nif = this; nif;
-       nif = (nsContainerFrame*) nif->GetNextInFlow()) {
+       nif = static_cast<nsContainerFrame*>(nif->GetNextInFlow())) {
     for (nsIFrame *kid = nif->mFrames.FirstChild(); kid;
          kid = kid->GetNextSibling()) {
       if (aType == nsLayoutUtils::MIN_WIDTH)
         kid->AddInlineMinWidth(aRenderingContext,
                                static_cast<InlineMinWidthData*>(aData));
       else
         kid->AddInlinePrefWidth(aRenderingContext,
                                 static_cast<InlinePrefWidthData*>(aData));
     }
     
-    // After we advance to our next-in-flow, the stored line may not
-    // longer be the correct line. Just forget it.
+    // After we advance to our next-in-flow, the stored line and line container
+    // may no longer be correct. Just forget them.
     aData->line = nsnull;
+    aData->lineContainer = nsnull;
+
     lastInFlow = nif;
   }
   
   aData->line = savedLine;
+  aData->lineContainer = savedLineContainer;
 
   // This goes at the end no matter how things are broken and how
   // messy the bidi situations are, since per CSS2.1 section 8.6
   // (implemented in bug 328168), the endSide border is always on the
   // last line.
   // We reached the last-in-flow, but it might have a next bidi
   // continuation, in which case that continuation should handle 
   // the endSide border.