Bug 1343606 - Pass the correct first child frame for the lines we're going to traverse, and reset bpd.mPrevFrame since we're starting at a new line. r=jfkthame, a=lizzard
authorMats Palmgren <mats@mozilla.com>
Thu, 02 Mar 2017 20:45:40 +0100
changeset 378848 1c676fbbcdbfeec529f424d6884dce04877ec73f
parent 378847 c68908b7f6f8267b19b558d27cc99c69b0c0d80e
child 378849 4c6710d8da0292d78a1f74adc8b04fdfb00089fa
push id1419
push userjlund@mozilla.com
push dateMon, 10 Apr 2017 20:44:07 +0000
treeherdermozilla-release@5e6801b73ef6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjfkthame, lizzard
bugs1343606
milestone53.0a2
Bug 1343606 - Pass the correct first child frame for the lines we're going to traverse, and reset bpd.mPrevFrame since we're starting at a new line. r=jfkthame, a=lizzard MozReview-Commit-ID: 77CG4u22OTt
layout/base/crashtests/1343606.html
layout/base/crashtests/crashtests.list
layout/base/nsBidiPresUtils.cpp
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/1343606.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+body {
+  columns: 5;
+  column-fill: auto;
+  height: 100px;
+}
+div {
+  display: grid;
+  grid-template-columns: 30px 30px 30px;
+  grid-auto-rows: 30px;
+  border:5px solid;
+}
+span {
+  border:1px solid black;
+}
+</style>
+<script>
+setTimeout(function(){ window.close(); },1000);
+window.onload = function(){
+  let a = document.getElementsByTagName("x")[0],
+      b = document.createTextNode("カ쾊紋鴺");
+  a.appendChild(b);
+  setTimeout(function(){
+    b.remove();
+  }, 0);
+};
+</script>
+</head>
+<body>
+<div>
+<span><x>某שּׁ큤</x></span>
+The quick brown fox jumps over the lazy dog.
+</div>
+</body>
+</html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -477,8 +477,9 @@ load 1270797-1.html
 load 1278455-1.html
 load 1286889.html
 load 1297835.html
 load 1288608.html
 load 1299736-1.html
 load 1308793.svg
 load 1308848-1.html
 load 1308848-2.html
+asserts(0-1) load 1343606.html # bug 1343948
--- a/layout/base/nsBidiPresUtils.cpp
+++ b/layout/base/nsBidiPresUtils.cpp
@@ -706,17 +706,18 @@ nsBidiPresUtils::Resolve(nsBlockFrame* a
 #endif
     block->RemoveStateBits(NS_BLOCK_NEEDS_BIDI_RESOLUTION);
     nsBlockInFlowLineIterator it(block, block->LinesBegin());
     bpd.mPrevFrame = nullptr;
     TraverseFrames(&it, block->PrincipalChildList().FirstChild(), &bpd);
     nsBlockFrame::FrameLines* overflowLines = block->GetOverflowLines();
     if (overflowLines) {
       nsBlockInFlowLineIterator it(block, overflowLines->mLines.begin(), true);
-      TraverseFrames(&it, block->PrincipalChildList().FirstChild(), &bpd);
+      bpd.mPrevFrame = nullptr;
+      TraverseFrames(&it, overflowLines->mFrames.FirstChild(), &bpd);
     }
   }
 
   if (ch != 0) {
     bpd.PopBidiControl(ch);
   }
 
   return ResolveParagraph(&bpd);