Bug 1486457 - Clear the float list if we weren't able to place a line. r=dbaron
authorEmilio Cobos Álvarez <emilio@crisal.io>
Tue, 28 Aug 2018 18:13:20 +0000
changeset 491511 7edf18c31ee0e0f598cfd2ae9371ba7c3161afcc
parent 491510 d214235eef08c5918ef02e07db21de9763e5ba31
child 491512 4e42a6a201f067a107d0bc0e28508dc2585be87f
push id1815
push userffxbld-merge
push dateMon, 15 Oct 2018 10:40:45 +0000
treeherdermozilla-release@18d4c09e9378 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdbaron
bugs1486457
milestone63.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1486457 - Clear the float list if we weren't able to place a line. r=dbaron We'll re-do the line anyway, and we'll forget about all the already-positioned floats in the line DoReflowInlineFrames anyway. Differential Revision: https://phabricator.services.mozilla.com/D4457
layout/generic/crashtests/1486457.html
layout/generic/crashtests/crashtests.list
layout/generic/nsBlockFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/1486457.html
@@ -0,0 +1,19 @@
+<style>
+* 	{ display: ruby-text-container }
+div { float: right }
+</style>
+<script>
+function start() {
+    try { o1 = document.createElement('div') } catch (e) {}
+    try { o2 = document.createElement('img') } catch (e) {}
+    try { o3 = document.createElement('img') } catch (e) {}
+    try { o4 = document.createElement('img') } catch (e) {}
+    try { o3.innerText = '%\n' } catch (e) {}
+    try { o4.align = 'right' } catch (e) {}
+    try { o3.appendChild(o4) } catch (e) {}
+    try { o2.appendChild(o3) } catch (e) {}
+    try { document.documentElement.appendChild(o1) } catch (e) {}
+    try { document.documentElement.appendChild(o2) } catch (e) {}
+}
+window.addEventListener('load', start)
+</script>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -700,8 +700,9 @@ load 1460158-2.html
 load 1460158-3.html
 load 1461039.html
 load 1461979-1.html
 load 1467239.html
 load 1472403.html
 load 1474768.html
 load 1478178.html
 load 1483972.html
+load 1486457.html
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -3957,17 +3957,17 @@ nsBlockFrame::ReflowInlineFrames(BlockRe
               lineLayout.GetLastOptionalBreakPosition(&forceBreakOffset, &forceBreakPriority);
           } else {
             forceBreakInFrame = nullptr;
           }
           // restore the float manager state
           aState.FloatManager()->PopState(&floatManagerState);
           // Clear out float lists
           aState.mCurrentLineFloats.DeleteAll();
-          MOZ_ASSERT(aState.mNoWrapFloats.IsEmpty());
+          aState.mNoWrapFloats.Clear();
           aState.mBelowCurrentLineFloats.DeleteAll();
         }
 
         // Don't allow pullup on a subsequent LineReflowStatus::RedoNoPull pass
         allowPullUp = false;
       } while (LineReflowStatus::RedoNoPull == lineReflowStatus);
     } while (LineReflowStatus::RedoMoreFloats == lineReflowStatus);
   } while (LineReflowStatus::RedoNextBand == lineReflowStatus);