Bug 1494030 - Fix an assertion. r=mats
authorEmilio Cobos Álvarez <emilio@crisal.io>
Thu, 27 Sep 2018 11:20:47 +0000
changeset 486885 910f24a3906f52c1ef0e86ac8117a7ebd448a949
parent 486884 75bdc10df0d20a349ad592437222e5dff4418ba2
child 486886 55660b661412a4a9cc28996ed5c4429b9c101ae2
push id246
push userfmarier@mozilla.com
push dateSat, 13 Oct 2018 00:15:40 +0000
reviewersmats
bugs1494030, 1424656
milestone64.0a1
Bug 1494030 - Fix an assertion. r=mats We're trying to insert a table caption via an append into a display: contents element. We pass the content-insertion-frame (the table frame) instead of the siblings' parent (the table wrapper frame). This is the right thing to pass though, we adjust the caption parent frame later, on AdjustCaptionParentFrame, and we ensure that we don't get here for a non-caption thing because of IsValidSibling (though note that that can actually lie, see bug 1424656, we'd get the layout wrong if the title element was a replaced element for example), so a normal append without a previous sibling will still be correct. It'd be nice to make this a bit less messy, fwiw, but I don't have the ideas or the time to do it now. Differential Revision: https://phabricator.services.mozilla.com/D7067
layout/base/crashtests/1494030.html
layout/base/crashtests/crashtests.list
layout/base/nsCSSFrameConstructor.cpp
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/1494030.html
@@ -0,0 +1,22 @@
+<html>
+
+<head>
+  <style>
+    head:nth-last-child(2) {
+      display: contents;
+    }
+
+    *,
+    dd {
+      display: table-caption;
+  </style>
+  <script>
+    function start() {
+      document.title = String.fromCharCode(51, 61, 82, 104, 64, 86, 117, 88, 57, 77, 40, 32, 81, 33, 120, 99, 126, 53, 121, 101);
+    }
+  </script>
+</head>
+
+<body onload="start()"></body>
+
+</html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -539,8 +539,9 @@ load 1464737.html
 load 1466638.html
 load 1467688.html
 load 1467964.html
 load 1469354.html
 pref(layout.accessiblecaret.enabled,true) load 1472020.html
 load 1472027.html
 load 1489149.html
 load 1490037.html
+load 1494030.html
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -6083,17 +6083,17 @@ nsCSSFrameConstructor::GetFloatContainin
  * the parent content is display: contents or has ::after content (may be null).
  */
 static nsIFrame*
 FindAppendPrevSibling(nsIFrame* aParentFrame, nsIFrame* aNextSibling)
 {
   aParentFrame->DrainSelfOverflowList();
 
   if (aNextSibling) {
-    MOZ_ASSERT(aNextSibling->GetParent() == aParentFrame, "Wrong parent");
+    MOZ_ASSERT(aNextSibling->GetParent()->GetContentInsertionFrame() == aParentFrame, "Wrong parent");
     return aNextSibling->GetPrevSibling();
   }
 
   return aParentFrame->GetChildList(kPrincipalList).LastChild();
 }
 
 /**
  * Finds the right parent frame to append content to aParentFrame.