Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-17 23:35:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1453196: Fix MathML reframing code when the root is a MathML element. r=bz

Browse Source 
MozReview-Commit-ID: CPd40oHIT5w

--HG--
extra : rebase_source : 64974ab5eb9adea507caf16c330a272f818951ed
This commit is contained in:
Emilio Cobos Álvarez 2018-04-14 22:58:13 +02:00
parent d39ab35df6
commit 3b8557aa3e
3 changed files with 40 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
layout/base/crashtests/1453196.html Normal file
View File

@ -0,0 +1,15 @@
<html>
<head>
<script>
function start () {
try { o1 = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'mtable') } catch (e) {}
try { o2 = document.createTextNode("\u202D") } catch (e) {}
try { document.documentElement.appendChild(o2) } catch (e) {}
try { o1.insertBefore(document.documentElement, o1.childNodes[0]) } catch (e) {}
try { document.appendChild(o1) } catch (e) {}
try { document.append(o2, undefined) } catch (e) {}
}
document.addEventListener('DOMContentLoaded', start)
</script>
</head>
</html>

1
layout/base/crashtests/crashtests.list
View File

@ -529,3 +529,4 @@ load 1448841-1.html
load 1452839.html
load 1453702.html
load 1453342.html
load 1453196.html

33
layout/base/nsCSSFrameConstructor.cpp
View File

@ -9090,6 +9090,27 @@ nsCSSFrameConstructor::UpdateTableCellSpans(nsIContent* aContent)
}
}
static nsIContent*
GetTopmostMathMLElement(nsIContent* aMathMLContent)
{
MOZ_ASSERT(aMathMLContent->IsMathMLElement());
MOZ_ASSERT(aMathMLContent->GetPrimaryFrame());
MOZ_ASSERT(aMathMLContent->GetPrimaryFrame()->IsFrameOfType(nsIFrame::eMathML));
nsIContent* root = aMathMLContent;
for (nsIContent* parent = aMathMLContent->GetFlattenedTreeParent();
parent;
parent = parent->GetFlattenedTreeParent()) {
nsIFrame* frame = parent->GetPrimaryFrame();
if (!frame || !frame->IsFrameOfType(nsIFrame::eMathML)) {
break;
}
root = parent;
}
return root;
}
void
nsCSSFrameConstructor::RecreateFramesForContent(nsIContent* aContent,
InsertionKind aInsertionKind)
@ -9115,15 +9136,9 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIContent* aContent,
nsIFrame* frame = aContent->GetPrimaryFrame();
if (frame && frame->IsFrameOfType(nsIFrame::eMathML)) {
// Reframe the topmost MathML element to prevent exponential blowup
// (see bug 397518)
while (true) {
nsIContent* parentContent = aContent->GetParent();
nsIFrame* parentContentFrame = parentContent->GetPrimaryFrame();
if (!parentContentFrame || !parentContentFrame->IsFrameOfType(nsIFrame::eMathML))
break;
aContent = parentContent;
frame = parentContentFrame;
}
// (see bug 397518).
aContent = GetTopmostMathMLElement(aContent);
frame = aContent->GetPrimaryFrame();
}
if (frame) {