Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-13 21:35:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1413288: The owner of a bullet frame is the first continuation of the parent. r=xidorn

Browse Source 
MozReview-Commit-ID: FUsdsETkV2Q

--HG--
extra : rebase_source : 9c6183e567321c9ee541a04d001dc00fbcc7e94b
This commit is contained in:
Emilio Cobos Álvarez 2017-11-01 12:20:55 +01:00
parent 3ac4888c45
commit 9bd202a77c
3 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
layout/base/ServoRestyleManager.cpp
View File

@ -66,7 +66,7 @@ ExpectedOwnerForChild(const nsIFrame& aFrame)
}
if (aFrame.IsBulletFrame()) {
return parent;
return FirstContinuationOrPartOfIBSplit(parent);
}
if (aFrame.IsLineFrame()) {

17
layout/style/crashtests/1413288.html Normal file
View File

@ -0,0 +1,17 @@
<style>
:root { column-width: 0px; }
:not(article) { padding: 2 0px; }
</style>
<script>
function jsfuzzer() {
try { htmlvar00007.setAttribute("align", "LEFT"); } catch(e) { }
try { svgvar00016.getStartPositionOfChar(0); } catch(e) { }
try { htmlvar00016.style.setProperty("column-gap", "0"); } catch(e) { }
}
</script>
<body onload=jsfuzzer()>
<iframe id="htmlvar00007"></iframe>
<details>
<summary id="htmlvar00016">)
<svg>
<tspan id="svgvar00016" />

1
layout/style/crashtests/crashtests.list
View File

@ -258,3 +258,4 @@ load 1410226-1.html
load 1410226-2.html
load 1411143.html
load 1411478.html
load 1413288.html