Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-10 03:45:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't construct an nsFrameList whose first child has a previous sibling. (Bug 586806) r=roc a2.0=blocking

Browse Source
This commit is contained in:
L. David Baron 2010-08-19 09:38:00 -04:00
parent 9783d9f347
commit f7f2374e3e
3 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
layout/generic/crashtests/586806-2.html Normal file
View File

@ -0,0 +1 @@
<div style="-moz-column-count: 2; width: 241px;"><div style="display: inline-block; width: 240px; height: 100px;"></div>m</div>

1
layout/generic/crashtests/crashtests.list
View File

@ -329,3 +329,4 @@ load 570160.html
load 571618-1.svg
load 574958.xhtml
load 585598-1.xhtml
load 586806-2.html

14
layout/generic/nsBlockFrame.cpp
View File

@ -4003,9 +4003,17 @@ nsBlockFrame::SplitLine(nsBlockReflowState& aState,
if (0 != pushCount) {
NS_ABORT_IF_FALSE(aLine->GetChildCount() > pushCount, "bad push");
NS_ABORT_IF_FALSE(nsnull != aFrame, "whoops");
NS_ASSERTION(nsFrameList(aFrame, nsLayoutUtils::GetLastSibling(aFrame))
.GetLength() >= pushCount,
"Not enough frames to push");
#ifdef DEBUG
{
nsIFrame *f = aFrame;
PRInt32 count = pushCount;
while (f && count > 0) {
f = f->GetNextSibling();
--count;
}
NS_ASSERTION(count == 0, "Not enough frames to push");
}
#endif
// Put frames being split out into their own line
nsLineBox* newLine = aState.NewLineBox(aFrame, pushCount, PR_FALSE);