From f8383bac25775cbf16b44154b6ebbb6f69c248fe Mon Sep 17 00:00:00 2001
From: Mats Palmgren <mats@mozilla.com>
Date: Mon, 19 Dec 2016 16:48:36 +0100
Subject: [PATCH] Bug 1324072 - Use the frame's BStart, not rect's (fixes typo
 from bug 789096).  r=jfkthame

---
 layout/mathml/nsMathMLmtableFrame.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/layout/mathml/nsMathMLmtableFrame.cpp b/layout/mathml/nsMathMLmtableFrame.cpp
index 3edc5dd09698..6cd90fb76f98 100644
--- a/layout/mathml/nsMathMLmtableFrame.cpp
+++ b/layout/mathml/nsMathMLmtableFrame.cpp
@@ -858,8 +858,9 @@ nsMathMLmtableWrapperFrame::Reflow(nsPresContext*           aPresContext,
                        aReflowInput.ComputedSizeAsContainerIfConstrained());
       blockSize = rect.BSize(wm);
       do {
-        dy += rect.BStart(wm);
-        frame = frame->GetParent();
+        nsIFrame* parent = frame->GetParent();
+        dy += frame->BStart(wm, parent->GetSize());
+        frame = parent;
       } while (frame != this);
     }
   }