80a466e59a
- Apply more FF58 fixes [1] Changes: https://github.com/MrAlex94/Waterfox/compare/56.0.2...56.0.3 Security: a891c5b4-3d7a-4de9-9c71-eef3fd698c77 [1]
69 lines
3.2 KiB
Text
69 lines
3.2 KiB
Text
commit 0f58a35d5cb7
|
|
Author: Emilio Cobos Álvarez <emilio@crisal.io>
|
|
Date: Thu Nov 23 01:01:34 2017 +0100
|
|
|
|
Bug 1419762 - Return the inline continuation of an IB split when appending. r=mats, a=jcristau
|
|
|
|
The only reason not to do that is when there's after content in there. We know
|
|
that there isn't really any ::after content, since it would've been handled by
|
|
FindNextSibling, so we know we're performing a real append.
|
|
|
|
MozReview-Commit-ID: ExoPolZy4gG
|
|
|
|
--HG--
|
|
extra : source : 333214e07fd463dc1c7db00875bb6dff98eb0cdf
|
|
---
|
|
layout/base/crashtests/1419762.html | 15 +++++++++++++++
|
|
layout/base/crashtests/crashtests.list | 1 +
|
|
layout/base/nsCSSFrameConstructor.cpp | 7 ++++---
|
|
3 files changed, 20 insertions(+), 3 deletions(-)
|
|
|
|
diff --git layout/base/crashtests/1419762.html layout/base/crashtests/1419762.html
|
|
new file mode 100644
|
|
index 000000000000..08a56106db93
|
|
--- /dev/null
|
|
+++ layout/base/crashtests/1419762.html
|
|
@@ -0,0 +1,15 @@
|
|
+<style id='style_1'>
|
|
+ :first-child { display: table-column-group; }
|
|
+</style>
|
|
+<script>
|
|
+ try { o1 = document.createElement('isindex') } catch(e) { }
|
|
+ try { o2 = document.createElement('input') } catch(e) { }
|
|
+ try { o3 = document.createElement('optgroup') } catch(e) { }
|
|
+ try { o4 = document.createElement('col') } catch(e) { }
|
|
+ try { document.documentElement.appendChild(o1) } catch(e) { }
|
|
+ try { o1.appendChild(o2) } catch(e) { }
|
|
+ try { o1.appendChild(o3) } catch(e) { }
|
|
+ try { document.documentElement.offsetTop; } catch (e) { }
|
|
+ try { document.documentElement.appendChild(o4) } catch(e) { }
|
|
+ try { document.styleSheets[0].insertRule('optgroup::first-line { list-style-type: japanese-formal; }', 0); } catch(e) { }
|
|
+</script>
|
|
diff --git layout/base/crashtests/crashtests.list layout/base/crashtests/crashtests.list
|
|
index 7010ca4f2d3f..ecced042e228 100644
|
|
--- layout/base/crashtests/crashtests.list
|
|
+++ layout/base/crashtests/crashtests.list
|
|
@@ -493,3 +493,4 @@ asserts(0-1) load 1343606.html # bug 1343948
|
|
load 1352380.html
|
|
load 1362423-1.html
|
|
load 1381323.html
|
|
+load 1419762.html
|
|
diff --git layout/base/nsCSSFrameConstructor.cpp layout/base/nsCSSFrameConstructor.cpp
|
|
index bb6da0dba1da..0a1b588c21df 100644
|
|
--- layout/base/nsCSSFrameConstructor.cpp
|
|
+++ layout/base/nsCSSFrameConstructor.cpp
|
|
@@ -7044,10 +7044,11 @@ nsCSSFrameConstructor::GetInsertionPrevSibling(InsertionPoint* aInsertion,
|
|
*aIsAppend = true;
|
|
if (IsFramePartOfIBSplit(aInsertion->mParentFrame)) {
|
|
// Since we're appending, we'll walk to the last anonymous frame
|
|
- // that was created for the broken inline frame. But don't walk
|
|
- // to the trailing inline if it's empty; stop at the block.
|
|
+ // that was created for the broken inline frame. We can walk to the
|
|
+ // trailing inline, since we know this is a real append, and not an
|
|
+ // insert (that would've been handled by `FindNextSibling`).
|
|
aInsertion->mParentFrame =
|
|
- GetLastIBSplitSibling(aInsertion->mParentFrame, false);
|
|
+ GetLastIBSplitSibling(aInsertion->mParentFrame, true);
|
|
}
|
|
// Get continuation that parents the last child. This MUST be done
|
|
// before the AdjustAppendParentForAfterContent call.
|