Bug 480686. Don't assume that the next-continuation of an inline frame is in the same block; it could be in the next-in-flow of the block. r=roc

2011-06-26 12:48:37 -04:00 · 2011-06-26 12:48:37 -04:00 · 54c33b27a9
--- a/layout/base/crashtests/480686-1.html
+++ b/layout/base/crashtests/480686-1.html
@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+span { background: url(../../../testing/crashtest/images/tree.gif); }
+
+</style>
+</head>
+
+<body><div style="direction: rtl;"><div style="-moz-column-width: 1px;"><span>Q<input></span></div></div></body>
+
+</html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@ -258,9 +258,12 @@ load 471594-1.xhtml
 load 479114-1.html
 load 477333-1.xhtml
 load 477731-1.html
+# 479360-1.xhtml will assert 6 times due to bug 439258 and then make the test
+# after the test after it also assert 6 times.
 asserts(6) load 479360-1.xhtml # Bug 439258
-load 481806-1.html
-asserts(6) load 483604-1.xhtml # Bug 439258
+load 480686-1.html
+asserts(6) load 481806-1.html  # Bug 439258
+load 483604-1.xhtml
 load 485501-1.html
 load 487544-1.html
 load 488390-1.xhtml
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@ -344,11 +344,15 @@ protected:
  }

  PRBool AreOnSameLine(nsIFrame* aFrame1, nsIFrame* aFrame2) {
-    // Assumes that aFrame1 and aFrame2 are both decsendants of mBlockFrame.
    PRBool isValid1, isValid2;
    nsBlockInFlowLineIterator it1(mBlockFrame, aFrame1, &isValid1);
    nsBlockInFlowLineIterator it2(mBlockFrame, aFrame2, &isValid2);
-    return isValid1 && isValid2 && it1.GetLine() == it2.GetLine();
+    return isValid1 && isValid2 &&
+      // Make sure aFrame1 and aFrame2 are in the same continuation of
+      // mBlockFrame.
+      it1.GetContainer() == it2.GetContainer() &&
+      // And on the same line in it
+      it1.GetLine() == it2.GetLine();
  }
 };