Bug 1507196 - Find first ColumnSetFrame in the child lists of ColumnSetWrapperFrame (and it's continuations). r=dbaron

ColumnSetFrame is always created by nsCSSFrameConstructor::BeginBuildingColumns(). We search for it in the possible child lists of ColumnSetWrapperFrame and its continuations. Differential Revision: https://phabricator.services.mozilla.com/D14501 --HG-- extra : moz-landing-system : lando
2018-12-20 00:07:59 +00:00 · 2018-12-20 00:07:59 +00:00 · 69209e69b9
--- a/layout/generic/ColumnSetWrapperFrame.cpp
+++ b/layout/generic/ColumnSetWrapperFrame.cpp
@ -63,7 +63,20 @@ void ColumnSetWrapperFrame::AppendDirectlyOwnedAnonBoxes(
  // Thus, no need to restyle them. AssertColumnSpanWrapperSubtreeIsSane()
  // asserts all the conditions above which allow us to skip appending
  // -moz-column-span-wrappers.
-  nsIFrame* columnSet = PrincipalChildList().FirstChild();
+  auto FindFirstChildInChildLists = [this]() -> nsIFrame* {
+    const ChildListID listIDs[] = {kPrincipalList, kOverflowList};
+    for (nsIFrame* frag = this; frag; frag = frag->GetNextInFlow()) {
+      for (ChildListID id : listIDs) {
+        const nsFrameList& list = frag->GetChildList(id);
+        if (nsIFrame* firstChild = list.FirstChild()) {
+          return firstChild;
+        }
+      }
+    }
+    return nullptr;
+  };
+
+  nsIFrame* columnSet = FindFirstChildInChildLists();
  MOZ_ASSERT(columnSet && columnSet->IsColumnSetFrame(),
             "The first child should always be ColumnSet!");
  aResult.AppendElement(OwnedAnonBox(columnSet));
--- a/layout/generic/crashtests/1507196.html
+++ b/layout/generic/crashtests/1507196.html
@ -0,0 +1,30 @@
+<html>
+
+<head>
+  <style class="">
+    * {
+      border-block-start-style: ridge;
+      margin-block-end: calc(27914%) !important;
+      float: left;
+      margin-inline-start: 3em;
+      -moz-column-width: 15px
+    }
+
+    HTML {
+      width: calc(25px* 3);
+      font: condensed bold italic small-caps 19769px/calc(1 + 2*188/4) Times New Roman, serif ! important;
+      height: calc(153%) !important;
+    }
+  </style>
+  <script>
+    function start() {
+      o1 = document.createElementNS('http://www.w3.org/1999/xhtml', 'c')
+      document.documentElement.appendChild(o1)
+      o1.scrollTop = 100
+      o1.dir = ''
+    }
+    document.addEventListener('DOMContentLoaded', start)
+  </script>
+</head>
+
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -720,3 +720,4 @@ load 1494380.html
 load 1505817.html
 pref(layout.css.column-span.enabled,true) load 1506216.html
 pref(layout.css.column-span.enabled,true) load 1506306.html
+pref(layout.css.column-span.enabled,true) load 1507196.html