diff --git a/layout/generic/ReflowInput.cpp b/layout/generic/ReflowInput.cpp
index 133c2702bc2c..058b79aab133 100644
--- a/layout/generic/ReflowInput.cpp
+++ b/layout/generic/ReflowInput.cpp
@@ -1093,6 +1093,14 @@ ReflowInput::ApplyRelativePositioning(nsIFrame* aFrame,
}
}
+// Returns true if aFrame is non-null, a XUL frame, and "XUL-collapsed" (which
+// only becomes a valid question to ask if we know it's a XUL frame).
+static bool
+IsXULCollapsedXULFrame(nsIFrame* aFrame)
+{
+ return aFrame && aFrame->IsXULBoxFrame() && aFrame->IsXULCollapsed();
+}
+
nsIFrame*
ReflowInput::GetHypotheticalBoxContainer(nsIFrame* aFrame,
nscoord& aCBIStartEdge,
@@ -1128,9 +1136,23 @@ ReflowInput::GetHypotheticalBoxContainer(nsIFrame* aFrame,
NS_ASSERTION(!(aFrame->GetStateBits() & NS_FRAME_IN_REFLOW),
"aFrame shouldn't be in reflow; we'll lie if it is");
WritingMode wm = aFrame->GetWritingMode();
- LogicalMargin borderPadding = aFrame->GetLogicalUsedBorderAndPadding(wm);
- aCBIStartEdge = borderPadding.IStart(wm);
- aCBSize = aFrame->GetLogicalSize(wm) - borderPadding.Size(wm);
+ // Compute CB's offset & content-box size by subtracting borderpadding from
+ // frame size. Exception: if the CB is 0-sized, it *might* be a child of a
+ // XUL-collapsed frame and might have nonzero borderpadding that was simply
+ // discarded during its layout. (See the child-zero-sizing in
+ // nsSprocketLayout::XULLayout()). In that case, we ignore the
+ // borderpadding here (just like we did when laying it out), or else we'd
+ // produce a bogus negative content-box size.
+ aCBIStartEdge = 0;
+ aCBSize = aFrame->GetLogicalSize(wm);
+ if (!aCBSize.IsAllZero() ||
+ (!IsXULCollapsedXULFrame(aFrame->GetParent()))) {
+ // aFrame is not XUL-collapsed (nor is it a child of a XUL-collapsed
+ // frame), so we can go ahead and subtract out border padding.
+ LogicalMargin borderPadding = aFrame->GetLogicalUsedBorderAndPadding(wm);
+ aCBIStartEdge += borderPadding.IStart(wm);
+ aCBSize -= borderPadding.Size(wm);
+ }
}
return aFrame;
diff --git a/layout/xul/crashtests/1379332-1.xul b/layout/xul/crashtests/1379332-1.xul
new file mode 100644
index 000000000000..97288d5955aa
--- /dev/null
+++ b/layout/xul/crashtests/1379332-1.xul
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
diff --git a/layout/xul/crashtests/1379332-2.xul b/layout/xul/crashtests/1379332-2.xul
new file mode 100644
index 000000000000..230afca124fe
--- /dev/null
+++ b/layout/xul/crashtests/1379332-2.xul
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
diff --git a/layout/xul/crashtests/crashtests.list b/layout/xul/crashtests/crashtests.list
index d5d43e7e54cf..f62f192f19e2 100644
--- a/layout/xul/crashtests/crashtests.list
+++ b/layout/xul/crashtests/crashtests.list
@@ -97,3 +97,9 @@ load 583957-1.html
load 617089.html
load menulist-focused.xhtml
load 716503.html
+
+# Bug 1379332's tests need stylo to be disabled in order for the
+# 'visiblity:collapse' to take effect (which is needed to trigger the assertion
+# that these tests are screening for, in unpatched builds):
+pref(layout.css.servo.enabled,false) load 1379332-1.xul
+pref(layout.css.servo.enabled,false) load 1379332-2.xul