Bug 1494332 - Avoid setting the has-first-letter child bit on a first-line. r=bzbarsky

We rely on the bit being on the block to restyle them in the right order.

Differential Revision: https://phabricator.services.mozilla.com/D7086

--HG--
extra : moz-landing-system : lando

layout/base/crashtests/1494332.html

@@ -0,0 +1,6 @@
+  <style>
+    body::first-letter,
+    body::first-line {
+  </style>
+  XXX {
+  <img id="h" srcset="B"></img>

layout/base/crashtests/crashtests.list

@@ -544,4 +544,5 @@ pref(layout.accessiblecaret.enabled,true) load 1472020.html
 load 1472027.html
 load 1489149.html
 load 1490037.html
+load 1494332.html
 load 1494030.html

layout/base/nsCSSFrameConstructor.cpp

@@ -10582,6 +10582,9 @@ nsCSSFrameConstructor::CreateLetterFrame(nsContainerFrame* aBlockFrame,
     MOZ_ASSERT(!aBlockFrame->GetPrevContinuation(),
                "Setting up a first-letter frame on a non-first block continuation?");
     auto parent = static_cast<nsContainerFrame*>(aParentFrame->FirstContinuation());
+    if (MOZ_UNLIKELY(parent->IsLineFrame())) {
+      parent = parent->GetParent();
+    }
     parent->SetHasFirstLetterChild();
     aBlockFrame->SetProperty(nsContainerFrame::FirstLetterProperty(),
                              letterFrame);
@@ -10700,6 +10703,7 @@ static void ClearHasFirstLetterChildFrom(nsContainerFrame* aParentFrame)
   auto* parent =
     static_cast<nsContainerFrame*>(aParentFrame->FirstContinuation());
   if (MOZ_UNLIKELY(parent->IsLineFrame())) {
+    MOZ_ASSERT(!parent->HasFirstLetterChild());
     parent = parent->GetParent();
   }
   MOZ_ASSERT(parent->HasFirstLetterChild());