Bug 595758 - Crash [@ nsTableFrame::MarkIntrinsicWidthsDirty] on print preview. r=dbaron a=blocking2.0:betaN

layout/tables/crashtests/crashtests.list

@@ -104,3 +104,5 @@ load 573354-1.xhtml
 load 576890-1.html
 load 576890-2.html
 load 576890-3.html
+asserts(0-1) load 595758-1.xhtml # Bug 453871
+load 595758-2.xhtml

layout/tables/nsTableFrame.cpp

@@ -1473,7 +1473,17 @@ nsTableFrame::ProcessRowInserted(nscoord aNewHeight)
 /* virtual */ void
 nsTableFrame::MarkIntrinsicWidthsDirty()
 {
-  LayoutStrategy()->MarkIntrinsicWidthsDirty();
+  nsITableLayoutStrategy* tls = LayoutStrategy();
+  if (NS_UNLIKELY(!tls)) {
+    // This is a FrameNeedsReflow() from nsBlockFrame::RemoveFrame()
+    // walking up the ancestor chain in a table next-in-flow.  In this case
+    // our original first-in-flow (which owns the TableLayoutStrategy) has
+    // already been destroyed and unhooked from the flow chain and thusly
+    // LayoutStrategy() returns null.  All the frames in the flow will be
+    // destroyed so no need to mark anything dirty here.  See bug 595758.
+    return;
+  }
+  tls->MarkIntrinsicWidthsDirty();
 
   // XXXldb Call SetBCDamageArea?