Bug 267037. Buttons should delegate child frames to the wrapped block, and tell the style system that legends are always blocks. Fixes a couple of crashes. r+sr=bzbarsky

layout/forms/nsHTMLButtonControlFrame.h

@@ -148,6 +148,11 @@ public:
   NS_IMETHOD GetProperty(nsIAtom* aName, nsAString& aValue); 
   NS_IMETHOD SetSuggestedSize(nscoord aWidth, nscoord aHeight);
 
+  // Inserted child content gets its frames parented by our child block
+  virtual nsIFrame* GetContentInsertionFrame() {
+    return GetFirstChild(nsnull)->GetContentInsertionFrame();
+  }
+
 protected:
   void ReParentFrameList(nsFrameManager* aFrameManager, nsIFrame* aFrameList);
   virtual PRBool IsReset(PRInt32 type);

layout/style/html.css

@@ -87,6 +87,13 @@ center {
   text-align: -moz-center;
 }
 
+legend {
+  /* HTML legend always builds an nsLegendFrame,
+     which is a block. The style system needs to
+     know. */
+  display: block !important;
+}
+
 blockquote[type=cite] {
   display: block;
   margin: 1em 0px;