crash if position: absolute applied to <math>, b=151054, r=roc+moz, sr=waterson

layout/base/nsCSSFrameConstructor.cpp

@@ -6982,9 +6982,6 @@ nsCSSFrameConstructor::ConstructMathMLFrame(nsIPresShell*            aPresShell,
     nsHTMLContainerFrame::CreateViewForFrame(aPresContext, newFrame,
                                              aStyleContext, aParentFrame, PR_FALSE);
 
-    // Add the new frame to our list of frame items.
-    aFrameItems.AddChild(newFrame);
-
     // Process the child content if requested
     nsFrameItems childItems;
     if (processChildren) {
@@ -7015,6 +7012,10 @@ nsCSSFrameConstructor::ConstructMathMLFrame(nsIPresShell*            aPresShell,
       // Add the placeholder frame to the flow
       aFrameItems.AddChild(placeholderFrame);
     }
+    else {
+      // Add the new frame to our list of frame items.
+      aFrameItems.AddChild(newFrame);
+    }
   }
   return rv;
 }

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -6982,9 +6982,6 @@ nsCSSFrameConstructor::ConstructMathMLFrame(nsIPresShell*            aPresShell,
     nsHTMLContainerFrame::CreateViewForFrame(aPresContext, newFrame,
                                              aStyleContext, aParentFrame, PR_FALSE);
 
-    // Add the new frame to our list of frame items.
-    aFrameItems.AddChild(newFrame);
-
     // Process the child content if requested
     nsFrameItems childItems;
     if (processChildren) {
@@ -7015,6 +7012,10 @@ nsCSSFrameConstructor::ConstructMathMLFrame(nsIPresShell*            aPresShell,
       // Add the placeholder frame to the flow
       aFrameItems.AddChild(placeholderFrame);
     }
+    else {
+      // Add the new frame to our list of frame items.
+      aFrameItems.AddChild(newFrame);
+    }
   }
   return rv;
 }