Back out bug 354600 to fix regressions.

layout/base/nsCSSFrameConstructor.cpp

@@ -12617,6 +12617,8 @@ nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState& aState,
     *aNewFrame = columnSetFrame;
 
     columnSetFrame->SetInitialChildList(nsnull, blockFrame);
+
+    blockFrame->AddStateBits(NS_BLOCK_SPACE_MGR);
   }
 
   blockFrame->SetStyleContextWithoutNotification(blockStyle);
@@ -12633,6 +12635,13 @@ nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState& aState,
   // See if we need to create a view, e.g. the frame is absolutely positioned
   nsHTMLContainerFrame::CreateViewForFrame(blockFrame, contentParent, PR_FALSE);
 
+  // If we're the first block to be created (e.g., because we're
+  // contained inside a XUL document), then make sure that we've got a
+  // space manager so we can handle floats...
+  if (! aState.mFloatedItems.containingBlock) {
+    blockFrame->AddStateBits(NS_BLOCK_SPACE_MGR | NS_BLOCK_MARGIN_ROOT);
+  }
+
   // We should make the outer frame be the absolute containing block,
   // if one is required. We have to do this because absolute
   // positioning must be computed with respect to the CSS dimensions
@@ -12779,6 +12788,10 @@ nsCSSFrameConstructor::ConstructInline(nsFrameConstructorState& aState,
     blockFrame = NS_NewBlockFrame(mPresShell, blockSC);
   }
 
+  if (! aState.mFloatedItems.containingBlock) {
+    blockFrame->AddStateBits(NS_BLOCK_SPACE_MGR | NS_BLOCK_MARGIN_ROOT);
+  }
+
   InitAndRestoreFrame(aState, aContent, aParentFrame, nsnull, blockFrame, PR_FALSE);  
 
   // Any inline frame could have a view (e.g., opacity)

layout/forms/nsComboboxControlFrame.cpp

@@ -1869,7 +1869,7 @@ nsComboboxControlFrame::CreateFrameFor(nsPresContext*   aPresContext,
   }
 
   // Start by by creating our anonymous block frame
-  mDisplayFrame = NS_NewBlockFrame(shell, styleContext);
+  mDisplayFrame = NS_NewBlockFrame(shell, styleContext, NS_BLOCK_SPACE_MGR);
   if (NS_UNLIKELY(!mDisplayFrame)) {
     return NS_ERROR_OUT_OF_MEMORY;
   }

layout/generic/nsBlockFrame.cpp

@@ -6934,8 +6934,9 @@ nsBlockFrame::Init(nsIContent*      aContent,
 
   nsresult rv = nsBlockFrameSuper::Init(aContent, aParent, aPrevInFlow);
 
-  ParentChanged();
-  
+  if (IsBoxWrapped())
+    mState |= NS_BLOCK_SPACE_MGR;
+
   return rv;
 }
 
@@ -7323,8 +7324,11 @@ NS_IMETHODIMP
 nsBlockFrame::SetParent(const nsIFrame* aParent)
 {
   nsresult rv = nsBlockFrameSuper::SetParent(aParent);
+  if (IsBoxWrapped())
+    mState |= NS_BLOCK_SPACE_MGR;
 
-  ParentChanged();
+  // XXX should we clear NS_BLOCK_SPACE_MGR if we were the child of a box
+  // but no longer are?
 
   return rv;
 }
@@ -7416,25 +7420,3 @@ nsBlockFrame::GetDepth() const
   return depth;
 }
 #endif
-
-void
-nsBlockFrame::ParentChanged()
-{
-  if (mParent && !mParent->IsFloatContainingBlock()) {
-    AddStateBits(NS_BLOCK_SPACE_MGR);
-
-    // columnated blocks are block formatting context roots, but not margin
-    // roots.  All other blocks that are not kids of blocks are margin roots.
-    if (mParent->GetType() != nsLayoutAtoms::columnSetFrame) {
-      AddStateBits(NS_BLOCK_MARGIN_ROOT);
-    }
-  }
-#ifdef DEBUG
-  else {
-    NS_ASSERTION(!IsBoxWrapped(), "A box is a float containing block?");
-  }
-#endif
-
-  // XXX should we clear NS_BLOCK_SPACE_MGR bit if we had a non-block parent
-  // but now have a block?
-}

layout/generic/nsBlockFrame.h

@@ -572,12 +572,6 @@ protected:
   void ReflowBullet(nsBlockReflowState& aState,
                     nsHTMLReflowMetrics& aMetrics);
 
-  /**
-   * Function that should be called whenever the parent of this frame
-   * changes, after mParent is set.
-   */
-  void ParentChanged();
-
   //----------------------------------------
 
 public:

layout/generic/nsColumnSetFrame.cpp

@@ -524,6 +524,8 @@ nsColumnSetFrame::ReflowChildren(nsHTMLReflowMetrics&     aDesiredSize,
           break;
         }
         
+        kidNextInFlow->AddStateBits(NS_BLOCK_SPACE_MGR);
+
         // Do an initial reflow if we're going to reflow this thing.
         aKidReason = eReflowReason_Initial;
       }

layout/generic/nsHTMLParts.h

@@ -102,7 +102,7 @@ NS_NewAreaFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRUint32 aFl
 // These AreaFrame's shrink wrap around their contents
 inline nsIFrame*
 NS_NewTableCellInnerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext) {
-  return NS_NewBlockFrame(aPresShell, aContext);
+  return NS_NewBlockFrame(aPresShell, aContext, NS_BLOCK_SPACE_MGR|NS_BLOCK_MARGIN_ROOT);
 }
 
 // This type of AreaFrame is the document root, a margin root, and the

layout/mathml/base/src/nsMathMLmtableFrame.h

@@ -307,7 +307,10 @@ public:
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const;
 
 protected:
-  nsMathMLmtdInnerFrame(nsStyleContext* aContext) : nsBlockFrame(aContext) {}
+  nsMathMLmtdInnerFrame(nsStyleContext* aContext) : nsBlockFrame(aContext) {
+    // Set the right bits -- see what NS_NewTableCellInnerFrame does
+    AddStateBits(NS_BLOCK_SPACE_MGR | NS_BLOCK_MARGIN_ROOT);
+  }
   virtual ~nsMathMLmtdInnerFrame();
 
   virtual PRIntn GetSkipSides() const { return 0; }