From 6edd0834a1807cec20366d172715420a559c9ca6 Mon Sep 17 00:00:00 2001 From: Boris Zbarsky Date: Sun, 26 Jun 2011 12:48:37 -0400 Subject: [PATCH] Bug 480686. Don't assume that the next-continuation of an inline frame is in the same block; it could be in the next-in-flow of the block. r=roc --- layout/base/crashtests/480686-1.html | 13 +++++++++++++ layout/base/crashtests/crashtests.list | 1 + layout/base/nsCSSRendering.cpp | 8 ++++++-- 3 files changed, 20 insertions(+), 2 deletions(-) create mode 100644 layout/base/crashtests/480686-1.html diff --git a/layout/base/crashtests/480686-1.html b/layout/base/crashtests/480686-1.html new file mode 100644 index 00000000000..8a4ba72d66e --- /dev/null +++ b/layout/base/crashtests/480686-1.html @@ -0,0 +1,13 @@ + + + + + + +
Q
+ + diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list index b8b4a888988..d779ab087e5 100644 --- a/layout/base/crashtests/crashtests.list +++ b/layout/base/crashtests/crashtests.list @@ -259,6 +259,7 @@ load 479114-1.html load 477333-1.xhtml load 477731-1.html asserts(6) load 479360-1.xhtml # Bug 439258 +load 480686-1.html load 481806-1.html asserts(6) load 483604-1.xhtml # Bug 439258 load 485501-1.html diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp index 301f4f92e72..87ad6ceda7e 100644 --- a/layout/base/nsCSSRendering.cpp +++ b/layout/base/nsCSSRendering.cpp @@ -344,11 +344,15 @@ protected: } PRBool AreOnSameLine(nsIFrame* aFrame1, nsIFrame* aFrame2) { - // Assumes that aFrame1 and aFrame2 are both decsendants of mBlockFrame. PRBool isValid1, isValid2; nsBlockInFlowLineIterator it1(mBlockFrame, aFrame1, &isValid1); nsBlockInFlowLineIterator it2(mBlockFrame, aFrame2, &isValid2); - return isValid1 && isValid2 && it1.GetLine() == it2.GetLine(); + return isValid1 && isValid2 && + // Make sure aFrame1 and aFrame2 are in the same continuation of + // mBlockFrame. + it1.GetContainer() == it2.GetContainer() && + // And on the same line in it + it1.GetLine() == it2.GetLine(); } };