From 7004b1f411e555598090563e1bdc3a224cfb8795 Mon Sep 17 00:00:00 2001
From: Mats Palmgren <matspal@gmail.com>
Date: Sun, 14 Nov 2010 19:26:36 +0100
Subject: [PATCH] Bug 595758 - Crash [@ nsTableFrame::MarkIntrinsicWidthsDirty]
 on print preview.  r=dbaron a=blocking2.0:betaN

---
 layout/tables/crashtests/crashtests.list |  2 ++
 layout/tables/nsTableFrame.cpp           | 12 +++++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/layout/tables/crashtests/crashtests.list b/layout/tables/crashtests/crashtests.list
index 4620d541f70..c5ab0764c42 100644
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -104,3 +104,5 @@ load 573354-1.xhtml
 load 576890-1.html
 load 576890-2.html
 load 576890-3.html
+asserts(0-1) load 595758-1.xhtml # Bug 453871
+load 595758-2.xhtml
diff --git a/layout/tables/nsTableFrame.cpp b/layout/tables/nsTableFrame.cpp
index 5c2ad1bbbfe..9dee72b12a5 100644
--- a/layout/tables/nsTableFrame.cpp
+++ b/layout/tables/nsTableFrame.cpp
@@ -1473,7 +1473,17 @@ nsTableFrame::ProcessRowInserted(nscoord aNewHeight)
 /* virtual */ void
 nsTableFrame::MarkIntrinsicWidthsDirty()
 {
-  LayoutStrategy()->MarkIntrinsicWidthsDirty();
+  nsITableLayoutStrategy* tls = LayoutStrategy();
+  if (NS_UNLIKELY(!tls)) {
+    // This is a FrameNeedsReflow() from nsBlockFrame::RemoveFrame()
+    // walking up the ancestor chain in a table next-in-flow.  In this case
+    // our original first-in-flow (which owns the TableLayoutStrategy) has
+    // already been destroyed and unhooked from the flow chain and thusly
+    // LayoutStrategy() returns null.  All the frames in the flow will be
+    // destroyed so no need to mark anything dirty here.  See bug 595758.
+    return;
+  }
+  tls->MarkIntrinsicWidthsDirty();
 
   // XXXldb Call SetBCDamageArea?