Make sure to push a null float containing block for <mtd>. Bug 399676, r+sr=roc

layout/base/nsCSSFrameConstructor.cpp

@@ -4077,7 +4077,7 @@ nsCSSFrameConstructor::ConstructTableCellFrame(nsFrameConstructorState& aState,
   InitAndRestoreFrame(aState, aContent, aNewCellOuterFrame, nsnull, aNewCellInnerFrame);
 
   if (!aIsPseudo) {
-    PRBool haveFirstLetterStyle, haveFirstLineStyle;
+    PRBool haveFirstLetterStyle = PR_FALSE, haveFirstLineStyle = PR_FALSE;
     if (isBlock) {
       ShouldHaveSpecialBlockStyle(aContent, aStyleContext,
                                   &haveFirstLetterStyle, &haveFirstLineStyle);
@@ -4085,10 +4085,9 @@ nsCSSFrameConstructor::ConstructTableCellFrame(nsFrameConstructorState& aState,
 
     // The block frame is a float container
     nsFrameConstructorSaveState floatSaveState;
-    if (isBlock) {
-      aState.PushFloatContainingBlock(aNewCellInnerFrame, floatSaveState,
+    aState.PushFloatContainingBlock(isBlock ? aNewCellInnerFrame : nsnull,
+                                    floatSaveState,
                                     haveFirstLetterStyle, haveFirstLineStyle);
-    }
 
     // Process the child content
     nsFrameItems childItems;