{inc} MathML matrices break when the content sink is incremental, b=344281, r+sr=bzbarsky

layout/mathml/base/src/nsMathMLmrowFrame.cpp

@@ -72,3 +72,23 @@ nsMathMLmrowFrame::InheritAutomaticData(nsIFrame* aParent)
 
   return NS_OK;
 }
+
+nsIFrame*
+nsMathMLmrowFrame::GetContentInsertionFrame()
+{
+  // Special for <mtable>: In the frame construction code, we also use
+  // this frame class as a wrapper for mtable. Hence, if we are asked 
+  // for the insertion frame in the context where we are such a wrapper,
+  // we should return the real frame intended for mtable
+  if (mContent->Tag() == nsMathMLAtoms::mtable_) {
+    nsIFrame* frame = mFrames.FirstChild();
+    for ( ; frame; frame = frame->GetFirstChild(nsnull)) {
+      // drill down to the real mtable
+      if (frame->GetType() == nsLayoutAtoms::tableOuterFrame)
+        return frame->GetContentInsertionFrame();
+    }
+    NS_NOTREACHED("mtable wrapper without the real table frame");
+  }
+
+  return nsMathMLContainerFrame::GetContentInsertionFrame();
+}

layout/mathml/base/src/nsMathMLmrowFrame.h

@@ -50,6 +50,9 @@ class nsMathMLmrowFrame : public nsMathMLContainerFrame {
 public:
   friend nsIFrame* NS_NewMathMLmrowFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
+  virtual nsIFrame*
+  GetContentInsertionFrame();
+
   NS_IMETHOD
   InheritAutomaticData(nsIFrame* aParent);