diff options
| -rw-r--r-- | layout/base/crashtests/1419762.html | 15 | ||||
| -rw-r--r-- | layout/base/crashtests/crashtests.list | 1 | ||||
| -rw-r--r-- | layout/base/nsCSSFrameConstructor.cpp | 7 |
3 files changed, 20 insertions, 3 deletions
diff --git a/layout/base/crashtests/1419762.html b/layout/base/crashtests/1419762.html new file mode 100644 index 000000000..08a56106d --- /dev/null +++ b/layout/base/crashtests/1419762.html @@ -0,0 +1,15 @@ +<style id='style_1'> + :first-child { display: table-column-group; } +</style> +<script> + try { o1 = document.createElement('isindex') } catch(e) { } + try { o2 = document.createElement('input') } catch(e) { } + try { o3 = document.createElement('optgroup') } catch(e) { } + try { o4 = document.createElement('col') } catch(e) { } + try { document.documentElement.appendChild(o1) } catch(e) { } + try { o1.appendChild(o2) } catch(e) { } + try { o1.appendChild(o3) } catch(e) { } + try { document.documentElement.offsetTop; } catch (e) { } + try { document.documentElement.appendChild(o4) } catch(e) { } + try { document.styleSheets[0].insertRule('optgroup::first-line { list-style-type: japanese-formal; }', 0); } catch(e) { } +</script> diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list index 66dc35ebc..9b09d1c84 100644 --- a/layout/base/crashtests/crashtests.list +++ b/layout/base/crashtests/crashtests.list @@ -485,3 +485,4 @@ load 1308848-2.html asserts(0-1) load 1343606.html # bug 1343948 load 1404789-1.html load 1404789-2.html +load 1419762.html diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp index f69ffe603..c7312dafb 100644 --- a/layout/base/nsCSSFrameConstructor.cpp +++ b/layout/base/nsCSSFrameConstructor.cpp @@ -6781,10 +6781,11 @@ nsCSSFrameConstructor::GetInsertionPrevSibling(InsertionPoint* aInsertion, *aIsAppend = true; if (IsFramePartOfIBSplit(aInsertion->mParentFrame)) { // Since we're appending, we'll walk to the last anonymous frame - // that was created for the broken inline frame. But don't walk - // to the trailing inline if it's empty; stop at the block. + // that was created for the broken inline frame. We can walk to the + // trailing inline, since we know this is a real append, and not an + // insert (that would've been handled by `FindNextSibling`). aInsertion->mParentFrame = - GetLastIBSplitSibling(aInsertion->mParentFrame, false); + GetLastIBSplitSibling(aInsertion->mParentFrame, true); } // Get continuation that parents the last child. aInsertion->mParentFrame = |