From 3b3b31593d9f85234adc73ff8c084758b9c5912c Mon Sep 17 00:00:00 2001 From: Scott Johnson Date: Sat, 7 Sep 2013 19:02:11 -0500 Subject: [PATCH] Bug 794693, part 2: Perform parent reflow state calculation at the box-block interface before setting up child reflow state to prevent crashing when a parent reflow state is assumed to be non-null. [r=dbaron] --- layout/generic/crashtests/794693.html | 9 ++++++ layout/generic/crashtests/crashtests.list | 1 + layout/generic/nsFrame.cpp | 36 ++++++++++------------- layout/generic/nsHTMLReflowState.cpp | 2 +- 4 files changed, 27 insertions(+), 21 deletions(-) create mode 100644 layout/generic/crashtests/794693.html diff --git a/layout/generic/crashtests/794693.html b/layout/generic/crashtests/794693.html new file mode 100644 index 00000000000..7d9f4c90f19 --- /dev/null +++ b/layout/generic/crashtests/794693.html @@ -0,0 +1,9 @@ + + + + + text text + + + + diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list index 53423e62838..fbe9e719098 100644 --- a/layout/generic/crashtests/crashtests.list +++ b/layout/generic/crashtests/crashtests.list @@ -466,6 +466,7 @@ load 769303-2.html load 769120.html load 786740-1.html asserts(0-4) test-pref(font.size.inflation.emPerLine,15) load 791601.xhtml # 3 counts of bug 871327, 1 bug 367185 +pref(font.size.inflation.minTwips,120) load 794693.html asserts(8) test-pref(layout.css.flexbox.enabled,true) load 798020-1.html test-pref(layout.css.flexbox.enabled,true) load 798235-1.html test-pref(layout.css.flexbox.enabled,true) load 799207-1.html diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp index a2e5ea6a44b..2e471fc941c 100644 --- a/layout/generic/nsFrame.cpp +++ b/layout/generic/nsFrame.cpp @@ -7770,15 +7770,6 @@ nsFrame::BoxReflow(nsBoxLayoutState& aState, gIndent2++; #endif - //printf("width=%d, height=%d\n", aWidth, aHeight); - /* - nsIFrame* parent; - GetParentBox(&parent); - - // if (parent->GetStateBits() & NS_STATE_CURRENTLY_IN_DEBUG) - // printf("In debug\n"); - */ - nsBoxLayoutMetrics *metrics = BoxMetrics(); nsReflowStatus status = NS_FRAME_COMPLETE; @@ -7855,30 +7846,35 @@ nsFrame::BoxReflow(nsBoxLayoutState& aState, parentReflowState.mComputedBorderPadding += parentReflowState.mComputedPadding; - // XXX Is it OK that this reflow state has no parent reflow state? - // (It used to have a bogus parent, skipping all the boxes). - nsSize availSize(aWidth, NS_INTRINSICSIZE); - nsHTMLReflowState reflowState(aPresContext, this, aRenderingContext, - availSize, - nsHTMLReflowState::DUMMY_PARENT_REFLOW_STATE); - // Construct the parent chain manually since constructing it normally // messes up dimensions. const nsHTMLReflowState *outerReflowState = aState.OuterReflowState(); NS_ASSERTION(!outerReflowState || outerReflowState->frame != this, "in and out of XUL on a single frame?"); + const nsHTMLReflowState* parentRS; if (outerReflowState && outerReflowState->frame == parentFrame) { // We're a frame (such as a text control frame) that jumps into // box reflow and then straight out of it on the child frame. // This means we actually have a real parent reflow state. // nsLayoutUtils::InflationMinFontSizeFor used to need this to be // linked up correctly for text control frames, so do so here). - reflowState.parentReflowState = outerReflowState; - reflowState.mCBReflowState = outerReflowState; + parentRS = outerReflowState; } else { - reflowState.parentReflowState = &parentReflowState; - reflowState.mCBReflowState = &parentReflowState; + parentRS = &parentReflowState; } + + // XXX Is it OK that this reflow state has only one ancestor? + // (It used to have a bogus parent, skipping all the boxes). + nsSize availSize(aWidth, NS_INTRINSICSIZE); + nsHTMLReflowState reflowState(aPresContext, *parentRS, this, + availSize, -1, -1, + nsHTMLReflowState::DUMMY_PARENT_REFLOW_STATE); + + // XXX_jwir3: This is somewhat fishy. If this is actually changing the value + // here (which it might be), then we should make sure that it's + // correct the first time around, rather than changing it later. + reflowState.mCBReflowState = parentRS; + reflowState.mReflowDepth = aState.GetReflowDepth(); // mComputedWidth and mComputedHeight are content-box, not diff --git a/layout/generic/nsHTMLReflowState.cpp b/layout/generic/nsHTMLReflowState.cpp index 4a20f5f12ad..27e7bcf4a7b 100644 --- a/layout/generic/nsHTMLReflowState.cpp +++ b/layout/generic/nsHTMLReflowState.cpp @@ -1845,7 +1845,7 @@ nsHTMLReflowState::InitConstraints(nsPresContext* aPresContext, // If this is a reflow root, then set the computed width and // height equal to the available space - if (nullptr == parentReflowState) { + if (nullptr == parentReflowState || mFlags.mDummyParentReflowState) { // XXXldb This doesn't mean what it used to! InitOffsets(aContainingBlockWidth, VerticalOffsetPercentBasis(frame, aContainingBlockWidth,