When reflowing a frame (such as text controls) that jumps from HTML layout into XUL layout and then jumps back to HTML on the child frame, link the parent reflow state chain correctly. (Bug 627842, patch 3) r=roc

layout/generic/nsFrame.cpp

@@ -7509,8 +7509,21 @@ nsFrame::BoxReflow(nsBoxLayoutState&        aState,
 
     // Construct the parent chain manually since constructing it normally
     // messes up dimensions.
+    const nsHTMLReflowState *outerReflowState = aState.OuterReflowState();
+    NS_ASSERTION(!outerReflowState || outerReflowState->frame != this,
+                 "in and out of XUL on a single frame?");
+    if (outerReflowState && outerReflowState->frame == parentFrame) {
+      // We're a frame (such as a text control frame) that jumps into
+      // box reflow and then straight out of it on the child frame.
+      // This means we actually have a real parent reflow state.
+      // nsLayoutUtils::InflationMinFontSizeFor needs this to be linked
+      // up correctly for text control frames, so do so here).
+      reflowState.parentReflowState = outerReflowState;
+      reflowState.mCBReflowState = outerReflowState;
+    } else {
       reflowState.parentReflowState = &parentReflowState;
       reflowState.mCBReflowState = &parentReflowState;
+    }
     reflowState.mReflowDepth = aState.GetReflowDepth();
 
     // mComputedWidth and mComputedHeight are content-box, not

layout/xul/base/src/nsBoxFrame.cpp

@@ -676,7 +676,7 @@ nsBoxFrame::Reflow(nsPresContext*          aPresContext,
 
   // create the layout state
   nsBoxLayoutState state(aPresContext, aReflowState.rendContext,
-                         aReflowState.mReflowDepth);
+                         &aReflowState, aReflowState.mReflowDepth);
 
   nsSize computedSize(aReflowState.ComputedWidth(),aReflowState.ComputedHeight());
 

layout/xul/base/src/nsBoxLayoutState.cpp

@@ -46,9 +46,11 @@
 
 nsBoxLayoutState::nsBoxLayoutState(nsPresContext* aPresContext,
                                    nsRenderingContext* aRenderingContext,
+                                   const nsHTMLReflowState* aOuterReflowState,
                                    PRUint16 aReflowDepth)
   : mPresContext(aPresContext)
   , mRenderingContext(aRenderingContext)
+  , mOuterReflowState(aOuterReflowState)
   , mLayoutFlags(0)
   , mReflowDepth(aReflowDepth)
   , mPaintingDisabled(false)
@@ -59,6 +61,7 @@ nsBoxLayoutState::nsBoxLayoutState(nsPresContext* aPresContext,
 nsBoxLayoutState::nsBoxLayoutState(const nsBoxLayoutState& aState)
   : mPresContext(aState.mPresContext)
   , mRenderingContext(aState.mRenderingContext)
+  , mOuterReflowState(aState.mOuterReflowState)
   , mLayoutFlags(aState.mLayoutFlags)
   , mReflowDepth(aState.mReflowDepth + 1)
   , mPaintingDisabled(aState.mPaintingDisabled)

layout/xul/base/src/nsBoxLayoutState.h

@@ -59,7 +59,10 @@ class nsHTMLReflowCommand;
 class NS_STACK_CLASS nsBoxLayoutState
 {
 public:
-  nsBoxLayoutState(nsPresContext* aPresContext, nsRenderingContext* aRenderingContext = nsnull,
+  nsBoxLayoutState(nsPresContext* aPresContext,
+                   nsRenderingContext* aRenderingContext = nsnull,
+                   // see OuterReflowState() below
+                   const nsHTMLReflowState* aOuterReflowState = nsnull,
                    PRUint16 aReflowDepth = 0) NS_HIDDEN;
   nsBoxLayoutState(const nsBoxLayoutState& aState) NS_HIDDEN;
 
@@ -84,11 +87,16 @@ public:
   void* AllocateStackMemory(size_t aSize)
   { return PresShell()->AllocateStackMemory(aSize); }
 
+  // The HTML reflow state that lives outside the box-block boundary.
+  // May not be set reliably yet.
+  const nsHTMLReflowState* OuterReflowState() { return mOuterReflowState; }
+
   PRUint16 GetReflowDepth() { return mReflowDepth; }
   
 private:
   nsRefPtr<nsPresContext> mPresContext;
   nsRenderingContext *mRenderingContext;
+  const nsHTMLReflowState *mOuterReflowState;
   PRUint32 mLayoutFlags;
   PRUint16 mReflowDepth; 
   bool mPaintingDisabled;