Bug 526375. Enforce always appending to the last continuation for {ib} splits. r=roc

layout/base/crashtests/526378-1.xul

@@ -0,0 +1,28 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var x = document.getElementById("x");
+  
+  x.appendChild(document.createTextNode("A"));
+  x.appendChild(document.createTextNode("\u202B" + "C"));
+
+  document.getBoxObjectFor(document.documentElement).height; // flush layout
+
+  x.normalize();
+  x.appendChild(document.createTextNode("D"));
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<box id="x" style="display:inline"><box/></box>
+</window>

layout/base/crashtests/crashtests.list

@@ -265,3 +265,4 @@ load 497519-2.xhtml
 load 500467-1.html
 load 501878-1.html
 load 503936-1.html
+load 526378-1.xul

layout/base/nsCSSFrameConstructor.cpp

@@ -5731,8 +5731,16 @@ AdjustAppendParentForAfterContent(nsPresContext* aPresContext,
     // either the last or next to last special sibling.
     nsIFrame* trailingInline = GetSpecialSibling(aParentFrame);
     if (trailingInline) {
-      aParentFrame = trailingInline->GetLastContinuation();
+      aParentFrame = trailingInline;
     }
+
+    // Always make sure to look at the last continuation of the frame
+    // for the {ib} case, even if that continuation is empty.  We
+    // don't do this for the non-special-frame case, since in the
+    // other cases appending to the last nonempty continuation is fine
+    // and in fact not doing that can confuse code that doesn't know
+    // to pull kids from continuations other than its next one.
+    aParentFrame = aParentFrame->GetLastContinuation();
   }
 
   return aParentFrame;