Bug 1032450 - Flag the reflow state for a table frame as a "dummy" state if its parent state is. r=roc

InitCBReflowState() copies the mCBReflowState from the parent
reflow state for table frames, which is null for "dummy" states,
so it would lead to a crash in InitConstraints() which assumes
non-dummy states has a non-null mCBReflowState.
This commit is contained in:
Mats Palmgren 2014-07-04 11:48:15 +00:00
parent c80262ec64
commit a0fc4f03ca
3 changed files with 16 additions and 1 deletions

View File

@ -0,0 +1,12 @@
<html>
<head>
</head>
<body style="display: -moz-inline-grid;">
<div style="display: table;position: relative; float: left;">
<button style="display: table-column-group;">
<iframe style="position: absolute;"></iframe>
</button>
</div>
</body></html>

View File

@ -534,3 +534,4 @@ pref(layout.css.grid.enabled,true) load 1015562.html
asserts(1-2) load 1015563-1.html
asserts(1-2) load 1015563-2.html
load outline-on-frameset.xhtml
pref(font.size.inflation.minTwips,200) load 1032450.html

View File

@ -212,7 +212,9 @@ nsHTMLReflowState::nsHTMLReflowState(nsPresContext* aPresContext,
aParentReflowState.mPercentHeightObserver->NeedsToObserve(*this))
? aParentReflowState.mPercentHeightObserver : nullptr;
if (aFlags & DUMMY_PARENT_REFLOW_STATE) {
if ((aFlags & DUMMY_PARENT_REFLOW_STATE) ||
(parentReflowState->mFlags.mDummyParentReflowState &&
frame->GetType() == nsGkAtoms::tableFrame)) {
mFlags.mDummyParentReflowState = true;
}