diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp index 68c8694ff3b..2a768d4b760 100644 --- a/layout/base/nsLayoutUtils.cpp +++ b/layout/base/nsLayoutUtils.cpp @@ -621,8 +621,7 @@ nsLayoutUtils::GetChildListNameFor(nsIFrame* aChildFrame) return nsIFrame::kPopupList; #endif // MOZ_XUL } else { - NS_ASSERTION(aChildFrame->IsFloating(), - "not a floated frame"); + NS_ASSERTION(aChildFrame->IsFloating(), "not a floated frame"); id = nsIFrame::kFloatList; } @@ -660,6 +659,10 @@ nsLayoutUtils::GetChildListNameFor(nsIFrame* aChildFrame) else if (aChildFrame->IsFloating()) { found = parent->GetChildList(nsIFrame::kOverflowOutOfFlowList) .ContainsFrame(aChildFrame); + if (!found) { + found = parent->GetChildList(nsIFrame::kPushedFloatsList) + .ContainsFrame(aChildFrame); + } } // else it's positioned and should have been on the 'id' child list. NS_POSTCONDITION(found, "not in child list"); diff --git a/layout/generic/crashtests/847208.html b/layout/generic/crashtests/847208.html new file mode 100644 index 00000000000..2128dbbb8e9 --- /dev/null +++ b/layout/generic/crashtests/847208.html @@ -0,0 +1,16 @@ + + + + + + +

text

+ + diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list index da3d4a3cdba..3020554907c 100644 --- a/layout/generic/crashtests/crashtests.list +++ b/layout/generic/crashtests/crashtests.list @@ -448,3 +448,4 @@ test-pref(layout.css.flexbox.enabled,true) load 827168-1.html load 842132-1.html test-pref(layout.css.flexbox.enabled,true) load 844529-1.html load 847130.xhtml +load 847208.html diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp index c9e1727f1a5..d18b92768ae 100644 --- a/layout/generic/nsBlockFrame.cpp +++ b/layout/generic/nsBlockFrame.cpp @@ -4954,16 +4954,8 @@ nsBlockFrame::AddFrames(nsFrameList& aFrameList, nsIFrame* aPrevSibling) } void -nsBlockFrame::RemoveFloat(nsIFrame* aFloat) +nsBlockFrame::RemoveFloatFromFloatCache(nsIFrame* aFloat) { -#ifdef DEBUG - if (!mFloats.ContainsFrame(aFloat)) { - MOZ_ASSERT(GetOverflowOutOfFlows() && - GetOverflowOutOfFlows()->ContainsFrame(aFloat), - "aFloat is not our child or on an unexpected frame list"); - } -#endif - // Find which line contains the float, so we can update // the float cache. line_iterator line = begin_lines(), line_end = end_lines(); @@ -4972,19 +4964,45 @@ nsBlockFrame::RemoveFloat(nsIFrame* aFloat) break; } } +} + +void +nsBlockFrame::RemoveFloat(nsIFrame* aFloat) +{ +#ifdef DEBUG + // Floats live in mFloats, or in the PushedFloat or OverflowOutOfFlows + // frame list properties. + if (!mFloats.ContainsFrame(aFloat)) { + MOZ_ASSERT((GetOverflowOutOfFlows() && + GetOverflowOutOfFlows()->ContainsFrame(aFloat)) || + (GetPushedFloats() && + GetPushedFloats()->ContainsFrame(aFloat)), + "aFloat is not our child or on an unexpected frame list"); + } +#endif if (mFloats.StartRemoveFrame(aFloat)) { return; } + nsFrameList* list = GetPushedFloats(); + if (list && list->ContinueRemoveFrame(aFloat)) { +#if 0 + // XXXmats not yet - need to investigate nsBlockReflowState::mPushedFloats + // first so we don't leave it pointing to a deleted list. + if (list->IsEmpty()) { + delete RemovePushedFloats(); + } +#endif + return; + } + { nsAutoOOFFrameList oofs(this); if (oofs.mList.ContinueRemoveFrame(aFloat)) { return; } } - - MOZ_ASSERT(false, "float child frame not found"); } static void MarkSameFloatManagerLinesDirty(nsBlockFrame* aBlock) @@ -5103,6 +5121,7 @@ nsBlockFrame::DoRemoveOutOfFlowFrame(nsIFrame* aFrame) ->DeleteNextInFlowChild(aFrame->PresContext(), nif, false); } // Now remove aFrame from its child list and Destroy it. + block->RemoveFloatFromFloatCache(aFrame); block->RemoveFloat(aFrame); aFrame->Destroy(); } diff --git a/layout/generic/nsBlockFrame.h b/layout/generic/nsBlockFrame.h index 82ec0f9fbd0..749481aaa20 100644 --- a/layout/generic/nsBlockFrame.h +++ b/layout/generic/nsBlockFrame.h @@ -518,10 +518,13 @@ protected: uint8_t FindTrailingClear(); /** - * Remove a float from our float list and also the float cache - * for the line its placeholder is on. - */ + * Remove a float from our float list. + */ void RemoveFloat(nsIFrame* aFloat); + /** + * Remove a float from the float cache for the line its placeholder is on. + */ + void RemoveFloatFromFloatCache(nsIFrame* aFloat); void CollectFloats(nsIFrame* aFrame, nsFrameList& aList, bool aCollectFromSiblings) {