Bug 1376158: Don't let non-primary frames affect the mIncrementScriptLevel of the content. r?xidorn
In the test-case we have a munderoverFrame setting the script-level of the
content through a frame which is an anonymous block, and another one setting the
script level to the opposite for the same content, via its primary frame.
That's somewhat silly, and with the previous patches the non-primary one
happened to be ignored because the IncrementScriptLevel flag was set on the fly.
The whole situation is somewhat silly, because as far as I can tell MathML tries
to map one frame to one element, and this doesn't hold. This patch makes the
behavior consistent and makes the test-case render as "invalid markup", which is
what should happen anyway.
MozReview-Commit-ID: 5ugxVwX3sMa
new file mode 100644
--- /dev/null
+++ b/layout/mathml/crashtests/1376158.html
@@ -0,0 +1,6 @@
+<math>
+<munderover>
+></ms>
+<munder accentunder="true">
+<mo>)</mo>
+<mscarry>
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -60,8 +60,9 @@ load 713606-1.html
load 716349-1.html
load 767251.xhtml
load 848725-1.html
load 848725-2.html
load 947557-1.html
load 973322-1.xhtml
load 1028521-1.xhtml
load 1061027.html
+load 1376158.html
--- a/layout/mathml/nsMathMLmunderoverFrame.cpp
+++ b/layout/mathml/nsMathMLmunderoverFrame.cpp
@@ -102,17 +102,18 @@ nsMathMLmunderoverFrame::ScriptIncrement
return 0; // frame not found
}
void
nsMathMLmunderoverFrame::SetIncrementScriptLevel(uint32_t aChildIndex,
bool aIncrement)
{
nsIFrame* child = PrincipalChildList().FrameAt(aChildIndex);
- if (!child || !child->GetContent()->IsMathMLElement()) {
+ if (!child || !child->GetContent()->IsMathMLElement() ||
+ child->GetContent()->GetPrimaryFrame() != child) {
return;
}
auto element = static_cast<nsMathMLElement*>(child->GetContent());
if (element->GetIncrementScriptLevel() == aIncrement) {
return;
}
