--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -11414,16 +11414,19 @@ nsCSSFrameConstructor::ProcessChildren(n
     ReparentFrames(this, blockFrame, aFrameItems, false);
 
     blockFrame->SetInitialChildList(kPrincipalList, aFrameItems);
     NS_ASSERTION(aFrameItems.IsEmpty(), "How did that happen?");
     aFrameItems.Clear();
     aFrameItems.AddChild(blockFrame);
 
     aFrame->AddStateBits(NS_STATE_BOX_WRAPS_KIDS_IN_BLOCK);
+    MOZ_ASSERT(!aFrame->IsLeaf(),
+               "Why do we have an nsLeafBoxFrame here?");
+    aFrame->AddStateBits(NS_FRAME_OWNS_ANON_BOXES);
   }
 }
 
 //----------------------------------------------------------------------
 
 // Support for :first-line style
 
 // Special routine to handle placing a list of frames into a block

--- a/layout/xul/nsBoxFrame.cpp
+++ b/layout/xul/nsBoxFrame.cpp
@@ -1903,16 +1903,24 @@ nsBoxFrame::RegUnregAccessKey(bool aDoRe
 }
 
 bool
 nsBoxFrame::SupportsOrdinalsInChildren()
 {
   return true;
 }
 
+void
+nsBoxFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult)
+{
+  if (GetStateBits() & NS_STATE_BOX_WRAPS_KIDS_IN_BLOCK) {
+    aResult.AppendElement(OwnedAnonBox(PrincipalChildList().FirstChild()));
+  }
+}
+
 // Helper less-than-or-equal function, used in CheckBoxOrder() as a
 // template-parameter for the sorting functions.
 bool
 IsBoxOrdinalLEQ(nsIFrame* aFrame1,
                 nsIFrame* aFrame2)
 {
   // If we've got a placeholder frame, use its out-of-flow frame's ordinal val.
   nsIFrame* aRealFrame1 = nsPlaceholderFrame::GetRealFrameFor(aFrame1);

--- a/layout/xul/nsBoxFrame.h
+++ b/layout/xul/nsBoxFrame.h
@@ -166,16 +166,21 @@ public:
                              const nsDisplayListSet& aOut);
 
   /**
    * This defaults to true, but some box frames (nsListBoxBodyFrame for
    * example) don't support ordinals in their children.
    */
   virtual bool SupportsOrdinalsInChildren();
 
+  /**
+   * Return our wrapper block, if any.
+   */
+  void AppendDirectlyOwnedAnonBoxes(nsTArray<OwnedAnonBox>& aResult) override;
+
 private:
   explicit nsBoxFrame(nsStyleContext* aContext)
     : nsBoxFrame(aContext, kClassID, false, nullptr) {}
 protected:
   nsBoxFrame(nsStyleContext* aContext, ClassID aID, bool aIsRoot = false,
              nsBoxLayout* aLayoutManager = nullptr);
   virtual ~nsBoxFrame();