Bug 1413288: The owner of a bullet frame is the first continuation of the parent. r?xidorn
MozReview-Commit-ID: FUsdsETkV2Q
--- a/layout/base/ServoRestyleManager.cpp
+++ b/layout/base/ServoRestyleManager.cpp
@@ -61,17 +61,17 @@ ExpectedOwnerForChild(const nsIFrame& aF
if (parent->IsLineFrame()) {
parent = parent->GetParent();
}
return parent->IsViewportFrame() ?
nullptr : FirstContinuationOrPartOfIBSplit(parent);
}
if (aFrame.IsBulletFrame()) {
- return parent;
+ return FirstContinuationOrPartOfIBSplit(parent);
}
if (aFrame.IsLineFrame()) {
// A ::first-line always ends up here via its block, which is therefore the
// right expected owner. That block can be an
// anonymous box. For example, we could have a ::first-line on a columnated
// block; the blockframe is the column-content anonymous box in that case.
// So we don't want to end up in the code below, which steps out of anon
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1413288.html
@@ -0,0 +1,17 @@
+<style>
+:root { column-width: 0px; }
+:not(article) { padding: 2 0px; }
+</style>
+<script>
+function jsfuzzer() {
+try { htmlvar00007.setAttribute("align", "LEFT"); } catch(e) { }
+try { svgvar00016.getStartPositionOfChar(0); } catch(e) { }
+try { htmlvar00016.style.setProperty("column-gap", "0"); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<iframe id="htmlvar00007"></iframe>
+<details>
+<summary id="htmlvar00016">)
+<svg>
+<tspan id="svgvar00016" />
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -253,8 +253,9 @@ load 1404324-2.html
load 1404324-3.html
load 1404057.html
load 1409502.html
load 1409931.html
load 1410226-1.html
load 1410226-2.html
load 1411143.html
load 1411478.html
+load 1413288.html
