Bug 1457985: Fix a typo in nsStyleContentData copy-constructor.
MozReview-Commit-ID: FtcA6Nm4dwr
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1457985.html
@@ -0,0 +1,2 @@
+<body style="content:attr(a) open-quote">
+<header style="all:inherit">
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -270,8 +270,9 @@ pref(dom.webcomponents.shadowdom.enabled
load 1426312.html
load 1439793.html
load 1409183.html
pref(dom.webcomponents.shadowdom.enabled,true) load 1445682.html
load 1450691.html
pref(dom.webcomponents.shadowdom.enabled,true) load 1453206.html
load 1454140.html
load 1455108.html
+load 1457985.html
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -4156,17 +4156,17 @@ nsStyleContentData::nsStyleContentData(c
mContent.mImage->AddRef();
break;
case eStyleContentType_Counter:
case eStyleContentType_Counters:
mContent.mCounters = aOther.mContent.mCounters;
mContent.mCounters->AddRef();
break;
case eStyleContentType_Attr:
- mContent.mAttr = new nsStyleContentAttr(*mContent.mAttr);
+ mContent.mAttr = new nsStyleContentAttr(*aOther.mContent.mAttr);
break;
case eStyleContentType_String:
mContent.mString = NS_strdup(aOther.mContent.mString);
break;
default:
MOZ_ASSERT(!aOther.mContent.mString);
mContent.mString = nullptr;
}