From df8f95f6c87857c0690e206f4fd1d7b317759bb0 Mon Sep 17 00:00:00 2001 From: "bzbarsky%mit.edu" Date: Sat, 11 Nov 2006 03:33:51 +0000 Subject: [PATCH] Fix crash bug 348510. r+sr=roc, a=dveditz git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_0_BRANCH@215144 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/layout/base/nsCSSFrameConstructor.cpp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/mozilla/layout/base/nsCSSFrameConstructor.cpp b/mozilla/layout/base/nsCSSFrameConstructor.cpp index c150f75db7d..90afa7787af 100644 --- a/mozilla/layout/base/nsCSSFrameConstructor.cpp +++ b/mozilla/layout/base/nsCSSFrameConstructor.cpp @@ -13890,12 +13890,18 @@ nsCSSFrameConstructor::SplitToContainingBlock(nsFrameConstructorState& aState, MarkIBSpecialPrevSibling(aState.mPresContext, blockFrame, firstInFlow); - // If we have a continuation frame, then we need to break the - // continuation. + // If we have a continuation frame, then we need to blow it away. Otherwise + // the flow will get all confused, with dangling in-flows around, and things + // pointing to the wrong things as in-flows. So just nuke the flow and we'll + // recover it when we reflow. nsIFrame* nextInFlow = aFrame->GetNextInFlow(); if (nextInFlow) { aFrame->SetNextInFlow(nsnull); nextInFlow->SetPrevInFlow(nsnull); + nsIFrame* parent = nextInFlow->GetParent(); + nsCOMPtr listName; + GetChildListNameFor(parent, nextInFlow, getter_AddRefs(listName)); + parent->RemoveFrame(listName, nextInFlow); } // This is where the mothership lands and we start to get a bit