tor-browser

commit 77769aba0eeff6d56ff619c38d5c3d11cd877d57
parent 5cf5d7e9dd3e3668767f2335f9097121a3ac275a
Author: Emily McDonough <emcdonough@mozilla.com>
Date:   Mon,  3 Nov 2025 19:00:17 +0000

Bug 1997453 - Clean up the temporary line iterator when applying text-decoration-inset. r=layout-jp-market-reviewers,layout-reviewers,jfkthame

Differential Revision: https://phabricator.services.mozilla.com/D270894

Diffstat:
M
layout/generic/nsTextFrame.cpp
 | 
8
++++++++

1 file changed, 8 insertions(+), 0 deletions(-)
diff --git a/layout/generic/nsTextFrame.cpp b/layout/generic/nsTextFrame.cpp
@@ -5893,6 +5893,14 @@ static bool ComputeDecorationInset(
         decRect.Deflate(indentMargin);
       }
     }
+
+    // We can't allow a block frame to retain a line iterator if we're
+    // currently in reflow, as it will become invalid as the line list is
+    // reflowed.
+    if (lineContainer->HasAnyStateBits(NS_FRAME_IN_REFLOW) &&
+        lineContainer->IsBlockFrameOrSubclass()) {
+      static_cast<nsBlockFrame*>(lineContainer)->ClearLineIterator();
+    }
   }
 
   // The rect of the current frame, mapped to the same coordinate space as