Bug 424238. Make sure to guard against mutations happening while we notify on opening the <body> and <frameset> tags, just like we do in FlushTags. r+sr=sicking

This commit is contained in:
Boris Zbarsky 2008-08-25 13:21:29 -04:00
parent eacd163726
commit 3cfa360533

View File

@ -2076,12 +2076,18 @@ HTMLContentSink::OpenBody(const nsIParserNode& aNode)
// insertionPoint is not -1, but this code will try to handle
// those cases too.
PRBool oldUpdates = mUpdatesInNotification;
mUpdatesInNotification = 0;
if (insertionPoint != -1) {
NotifyInsert(parent, mBody, insertionPoint - 1);
} else {
NotifyAppend(parent, numFlushed);
}
mCurrentContext->mStack[parentIndex].mNumFlushed = childCount;
if (mUpdatesInNotification > 1) {
UpdateChildCounts();
}
mUpdatesInNotification = oldUpdates;
}
StartLayout(PR_FALSE);
@ -2232,12 +2238,18 @@ HTMLContentSink::OpenFrameset(const nsIParserNode& aNode)
// insertionPoint is not -1, but this code will try to handle
// those cases too.
PRBool oldUpdates = mUpdatesInNotification;
mUpdatesInNotification = 0;
if (insertionPoint != -1) {
NotifyInsert(parent, mFrameset, insertionPoint - 1);
} else {
NotifyAppend(parent, numFlushed);
}
mCurrentContext->mStack[parentIndex].mNumFlushed = childCount;
if (mUpdatesInNotification > 1) {
UpdateChildCounts();
}
mUpdatesInNotification = oldUpdates;
}
return rv;