Bug 598907 - crash [@ _purecall | nsGenericHTMLFormElement::IsDisabled() ]. r=smaug a=blocking

This commit is contained in:
Mounir Lamouri 2010-11-05 18:15:05 +01:00
parent 45a67c2d71
commit 529415fddc
4 changed files with 40 additions and 0 deletions

View File

@ -2322,6 +2322,10 @@ nsGenericHTMLFormElement::nsGenericHTMLFormElement(already_AddRefed<nsINodeInfo>
nsGenericHTMLFormElement::~nsGenericHTMLFormElement()
{
if (mFieldSet) {
static_cast<nsHTMLFieldSetElement*>(mFieldSet)->RemoveElement(this);
}
// Check that this element doesn't know anything about its form at this point.
NS_ASSERTION(!mForm, "mForm should be null at this point!");
}
@ -2939,13 +2943,20 @@ nsGenericHTMLFormElement::UpdateFieldSet()
static_cast<nsHTMLFieldSetElement*>(parent);
if (!prev || fieldset->GetFirstLegend() != prev) {
if (mFieldSet) {
static_cast<nsHTMLFieldSetElement*>(mFieldSet)->RemoveElement(this);
}
mFieldSet = fieldset;
fieldset->AddElement(this);
return;
}
}
}
// No fieldset found.
if (mFieldSet) {
static_cast<nsHTMLFieldSetElement*>(mFieldSet)->RemoveElement(this);
}
mFieldSet = nsnull;
}

View File

@ -874,6 +874,19 @@ public:
FieldSetDisabledChanged(nsEventStates(), aNotify);
}
/**
* This callback is called by a fieldset on all it's elements when it's being
* destroyed. When called, the elements should check that aFieldset is there
* first parent fieldset and null mFieldset in that case only.
*
* @param aFieldSet The fieldset being removed.
*/
void ForgetFieldSet(nsIContent* aFieldset) {
if (mFieldSet == aFieldset) {
mFieldSet = nsnull;
}
}
/**
* Returns if the control can be disabled.
*/

View File

@ -58,6 +58,10 @@ nsHTMLFieldSetElement::nsHTMLFieldSetElement(already_AddRefed<nsINodeInfo> aNode
nsHTMLFieldSetElement::~nsHTMLFieldSetElement()
{
PRUint32 length = mDependentElements.Length();
for (PRUint32 i=0; i<length; ++i) {
mDependentElements[i]->ForgetFieldSet(this);
}
}
// nsISupports

View File

@ -41,6 +41,7 @@
#include "nsGenericHTMLElement.h"
#include "nsIDOMHTMLFieldSetElement.h"
#include "nsIConstraintValidation.h"
#include "nsTPtrArray.h"
class nsHTMLFieldSetElement : public nsGenericHTMLFormElement,
@ -87,6 +88,14 @@ public:
const nsIContent* GetFirstLegend() const { return mFirstLegend; }
void AddElement(nsGenericHTMLFormElement* aElement) {
mDependentElements.AppendElement(aElement);
}
void RemoveElement(nsGenericHTMLFormElement* aElement) {
mDependentElements.RemoveElement(aElement);
}
NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsHTMLFieldSetElement,
nsGenericHTMLFormElement)
private:
@ -104,6 +113,9 @@ private:
// listed form controls elements.
nsRefPtr<nsContentList> mElements;
// List of elements which have this fieldset as first fieldset ancestor.
nsTPtrArray<nsGenericHTMLFormElement> mDependentElements;
nsIContent* mFirstLegend;
};