wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 683702: In nsFrame teardown, clear the reference to me on my prev IB sibling (as well as on my next IB sibling). r=roc

Browse Source
This commit is contained in:
Daniel Holbert 2011-09-01 00:10:22 -07:00
parent 55a9249c51
commit 5d075a7a42
4 changed files with 57 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
layout/generic/crashtests/682649-1.html Normal file
View File

@ -0,0 +1,18 @@
<!DOCTYPE html>
<html style="position: relative; -moz-column-count: 3;" class="reftest-wait">
<head>
<script>
function boom()
{
document.documentElement.offsetHeight;
document.body.style.position = "";
document.documentElement.offsetHeight;
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="boom();" style="position: absolute;">A<span><div></div>B</span></body>
</html>

24
layout/generic/crashtests/683702-1.xhtml Normal file
View File

@ -0,0 +1,24 @@
<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
<head>
<script>
function doe() {
document.getElementById('a').style.display = '';
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="doe()">
<div style="position: absolute; -moz-column-count: 2;">
<table id="c">
<div id="a" style="border: 100px solid black; display:none;"></div><tr>
<td style="position: absolute;">
<span>
<div style="border: 100px solid black;"></div>
</span>
</td>
</tr>
</table>
</div>
</body>
</html>

2
layout/generic/crashtests/crashtests.list
View File

@ -370,3 +370,5 @@ load text-overflow-bug671796.xhtml
load 667025.html
asserts(14) load 673770.html # bug 569193 and bug 459597
load 679933-1.html
load 682649-1.html
load 683702-1.xhtml

15
layout/generic/nsFrame.cpp
View File

@ -451,16 +451,27 @@ nsFrame::DestroyFrom(nsIFrame* aDestructRoot)
}
}
// If we have an IB split special sibling, clear its reference to us.
// If we have any IB split special siblings, clear their references to us.
// (Note: This has to happen before we call shell->NotifyDestroyingFrame,
// because that clears our Properties() table.)
if (mState & NS_FRAME_IS_SPECIAL) {
// Delete previous sibling's reference to me.
nsIFrame* prevSib = static_cast<nsIFrame*>
(Properties().Get(nsIFrame::IBSplitSpecialPrevSibling()));
if (prevSib) {
NS_WARN_IF_FALSE(this ==
prevSib->Properties().Get(nsIFrame::IBSplitSpecialSibling()),
"IB sibling chain is inconsistent");
prevSib->Properties().Delete(nsIFrame::IBSplitSpecialSibling());
}
// Delete next sibling's reference to me.
nsIFrame* nextSib = static_cast<nsIFrame*>
(Properties().Get(nsIFrame::IBSplitSpecialSibling()));
if (nextSib) {
NS_WARN_IF_FALSE(this ==
nextSib->Properties().Get(nsIFrame::IBSplitSpecialPrevSibling()),
"Next-sibling / prev-sibling chain is inconsistent");
"IB sibling chain is inconsistent");
nextSib->Properties().Delete(nsIFrame::IBSplitSpecialPrevSibling());
}
}