Bug 395628 - ""ASSERTION: post-reflow queues not empty" with feed in <frame>" [p=mats.palmgren@bredband.net (Mats Palmgren) r=smaug r+sr=dbaron a=blocking1.9+]

layout/base/nsIReflowCallback.h

@@ -38,12 +38,15 @@
 #ifndef nsIReflowCallback_h___
 #define nsIReflowCallback_h___
 
-class nsIPresShell;
-
 /**
  * Reflow callback interface.
  * These are not refcounted. Objects must be removed from the presshell
  * callback list before they die.
+ * Protocol: objects will either get a ReflowFinished() call when a reflow
+ * has finished or a ReflowCallbackCanceled() call if the shell is destroyed,
+ * whichever happens first. If the object is explicitly removed from the shell
+ * (using nsIPresShell::CancelReflowCallback()) before that occurs then neither
+ * of the callback methods are called.
  */
 class nsIReflowCallback {
 public:
@@ -52,6 +55,12 @@ public:
    * you need a Flush_Layout to happen after this.
    */
   virtual PRBool ReflowFinished() = 0;
+  /**
+   * The presshell calls this on outstanding callback requests in its
+   * Destroy() method. The shell removes the request after calling
+   * ReflowCallbackCanceled().
+   */
+  virtual void ReflowCallbackCanceled() = 0;
 };
 
-#endif /* nsIFrameUtil_h___ */
+#endif /* nsIReflowCallback_h___ */

layout/base/nsPresShell.cpp

@@ -1002,6 +1002,7 @@ protected:
   virtual ~PresShell();
 
   void HandlePostedReflowCallbacks();
+  void CancelPostedReflowCallbacks();
 
   void UnsuppressAndInvalidate();
 
@@ -1663,6 +1664,7 @@ PresShell::Destroy()
   mReflowEvent.Revoke();
 
   CancelAllPendingReflows();
+  CancelPostedReflowCallbacks();
 
   // Destroy the frame manager. This will destroy the frame hierarchy
   mFrameConstructor->WillDestroyFrameTree();
@@ -4372,6 +4374,23 @@ PresShell::CancelReflowCallback(nsIReflowCallback* aCallback)
    return NS_OK;
 }
 
+void
+PresShell::CancelPostedReflowCallbacks()
+{
+  while (mFirstCallbackEventRequest) {
+    nsCallbackEventRequest* node = mFirstCallbackEventRequest;
+    mFirstCallbackEventRequest = node->next;
+    if (!mFirstCallbackEventRequest) {
+      mLastCallbackEventRequest = nsnull;
+    }
+    nsIReflowCallback* callback = node->callback;
+    FreeFrame(sizeof(nsCallbackEventRequest), node);
+    if (callback) {
+      callback->ReflowCallbackCanceled();
+    }
+  }
+}
+
 void
 PresShell::HandlePostedReflowCallbacks()
 {
@@ -5492,7 +5511,7 @@ PresShell::HandleEvent(nsIView         *aView,
       nsXULPopupManager* pm = nsXULPopupManager::GetInstance();
       if (pm) {
         nsTArray<nsIFrame*> popups = pm->GetOpenPopups();
-        PRInt32 i;
+        PRUint32 i;
         // Search from top to bottom
         for (i = 0; i < popups.Length(); i++) {
           nsIFrame* popup = popups[i];

layout/generic/nsFrameFrame.cpp

@@ -176,6 +176,7 @@ public:
 
   // nsIReflowCallback
   virtual PRBool ReflowFinished();
+  virtual void ReflowCallbackCanceled();
 
 protected:
   nsSize GetMargin();
@@ -584,6 +585,11 @@ nsSubDocumentFrame::ReflowFinished()
   return PR_FALSE;
 }
 
+void
+nsSubDocumentFrame::ReflowCallbackCanceled()
+{
+  mPostedReflowCallback = PR_FALSE;
+}
 
 NS_IMETHODIMP
 nsSubDocumentFrame::VerifyTree() const

layout/generic/nsGfxScrollFrame.cpp

@@ -2389,6 +2389,12 @@ nsGfxScrollFrameInner::ReflowFinished()
   return PR_TRUE;
 }
 
+void
+nsGfxScrollFrameInner::ReflowCallbackCanceled()
+{
+  mPostedReflowCallback = PR_FALSE;
+}
+
 static void LayoutAndInvalidate(nsBoxLayoutState& aState,
                                 nsIFrame* aBox, const nsRect& aRect)
 {

layout/generic/nsGfxScrollFrame.h

@@ -96,6 +96,7 @@ public:
 
   // nsIReflowCallback
   virtual PRBool ReflowFinished();
+  virtual void ReflowCallbackCanceled();
 
   // nsIScrollPositionListener
 

layout/xul/base/src/nsListBoxBodyFrame.cpp

@@ -507,6 +507,12 @@ nsListBoxBodyFrame::ReflowFinished()
   return PR_TRUE;
 }
 
+void
+nsListBoxBodyFrame::ReflowCallbackCanceled()
+{
+  mReflowCallbackPosted = PR_FALSE;
+}
+
 ///////// nsIListBoxObject ///////////////
 
 NS_IMETHODIMP

layout/xul/base/src/nsListBoxBodyFrame.h

@@ -88,6 +88,7 @@ public:
 
   // nsIReflowCallback
   virtual PRBool ReflowFinished();
+  virtual void ReflowCallbackCanceled();
 
   // nsIBox
   NS_IMETHOD DoLayout(nsBoxLayoutState& aBoxLayoutState);

layout/xul/base/src/nsMenuFrame.cpp

@@ -234,7 +234,8 @@ public:
   {
   }
 
-  virtual PRBool ReflowFinished() {
+  virtual PRBool ReflowFinished()
+  {
     PRBool shouldFlush = PR_FALSE;
     if (mWeakFrame.IsAlive()) {
       if (mWeakFrame.GetFrame()->GetType() == nsGkAtoms::menuFrame) {
@@ -247,6 +248,11 @@ public:
     return shouldFlush;
   }
 
+  virtual void ReflowCallbackCanceled()
+  {
+    delete this;
+  }
+
   nsWeakFrame mWeakFrame;
 };
 

layout/xul/base/src/nsProgressMeterFrame.cpp

@@ -88,6 +88,11 @@ public:
     return shouldFlush;
   }
 
+  virtual void ReflowCallbackCanceled()
+  {
+    delete this;
+  }
+
   nsWeakFrame mWeakFrame;
 };
 

layout/xul/base/src/nsTextBoxFrame.cpp

@@ -225,6 +225,11 @@ public:
         return shouldFlush;
     }
 
+    virtual void ReflowCallbackCanceled()
+    {
+        delete this;
+    }
+
     nsWeakFrame mWeakFrame;
 };
 

layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp

@@ -481,6 +481,11 @@ nsTreeBodyFrame::ReflowFinished()
   return PR_FALSE;
 }
 
+void
+nsTreeBodyFrame::ReflowCallbackCanceled()
+{
+  mReflowCallbackPosted = PR_FALSE;
+}
 
 NS_IMETHODIMP nsTreeBodyFrame::GetView(nsITreeView * *aView)
 {

layout/xul/base/src/tree/src/nsTreeBodyFrame.h

@@ -94,6 +94,7 @@ public:
 
   // nsIReflowCallback
   virtual PRBool ReflowFinished();
+  virtual void ReflowCallbackCanceled();
 
   // nsICSSPseudoComparator
   NS_IMETHOD PseudoMatches(nsIAtom* aTag, nsCSSSelector* aSelector, PRBool* aResult);