wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 454751. Use a fresh nsFrameConstructorState when we construct new frames in ReconstructDocElementHierarchyInternal, so internal state pointing to deleted frames is flushed out. r+sr=bzbarsky

Browse Source
This commit is contained in:
Robert O'Callahan 2008-11-26 11:12:06 +13:00
parent 3f3b6013d1
commit 98a52f5f6c
3 changed files with 40 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
layout/base/crashtests/454751-1.xul Normal file
View File

@ -0,0 +1,20 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="addStyleSheet('window { display: table; }');">
<script type="text/javascript">
function addStyleSheet(text)
{
var sheet = document.createElementNS("http://www.w3.org/1999/xhtml", "style");
sheet.appendChild(document.createTextNode(text));
document.documentElement.appendChild(sheet);
}
</script>
<treecols/>
</window>

1
layout/base/crashtests/crashtests.list
View File

@ -125,6 +125,7 @@ load 429088-2.html
load 432752-1.svg
load 433450-1.html
load 444925-1.xul
load 454751-1.xul
load 455063-1.html
load 455063-2.html
load 455063-3.html

31
layout/base/nsCSSFrameConstructor.cpp
View File

@ -7683,20 +7683,27 @@ nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal()
return rv;
}
}
mInitialContainingBlock = nsnull;
mRootElementStyleFrame = nsnull;
}
}
if (rootContent && NS_SUCCEEDED(rv)) {
mInitialContainingBlock = nsnull;
mRootElementStyleFrame = nsnull;
// Create the new document element hierarchy
nsIFrame* newChild;
rv = ConstructDocElementFrame(state, rootContent,
mDocElementContainingBlock, &newChild);
// We don't reuse the old frame constructor state because,
// for example, its mPopupItems may be stale
nsFrameConstructorState state(mPresShell, mFixedContainingBlock,
nsnull, nsnull, mTempFrameTreeState);
// newChild could be null even if |rv| is success, thanks to XBL.
if (NS_SUCCEEDED(rv) && newChild) {
rv = state.mFrameManager->InsertFrames(mDocElementContainingBlock,
nsnull, nsnull, newChild);
}
// Create the new document element hierarchy
nsIFrame* newChild;
rv = ConstructDocElementFrame(state, rootContent,
mDocElementContainingBlock, &newChild);
// newChild could be null even if |rv| is success, thanks to XBL.
if (NS_SUCCEEDED(rv) && newChild) {
rv = state.mFrameManager->InsertFrames(mDocElementContainingBlock,
nsnull, nsnull, newChild);
}
}
}