wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 569018. If our candidate parent frame isn't for our container content then it's not a candidate parent frame. r=bzbarsky

Browse Source
This commit is contained in:
Timothy Nikkel 2010-07-02 14:11:04 -05:00
parent 60e2c474d2
commit 9fa49496f5
3 changed files with 27 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
layout/base/crashtests/569018-1.html Normal file
View File

@ -0,0 +1,17 @@
<!DOCTYPE html>
<html>
<head>
<script type="text/javascript">
function boom()
{
document.getElementById("x").appendChild(document.getElementsByTagName("map")[0]);
document.getElementsByTagName("area")[0].appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", 'span'));
document.body.appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", 'td'));
}
</script>
</head>
<body onload="setTimeout(boom, 30);"><img src="data:image/gif,GIF87a%02%00%02%00%B3%00%00%00%00%00%FF%FF%FF%00%00%00%00%00%00%FF%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%2C%00%00%00%00%02%00%02%00%00%04%03%90H%12%00%3B" usemap="#Map"><map name="Map"><area></map><span id="x"></span></body>
</html>

1
layout/base/crashtests/crashtests.list
View File

@ -302,5 +302,6 @@ load 560441-1.xhtml
load 560447-1.html
load 564063-1.html
load 567292-1.xhtml
load 569018-1.html
load 572003.xul
load 572582-1.xhtml

21
layout/base/nsCSSFrameConstructor.cpp
View File

@ -5514,6 +5514,13 @@ nsCSSFrameConstructor::GetFrameFor(nsIContent* aContent)
if (!frame)
return nsnull;
// If the content of the frame is not the desired content then this is not
// really a frame for the desired content.
// XXX This check is needed due to bug 135040. Remove it once that's fixed.
if (frame->GetContent() != aContent) {
return nsnull;
}
nsIFrame* insertionFrame = frame->GetContentInsertionFrame();
NS_ASSERTION(insertionFrame == frame || !frame->IsLeaf(),
@ -6256,11 +6263,6 @@ nsCSSFrameConstructor::MaybeConstructLazily(Operation aOperation,
// Walk up the tree setting the NODE_DESCENDANTS_NEED_FRAMES bit as we go.
nsIContent* content = aContainer;
#ifdef DEBUG
// We have to jump through hoops so that we can make some reasonable asserts
// due to bug 135040. We detect if we find a bogus primary frame (I'm looking
// at you, areas), and relax our assertions for the remaining ancestors.
PRBool bogusPrimaryFrame = PR_FALSE;
// If we hit a node with no primary frame, or the NODE_NEEDS_FRAME bit set
// we want to assert, but leaf frames that process their own children and may
// ignore anonymous children (eg framesets) make this complicated. So we set
@ -6275,15 +6277,10 @@ nsCSSFrameConstructor::MaybeConstructLazily(Operation aOperation,
if (content->GetPrimaryFrame() && content->GetPrimaryFrame()->IsLeaf()) {
noPrimaryFrame = needsFrameBitSet = PR_FALSE;
}
if (!bogusPrimaryFrame && content->GetPrimaryFrame() &&
content->GetPrimaryFrame()->GetContent() != content) {
bogusPrimaryFrame = PR_TRUE;
}
if (!noPrimaryFrame && !content->GetPrimaryFrame() && !bogusPrimaryFrame) {
if (!noPrimaryFrame && !content->GetPrimaryFrame()) {
noPrimaryFrame = PR_TRUE;
}
if (!needsFrameBitSet && content->HasFlag(NODE_NEEDS_FRAME) &&
!bogusPrimaryFrame) {
if (!needsFrameBitSet && content->HasFlag(NODE_NEEDS_FRAME)) {
needsFrameBitSet = PR_TRUE;
}
#endif