Bug 472776. Don't accidentally clear TEXT_IN_TEXTRUN_USER_DATA after we just set it. r=smontagu

--HG--
extra : rebase_source : 1d7f12a729e471871cb6b610461f9b4eee2c64ae
This commit is contained in:
Robert O'Callahan 2009-02-24 21:27:48 +13:00
parent 19082bf736
commit b1dd1c04eb
3 changed files with 24 additions and 5 deletions

View File

@ -0,0 +1,20 @@
<!DOCTYPE html>
<html>
<head>
<script type="text/javascript">
function boom()
{
var v = document.getElementById("v");
v.childNodes[1].firstChild.data = "";
document.documentElement.offsetHeight;
v.appendChild(document.createTextNode("D"));
v.removeChild(v.firstChild);
}
</script>
</head>
<body onload="boom();">
<div id="v"><span>A</span><span>&#x06CC;C</span></div>
</body>
</html>

View File

@ -193,5 +193,6 @@ load 463741-1.html
load 465651-1.html
load 467487-1.html
load 468207-1.html
load 472776-1.html
load 472950-1.html
load 477928.html

View File

@ -1596,11 +1596,6 @@ BuildTextRunsScanner::BuildTextRunForFrames(void* aTextBuffer)
TextRunMappedFlow* newFlow = &userData->mMappedFlows[i];
newFlow->mStartFrame = mappedFlow->mStartFrame;
if (!mSkipIncompleteTextRuns) {
// If mSkipIncompleteTextRuns is set, then we're just going to
// throw away the userData.
newFlow->mStartFrame->AddStateBits(TEXT_IN_TEXTRUN_USER_DATA);
}
newFlow->mDOMOffsetToBeforeTransformOffset = builder.GetCharCount() -
mappedFlow->mStartFrame->GetContentOffset();
newFlow->mContentLength = contentLength;
@ -1950,6 +1945,9 @@ BuildTextRunsScanner::AssignTextRun(gfxTextRun* aTextRun)
f->ClearTextRun();
f->SetTextRun(aTextRun);
}
// Set this bit now; we can't set it any earlier because
// f->ClearTextRun() might clear it out.
startFrame->AddStateBits(TEXT_IN_TEXTRUN_USER_DATA);
// BuildTextRunForFrames mashes together mapped flows for the same element,
// so we do that here too.
lastContent = startFrame->GetContent();