fix for #21417

r=troy, a=chofmann
the editor's internal mDisplayFrame was not being removed from the frame manager's map of content->frames, so after enough scrolling in the addressing pane, reflow would try to reference a deleted frame. Fix is to remove the frame from the frame manager every time it's destroyed.

content/shared/public/nsLayoutAtomList.h

@@ -60,6 +60,7 @@ LAYOUT_ATOM(xmlnsNameSpace, "xmlns")
 LAYOUT_ATOM(absoluteList, "Absolute-list")
 LAYOUT_ATOM(bulletList, "Bullet-list")
 LAYOUT_ATOM(colGroupList, "ColGroup-list")
+LAYOUT_ATOM(editorDisplayList, "EditorDisplay-List")
 LAYOUT_ATOM(fixedList, "Fixed-list")
 LAYOUT_ATOM(floaterList, "Floater-list")
 LAYOUT_ATOM(popupList, "Popup-list")

layout/base/nsCSSFrameConstructor.cpp

@@ -75,6 +75,9 @@
 
 #include "nsInlineFrame.h"
 #include "nsBlockFrame.h"
+
+#include "nsGfxTextControlFrame.h"
+
 #undef NOISY_FIRST_LETTER
 
 #ifdef MOZ_MATHML
@@ -2874,6 +2877,8 @@ nsCSSFrameConstructor::ConstructTextControlFrame(nsIPresShell*        aPresShell
     if (NS_FAILED(rv)) {
       aNewFrame = nsnull;
     }
+    if (aNewFrame)
+      ((nsGfxTextControlFrame*)aNewFrame)->SetFrameConstructor(this);
   }
   if (!aNewFrame)
   {

layout/base/nsLayoutAtomList.h

@@ -60,6 +60,7 @@ LAYOUT_ATOM(xmlnsNameSpace, "xmlns")
 LAYOUT_ATOM(absoluteList, "Absolute-list")
 LAYOUT_ATOM(bulletList, "Bullet-list")
 LAYOUT_ATOM(colGroupList, "ColGroup-list")
+LAYOUT_ATOM(editorDisplayList, "EditorDisplay-List")
 LAYOUT_ATOM(fixedList, "Fixed-list")
 LAYOUT_ATOM(floaterList, "Floater-list")
 LAYOUT_ATOM(popupList, "Popup-list")

layout/base/public/nsLayoutAtomList.h

@@ -60,6 +60,7 @@ LAYOUT_ATOM(xmlnsNameSpace, "xmlns")
 LAYOUT_ATOM(absoluteList, "Absolute-list")
 LAYOUT_ATOM(bulletList, "Bullet-list")
 LAYOUT_ATOM(colGroupList, "ColGroup-list")
+LAYOUT_ATOM(editorDisplayList, "EditorDisplay-List")
 LAYOUT_ATOM(fixedList, "Fixed-list")
 LAYOUT_ATOM(floaterList, "Floater-list")
 LAYOUT_ATOM(popupList, "Popup-list")

layout/html/forms/src/nsGfxTextControlFrame.cpp

@@ -89,6 +89,7 @@
 #include "nsIControllers.h"
 #include "nsIDOMNSHTMLTextAreaElement.h"
 #include "nsIDOMNSHTMLInputElement.h"
+#include "nsLayoutAtoms.h"
 
 
 static NS_DEFINE_IID(kIFormControlIID, NS_IFORMCONTROL_IID);
@@ -226,6 +227,7 @@ nsGfxTextControlFrame::nsGfxTextControlFrame()
   mFramePresContext(nsnull),
   mCachedState(nsnull),
   mWeakReferent(this),
+  mFrameConstructor(nsnull),
   mDisplayFrame(nsnull),
   mDidSetFocus(PR_FALSE)
 
@@ -236,6 +238,8 @@ nsGfxTextControlFrame::~nsGfxTextControlFrame()
 {
   nsresult result;
   if (mDisplayFrame) {
+    mFrameConstructor->RemoveMappingsForFrameSubtree(mFramePresContext,
+                                                     mDisplayFrame, nsnull);
     mDisplayFrame->Destroy(mFramePresContext);
   }
   if (mTempObserver)
@@ -1799,6 +1803,7 @@ nsGfxTextControlFrame::Reflow(nsIPresContext* aPresContext,
 
           // create the pseudo frame for the anonymous content
           if (mDisplayFrame) {
+            mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, mDisplayFrame, nsnull);
             rv = mDisplayFrame->Destroy(aPresContext);
             if (NS_FAILED(rv)) return rv;
           }
@@ -1856,6 +1861,7 @@ nsGfxTextControlFrame::Reflow(nsIPresContext* aPresContext,
     {
       if (mDisplayFrame) 
       {
+        mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, mDisplayFrame, nsnull);
         mDisplayFrame->Destroy(mFramePresContext);
         mDisplayFrame = nsnull;
       }
@@ -2521,6 +2527,40 @@ void nsGfxTextControlFrame::RemoveNewlines(nsString &aString)
   aString.StripChars(badChars);
 }
 
+NS_IMETHODIMP
+nsGfxTextControlFrame::GetAdditionalChildListName(PRInt32 aIndex,
+                                                  nsIAtom **aListName) const
+{
+  if (aIndex == 0) {
+    *aListName = nsLayoutAtoms::editorDisplayList;
+    NS_IF_ADDREF(*aListName);
+  }
+
+  return nsTextControlFrame::GetAdditionalChildListName(aIndex, aListName);
+}
+
+NS_IMETHODIMP
+nsGfxTextControlFrame::FirstChild(nsIAtom* aListName, nsIFrame** aFirstChild) const
+{
+  if (nsLayoutAtoms::editorDisplayList) {
+    *aFirstChild = mDisplayFrame;
+    return NS_OK;
+  }
+  
+  return nsTextControlFrame::FirstChild(aListName, aFirstChild);
+}
+
+NS_IMETHODIMP
+nsGfxTextControlFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (mDisplayFrame) {
+    mFrameConstructor->RemoveMappingsForFrameSubtree(aPresContext, mDisplayFrame, nsnull);
+    mDisplayFrame->Destroy(aPresContext);
+    mDisplayFrame=nsnull;
+  }
+  return nsTextControlFrame::Destroy(aPresContext);
+}
+
 #ifdef NS_DEBUG
 NS_IMETHODIMP
 nsGfxTextControlFrame::List(nsIPresContext* aPresContext, FILE* out, PRInt32 aIndent) const

layout/html/forms/src/nsGfxTextControlFrame.h

@@ -44,6 +44,8 @@
 #include "nsHTMLValue.h"
 #include "nsIWebShell.h"
 
+#include "nsCSSFrameConstructor.h"
+
 class nsIFrame;
 class nsIDOMSelection;
 
@@ -546,8 +548,16 @@ protected:
                           nsIFrame*            aFrame,
                           nsFramePaintLayer    aWhichLayer);
 
+  NS_IMETHOD FirstChild(nsIAtom *aListName, nsIFrame **aFirstChild) const;
+  
+  NS_IMETHOD GetAdditionalChildListName(PRInt32 aIndex,
+                                        nsIAtom** aListName) const;
+  NS_IMETHOD Destroy(nsIPresContext *aPresContext);
+
 public:
   void SetShouldSetFocus() { mDidSetFocus = PR_FALSE; };
+  void SetFrameConstructor(nsCSSFrameConstructor *aConstructor)
+    { mFrameConstructor = aConstructor; } // not owner - do not addref!
 
 protected:
   nsCOMPtr<nsIWebShell> mWebShell;
@@ -567,6 +577,7 @@ protected:
   nsCOMPtr<nsIEnderEventListener> mEventListener;  // ref counted
   nsEnderFocusListenerForContent *mFocusListenerForContent; // ref counted
 
+  nsCSSFrameConstructor *mFrameConstructor;
   nsIFrame *mDisplayFrame;
   nsCOMPtr<nsITextContent> mDisplayContent;
  

layout/html/style/src/Makefile.in

@@ -89,6 +89,7 @@ INCLUDES	+= \
 		-I$(srcdir)/../../base/src \
 		-I$(srcdir)/../../../base/src \
 		-I$(srcdir)/../../table/src \
+		-I$(srcdir)/../../forms/src \
 		-I$(srcdir)/../../content/src \
 		-I$(srcdir)/../../../xul/content/src \
 		-I$(srcdir)/. \

layout/html/style/src/makefile.win

@@ -102,6 +102,7 @@ LINCS=-I$(PUBLIC)\xpcom -I$(PUBLIC)\raptor -I$(PUBLIC)\netlib \
   -I..\..\..\mathml\content\src \
   -I..\..\..\mathml\base\src \
 !endif
+  -I..\..\forms\src \
   -I..\..\base\src -I..\..\table\src -I..\..\content\src -I$(PUBLIC)\js -I$(PUBLIC)\dom
 
 LCFLAGS = \

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -75,6 +75,9 @@
 
 #include "nsInlineFrame.h"
 #include "nsBlockFrame.h"
+
+#include "nsGfxTextControlFrame.h"
+
 #undef NOISY_FIRST_LETTER
 
 #ifdef MOZ_MATHML
@@ -2874,6 +2877,8 @@ nsCSSFrameConstructor::ConstructTextControlFrame(nsIPresShell*        aPresShell
     if (NS_FAILED(rv)) {
       aNewFrame = nsnull;
     }
+    if (aNewFrame)
+      ((nsGfxTextControlFrame*)aNewFrame)->SetFrameConstructor(this);
   }
   if (!aNewFrame)
   {