Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-03 18:47:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

bug 315752: Crashes and assertions happening in DoDeletingFrameSubtree when <select>s are in the air. The fix is to make DoCleanupFrameReferences clean up additional child lists. Patch by bzbarsky. r=roc/mats/mrbkap sr=roc

Browse Source
This commit is contained in:
mrbkap%gmail.com 2005-12-20 02:06:14 +00:00
parent 90ce75f82a
commit 4bad6f49dc
2 changed files with 15 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
layout/base/nsCSSFrameConstructor.cpp
View File

@ -654,7 +654,8 @@ MarkIBSpecialPrevSibling(nsPresContext* aPresContext,
// Helper function that recursively removes content to frame mappings and
// undisplayed content mappings.
// This differs from DeletingFrameSubtree() because the frames have not yet been
// added to the frame hierarchy
// added to the frame hierarchy.
// XXXbz it would really help if we merged the two methods somehow... :(
static void
DoCleanupFrameReferences(nsPresContext* aPresContext,
nsFrameManager* aFrameManager,
@ -670,7 +671,7 @@ DoCleanupFrameReferences(nsPresContext* aPresContext,
// And don't forget to unregister the placeholder mapping. Note that this
// means it's the caller's responsibility to actually destroy the
// out-of-flow pointed to placeholder, since after this point the
// out-of-flow pointed to by the placeholder, since after this point the
// out-of-flow is not reachable via the placeholder.
aFrameManager->UnregisterPlaceholderFrame(placeholder);
}
@ -681,14 +682,19 @@ DoCleanupFrameReferences(nsPresContext* aPresContext,
aFrameManager->ClearAllUndisplayedContentIn(content);
// Recursively walk the child frames.
// Note: we only need to look at the principal child list
nsIFrame* childFrame = aFrameIn->GetFirstChild(nsnull);
while (childFrame) {
DoCleanupFrameReferences(aPresContext, aFrameManager, childFrame);
nsIAtom* childListName = nsnull;
PRInt32 childListIndex = 0;
do {
nsIFrame* childFrame = aFrameIn->GetFirstChild(childListName);
while (childFrame) {
DoCleanupFrameReferences(aPresContext, aFrameManager, childFrame);
// Get the next sibling child frame
childFrame = childFrame->GetNextSibling();
}
// Get the next sibling child frame
childFrame = childFrame->GetNextSibling();
}
childListName = aFrameIn->GetAdditionalChildListName(childListIndex++);
} while (childListName);
}
// Helper function that walks a frame list and calls DoCleanupFrameReference()

4
layout/forms/nsComboboxControlFrame.cpp
View File

@ -2058,11 +2058,7 @@ nsComboboxControlFrame::Destroy(nsPresContext* aPresContext)
}
}
nsCSSFrameConstructor* fc = aPresContext->PresShell()->FrameConstructor();
// Cleanup frames in popup child list
for (nsIFrame* child = mPopupFrames.FirstChild(); child; child = child->GetNextSibling()) {
fc->RemoveMappingsForFrameSubtree(child);
}
mPopupFrames.DestroyFrames(aPresContext);
return nsAreaFrame::Destroy(aPresContext);