mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-09 11:25:00 +00:00
Prevent crash caused by trigger-happy deletion of frames during Bidi resolution. Bug 95228, r=lkemmel@il.ibm.com, sr=waterson
This commit is contained in:
parent
81bdbc110c
commit
a3b1208204
@ -832,12 +832,19 @@ nsBidiPresUtils::RemoveBidiContinuation(nsIPresContext* aPresContext,
|
||||
delete frame;
|
||||
++aOffset;
|
||||
}
|
||||
else if (parent != nsnull) {
|
||||
parent->RemoveFrame(aPresContext, *presShell, nsLayoutAtoms::nextBidi,
|
||||
frame);
|
||||
}
|
||||
else {
|
||||
frame->Destroy(aPresContext);
|
||||
nsFrameState frameState;
|
||||
frame->GetFrameState(&frameState);
|
||||
if (frameState & NS_FRAME_IS_BIDI) {
|
||||
// only delete Bidi frames
|
||||
if (parent != nsnull) {
|
||||
parent->RemoveFrame(aPresContext, *presShell,
|
||||
nsLayoutAtoms::nextBidi, frame);
|
||||
}
|
||||
else {
|
||||
frame->Destroy(aPresContext);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if (aNextFrame) {
|
||||
|
@ -832,12 +832,19 @@ nsBidiPresUtils::RemoveBidiContinuation(nsIPresContext* aPresContext,
|
||||
delete frame;
|
||||
++aOffset;
|
||||
}
|
||||
else if (parent != nsnull) {
|
||||
parent->RemoveFrame(aPresContext, *presShell, nsLayoutAtoms::nextBidi,
|
||||
frame);
|
||||
}
|
||||
else {
|
||||
frame->Destroy(aPresContext);
|
||||
nsFrameState frameState;
|
||||
frame->GetFrameState(&frameState);
|
||||
if (frameState & NS_FRAME_IS_BIDI) {
|
||||
// only delete Bidi frames
|
||||
if (parent != nsnull) {
|
||||
parent->RemoveFrame(aPresContext, *presShell,
|
||||
nsLayoutAtoms::nextBidi, frame);
|
||||
}
|
||||
else {
|
||||
frame->Destroy(aPresContext);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if (aNextFrame) {
|
||||
|
Loading…
Reference in New Issue
Block a user