Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-13 05:15:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 459666. GetReferencedFrame should bail out if we've destroyed the frame tree while reconstructing frames for the entire document. r+sr=bzbarsky

Browse Source
This commit is contained in:
Robert O'Callahan 2009-02-10 21:28:16 +13:00
parent 313514226b
commit d88d077696
4 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
layout/base/nsCSSFrameConstructor.h
View File

@ -275,6 +275,12 @@ public:
nsIFrame* GetDocElementContainingBlock()
{ return mDocElementContainingBlock; }
// Returns true if we've torn down the frame tree.
// Usually this means we've started destroying the presentation, but
// we could also have mostly torn it down in preparation for
// reconstructing frames for the entire document.
PRBool IsDestroyingFrameTree() { return mIsDestroyingFrameTree; }
private:
nsresult ReconstructDocElementHierarchyInternal();

13
layout/svg/base/src/nsSVGEffects.cpp
View File

@ -67,7 +67,8 @@ nsSVGRenderingObserver::~nsSVGRenderingObserver()
if (mElement.get()) {
mElement.get()->RemoveMutationObserver(this);
}
if (mReferencedFrame && !mReferencedFramePresShell->IsDestroying()) {
if (mReferencedFrame &&
!mReferencedFramePresShell->FrameConstructor()->IsDestroyingFrameTree()) {
nsSVGEffects::RemoveRenderingObserver(mReferencedFrame, this);
}
}
@ -75,8 +76,14 @@ nsSVGRenderingObserver::~nsSVGRenderingObserver()
nsIFrame*
nsSVGRenderingObserver::GetReferencedFrame()
{
if (mReferencedFrame && !mReferencedFramePresShell->IsDestroying()) {
if (mReferencedFrame &&
!mReferencedFramePresShell->FrameConstructor()->IsDestroyingFrameTree()) {
// We may be destroying frames in mReferencedFramePresShell, which
// means we can't call GetPrimaryFrame there. But that's OK, since
// mReferencedFrame cannot have been destroyed yet (or we would have
// lost our reference to it).
NS_ASSERTION(mElement.get() &&
!mReferencedFramePresShell->FrameManager()->IsDestroyingFrames() &&
static_cast<nsGenericElement*>(mElement.get())->GetPrimaryFrame() == mReferencedFrame,
"Cached frame is incorrect!");
return mReferencedFrame;
@ -113,7 +120,7 @@ nsSVGRenderingObserver::GetReferencedFrame(nsIAtom* aFrameType, PRBool* aOK)
void
nsSVGRenderingObserver::DoUpdate()
{
if (mFramePresShell->IsDestroying()) {
if (mFramePresShell->FrameConstructor()->IsDestroyingFrameTree()) {
// mFrame is no longer valid. Bail out.
mFrame = nsnull;
return;

7
layout/svg/crashtests/459666-1.html Normal file
View File

@ -0,0 +1,7 @@
<!DOCTYPE html>
<html style="filter: url(#e);">
<head></head>
<body onload="document.documentElement.style.counterReset = 'a';">
<div id="e"></div>
</body>
</html>

1
layout/svg/crashtests/crashtests.list
View File

@ -57,6 +57,7 @@ load 441368-1.svg
load 453754-1.svg
load 455314-1.xhtml
load 458453.html
load 459666-1.html
load 464374-1.svg
load 466585-1.svg
load 470124-1.svg