Backed out changeset 8589d9bdd501 (bug 1040735) for B2G gaia-ui-test crashes
authorEd Morley <emorley@mozilla.com>
Fri, 15 Aug 2014 16:03:03 +0100
changeset 199714 5de91aef0d9cc7aa021961fb5bbfcfe591757aa3
parent 199713 a3acc5b4345af3bc4dd99c9e14fd349fa78eac11
child 199715 c3ab83f45b5d23e424001d4bc1717297c6367171
push id47721
push useremorley@mozilla.com
push dateFri, 15 Aug 2014 15:03:23 +0000
treeherdermozilla-inbound@5de91aef0d9c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1040735
milestone34.0a1
backs out8589d9bdd50156d71a3566153459236c16c102ed
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset 8589d9bdd501 (bug 1040735) for B2G gaia-ui-test crashes
accessible/base/nsAccessibilityService.cpp
accessible/base/nsAccessibilityService.h
accessible/generic/Accessible.cpp
accessible/tests/mochitest/treeupdate/a11y.ini
accessible/tests/mochitest/treeupdate/test_bug1040735.html
layout/base/RestyleManager.cpp
layout/base/nsCSSFrameConstructor.cpp
layout/xul/nsListBoxBodyFrame.cpp
--- a/accessible/base/nsAccessibilityService.cpp
+++ b/accessible/base/nsAccessibilityService.cpp
@@ -386,32 +386,32 @@ nsAccessibilityService::ContentRangeInse
 
   DocAccessible* docAccessible = GetDocAccessible(aPresShell);
   if (docAccessible)
     docAccessible->ContentInserted(aContainer, aStartChild, aEndChild);
 }
 
 void
 nsAccessibilityService::ContentRemoved(nsIPresShell* aPresShell,
+                                       nsIContent* aContainer,
                                        nsIContent* aChild)
 {
-  nsIContent* container = aChild->GetFlattenedTreeParent();
 #ifdef A11Y_LOG
   if (logging::IsEnabled(logging::eTree)) {
     logging::MsgBegin("TREE", "content removed");
-    logging::Node("container", container);
+    logging::Node("container", aContainer);
     logging::Node("content", aChild);
     logging::MsgEnd();
     logging::Stack();
   }
 #endif
 
   DocAccessible* docAccessible = GetDocAccessible(aPresShell);
   if (docAccessible)
-    docAccessible->ContentRemoved(container, aChild);
+    docAccessible->ContentRemoved(aContainer, aChild);
 }
 
 void
 nsAccessibilityService::UpdateText(nsIPresShell* aPresShell,
                                    nsIContent* aContent)
 {
   DocAccessible* document = GetDocAccessible(aPresShell);
   if (document)
--- a/accessible/base/nsAccessibilityService.h
+++ b/accessible/base/nsAccessibilityService.h
@@ -85,17 +85,18 @@ public:
    * inserted.
    */
   void ContentRangeInserted(nsIPresShell* aPresShell, nsIContent* aContainer,
                             nsIContent* aStartChild, nsIContent* aEndChild);
 
   /**
    * Notification used to update the accessible tree when content is removed.
    */
-  void ContentRemoved(nsIPresShell* aPresShell, nsIContent* aChild);
+  void ContentRemoved(nsIPresShell* aPresShell, nsIContent* aContainer,
+                      nsIContent* aChild);
 
   virtual void UpdateText(nsIPresShell* aPresShell, nsIContent* aContent);
 
   /**
    * Update XUL:tree accessible tree when treeview is changed.
    */
   void TreeViewChanged(nsIPresShell* aPresShell, nsIContent* aContent,
                        nsITreeView* aView);
--- a/accessible/generic/Accessible.cpp
+++ b/accessible/generic/Accessible.cpp
@@ -2533,16 +2533,17 @@ void
 Accessible::BindToParent(Accessible* aParent, uint32_t aIndexInParent)
 {
   NS_PRECONDITION(aParent, "This method isn't used to set null parent!");
 
   if (mParent) {
     if (mParent != aParent) {
       NS_ERROR("Adopting child!");
       mParent->RemoveChild(this);
+      mParent->InvalidateChildrenGroupInfo();
     } else {
       NS_ERROR("Binding to the same parent!");
       return;
     }
   }
 
   mParent = aParent;
   mIndexInParent = aIndexInParent;
--- a/accessible/tests/mochitest/treeupdate/a11y.ini
+++ b/accessible/tests/mochitest/treeupdate/a11y.ini
@@ -1,16 +1,15 @@
 [DEFAULT]
 
 [test_ariadialog.html]
 [test_bug852150.xhtml]
 [test_bug883708.xhtml]
 [test_bug884251.xhtml]
 [test_bug895082.html]
-[test_bug1040735.html]
 [test_canvas.html]
 [test_colorpicker.xul]
 [test_contextmenu.xul]
 [test_cssoverflow.html]
 [test_deck.xul]
 [test_doc.html]
 [test_gencontent.html]
 [test_hidden.html]
deleted file mode 100644
--- a/accessible/tests/mochitest/treeupdate/test_bug1040735.html
+++ /dev/null
@@ -1,43 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>Adopt DOM node from anonymous subtree</title>
-
-  <link rel="stylesheet" type="text/css"
-        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
-
-  <script type="application/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript"
-          src="../common.js"></script>
-
-  <script type="application/javascript">
-    SimpleTest.expectAssertions(0, 1);
-    function doTest()
-    {
-      document.body.appendChild(document.getElementById("mw_a"));
-      setTimeout(function() { ok(true, "no crash and assertions"); SimpleTest.finish(); } , 0);
-    }
-
-    SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
-  </script>
-</head>
-
-<body>
-  <a target="_blank"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=1040735"
-     title="Bug 1040735 - DOM node reinsertion under anonymous content may trigger a11y child adoption">
-    Bug 1040735</a>
-  <p id="display"></p>
-  <div id="content" style="display: none"></div>
-  <pre id="test">
-  </pre>
-
-  <marquee>
-    <div id="mw_a" style="visibility: hidden;">
-      <div style="visibility: visible;" id="mw_inside"></div>
-    </div>
-  </marquee>
-</body>
-</html>
--- a/layout/base/RestyleManager.cpp
+++ b/layout/base/RestyleManager.cpp
@@ -3036,17 +3036,17 @@ ElementRestyler::SendAccessibilityNotifi
                                        content,
                                        content->GetNextSibling());
     }
   } else if (mOurA11yNotification == eNotifyHidden) {
     nsAccessibilityService* accService = nsIPresShell::AccService();
     if (accService) {
       nsIPresShell* presShell = mFrame->PresContext()->GetPresShell();
       nsIContent* content = mFrame->GetContent();
-      accService->ContentRemoved(presShell, content);
+      accService->ContentRemoved(presShell, content->GetParent(), content);
 
       // Process children staying shown.
       uint32_t visibleContentCount = mVisibleKidsOfHiddenElement.Length();
       for (uint32_t idx = 0; idx < visibleContentCount; idx++) {
         nsIContent* childContent = mVisibleKidsOfHiddenElement[idx];
         accService->ContentRangeInserted(presShell, childContent->GetParent(),
                                          childContent,
                                          childContent->GetNextSibling());
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7782,17 +7782,17 @@ nsCSSFrameConstructor::ContentRemoved(ns
       nsresult rv = RecreateFramesForContent(grandparentFrame->GetContent(), true);
       LAYOUT_PHASE_TEMP_REENTER();
       return rv;
     }
 
 #ifdef ACCESSIBILITY
     nsAccessibilityService* accService = nsIPresShell::AccService();
     if (accService) {
-      accService->ContentRemoved(mPresShell, aChild);
+      accService->ContentRemoved(mPresShell, aContainer, aChild);
     }
 #endif
 
     // Examine the containing-block for the removed content and see if
     // :first-letter style applies.
     nsIFrame* inflowChild = childFrame;
     if (childFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW) {
       inflowChild = GetPlaceholderFrameFor(childFrame);
--- a/layout/xul/nsListBoxBodyFrame.cpp
+++ b/layout/xul/nsListBoxBodyFrame.cpp
@@ -1465,17 +1465,18 @@ nsListBoxBodyFrame::RemoveChildFrame(nsB
 {
   MOZ_ASSERT(mFrames.ContainsFrame(aFrame));
   MOZ_ASSERT(aFrame != GetContentInsertionFrame());
 
 #ifdef ACCESSIBILITY
   nsAccessibilityService* accService = nsIPresShell::AccService();
   if (accService) {
     nsIContent* content = aFrame->GetContent();
-    accService->ContentRemoved(PresContext()->PresShell(), content);
+    accService->ContentRemoved(PresContext()->PresShell(), content->GetParent(),
+                               content);
   }
 #endif
 
   mFrames.RemoveFrame(aFrame);
   if (mLayoutManager)
     mLayoutManager->ChildrenRemoved(this, aState, aFrame);
   aFrame->Destroy();
 }