Bug 506844. Remove kids in order, not in reverse order, when clearing textContent and innerHTML. r=sicking
authorBoris Zbarsky <bzbarsky@mit.edu>
Wed, 03 Aug 2011 14:32:32 -0400
changeset 73769 a430f8b1921ed584de62f2407414434ae5153dab
parent 73768 bb97ea5737a4a950ff2574745c8bd521e8516790
child 73770 ad8831aa105f452e28be52979312b4ce5318ef78
push id945
push userbzbarsky@mozilla.com
push dateWed, 03 Aug 2011 18:34:19 +0000
treeherdermozilla-inbound@ad8831aa105f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssicking
bugs506844
milestone8.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 506844. Remove kids in order, not in reverse order, when clearing textContent and innerHTML. r=sicking
content/base/src/nsContentUtils.cpp
content/html/content/src/nsGenericHTMLElement.cpp
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -3871,17 +3871,16 @@ nsContentUtils::SetNodeTextContent(nsICo
   mozAutoDocUpdate updateBatch(aContent->GetCurrentDoc(),
     UPDATE_CONTENT_MODEL, PR_TRUE);
 
   PRUint32 childCount = aContent->GetChildCount();
 
   if (aTryReuse && !aValue.IsEmpty()) {
     PRUint32 removeIndex = 0;
 
-    // i is unsigned, so i >= is always true
     for (PRUint32 i = 0; i < childCount; ++i) {
       nsIContent* child = aContent->GetChildAt(removeIndex);
       if (removeIndex == 0 && child && child->IsNodeOfType(nsINode::eTEXT)) {
         nsresult rv = child->SetText(aValue, PR_TRUE);
         NS_ENSURE_SUCCESS(rv, rv);
 
         removeIndex = 1;
       }
@@ -3890,19 +3889,18 @@ nsContentUtils::SetNodeTextContent(nsICo
       }
     }
 
     if (removeIndex == 1) {
       return NS_OK;
     }
   }
   else {
-    // i is unsigned, so i >= is always true
-    for (PRUint32 i = childCount; i-- != 0; ) {
-      aContent->RemoveChildAt(i, PR_TRUE);
+    for (PRUint32 i = 0; i < childCount; ++i) {
+      aContent->RemoveChildAt(0, PR_TRUE);
     }
   }
 
   if (aValue.IsEmpty()) {
     return NS_OK;
   }
 
   nsCOMPtr<nsIContent> textContent;
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -753,19 +753,19 @@ nsGenericHTMLElement::SetInnerHTML(const
   mozAutoSubtreeModified subtree(doc, nsnull);
 
   FireNodeRemovedForChildren();
 
   // Needed when innerHTML is used in combination with contenteditable
   mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, PR_TRUE);
 
   // Remove childnodes.
-  // i is unsigned, so i >= is always true
-  for (PRUint32 i = GetChildCount(); i-- != 0; ) {
-    RemoveChildAt(i, PR_TRUE);
+  PRUint32 childCount = GetChildCount();
+  for (PRUint32 i = 0; i < childCount; ++i) {
+    RemoveChildAt(0, PR_TRUE);
   }
 
   nsCOMPtr<nsIDOMDocumentFragment> df;
 
   if (doc->IsHTML()) {
     PRInt32 oldChildCount = GetChildCount();
     nsContentUtils::ParseFragmentHTML(aInnerHTML,
                                       this,