Bug 854082 - Restore SetFrame(null) call to avoid instance owners pointing to dead frames. r=bsmedberg
authorJohn Schoenick <jschoenick@mozilla.com>
Wed, 17 Apr 2013 14:13:09 -0700
changeset 129677 2db093c411a51fdc08342b10bb4804c9cc550e06
parent 129676 8f1599c9c715511d198e45bdc8272fbf5f823716
child 129678 9844a2fe0f46a62da9c5476725a763e354ab8d93
push id24586
push userryanvm@gmail.com
push dateWed, 24 Apr 2013 12:15:57 +0000
treeherdermozilla-central@1c5977e8d52f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbsmedberg
bugs854082
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 854082 - Restore SetFrame(null) call to avoid instance owners pointing to dead frames. r=bsmedberg
layout/generic/nsObjectFrame.cpp
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -303,16 +303,20 @@ nsObjectFrame::DestroyFrom(nsIFrame* aDe
 {
   if (mReflowCallbackPosted) {
     PresContext()->PresShell()->CancelReflowCallback(this);
   }
 
   // Tell content owner of the instance to disconnect its frame.
   nsCOMPtr<nsIObjectLoadingContent> objContent(do_QueryInterface(mContent));
   NS_ASSERTION(objContent, "Why not an object loading content?");
+
+  if (mInstanceOwner) {
+    mInstanceOwner->SetFrame(nullptr);
+  }
   objContent->HasNewFrame(nullptr);
 
   if (mBackgroundSink) {
     mBackgroundSink->Destroy();
   }
 
   SetInstanceOwner(nullptr);