Bug 815315 - Avoid crashing if the last row-group child frame was removed. r=bz
authorMats Palmgren <matspal@gmail.com>
Sat, 01 Dec 2012 01:10:40 +0100
changeset 114674 6e5da7fd674016db774bb3b62eb6498ec44041e7
parent 114673 88ee3b68083512476e7013fefb87ddc6d0258a0d
child 114675 aabc7c735fb0a706ecd745ca41ebb447fab1b8dd
push id23926
push userryanvm@gmail.com
push dateSat, 01 Dec 2012 15:27:30 +0000
treeherdermozilla-central@ecdf0e332f17 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs815315
milestone20.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 815315 - Avoid crashing if the last row-group child frame was removed. r=bz
layout/tables/nsCellMap.cpp
--- a/layout/tables/nsCellMap.cpp
+++ b/layout/tables/nsCellMap.cpp
@@ -274,16 +274,20 @@ nsTableCellMap::Synchronize(nsTableFrame
       if (!maps.AppendElement(map)) {
         delete map;
         map = nullptr;
         NS_WARNING("Could not AppendElement");
         break;
       }
     }
   }
+  if (maps.IsEmpty()) {
+    MOZ_ASSERT(!mFirstMap);
+    return;
+  }
 
   int32_t mapIndex = maps.Length() - 1;  // Might end up -1
   nsCellMap* nextMap = maps.ElementAt(mapIndex);
   nextMap->SetNextSibling(nullptr);
   for (mapIndex-- ; mapIndex >= 0; mapIndex--) {
     nsCellMap* map = maps.ElementAt(mapIndex);
     map->SetNextSibling(nextMap);
     nextMap = map;