Bug 1439036: Stop passing bogus next sibling values into restyling / frame construction. r?bz draft
authorEmilio Cobos Álvarez <emilio@crisal.io>
Sat, 17 Feb 2018 01:25:05 +0100
changeset 756598 c0d55e060c882ba42eb5340b4f51b564747ae803
parent 756597 986f5e9b424c0e481a4aaf5b08b24e73fbe1831e
child 756599 827806297cfad239ca8ece432724d9099e5a5bdd
push id99496
push userbmo:emilio@crisal.io
push dateSat, 17 Feb 2018 00:48:38 +0000
reviewersbz
bugs1439036
milestone60.0a1
Bug 1439036: Stop passing bogus next sibling values into restyling / frame construction. r?bz I think this is a regression from https://hg.mozilla.org/mozilla-central/rev/4a8294c6b8e33ba08ef767bede8deeb28234b5b8. Before that, the only caller with NAC used to pass -1 as an index, which means we didn't get a node back. MozReview-Commit-ID: 7HYPaa2V3OB
layout/base/PresShell.cpp
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -4480,17 +4480,17 @@ PresShell::ContentInserted(nsIDocument* 
       aChild,
       nullptr,
       nsCSSFrameConstructor::InsertionKind::Async);
 
   VERIFY_STYLE_TREE;
 }
 
 void
-PresShell::ContentRemoved(nsIDocument *aDocument,
+PresShell::ContentRemoved(nsIDocument* aDocument,
                           nsIContent* aMaybeContainer,
                           nsIContent* aChild,
                           nsIContent* aPreviousSibling)
 {
   NS_PRECONDITION(!mIsDocumentGone, "Unexpected ContentRemoved");
   NS_PRECONDITION(aDocument == mDocument, "Unexpected aDocument");
   nsINode* container = RealContainer(aDocument, aMaybeContainer, aChild);
 
@@ -4506,18 +4506,24 @@ PresShell::ContentRemoved(nsIDocument *a
     ->ContentRemoved(aDocument, aMaybeContainer, aChild);
 
   nsAutoCauseReflowNotifier crNotifier(this);
 
   // Call this here so it only happens for real content mutations and
   // not cases when the frame constructor calls its own methods to force
   // frame reconstruction.
   nsIContent* oldNextSibling = nullptr;
-  oldNextSibling = aPreviousSibling ?
-    aPreviousSibling->GetNextSibling() : container->GetFirstChild();
+
+  // Editor calls into here with NAC via HTMLEditor::DeleteRefToAnonymousNode.
+  // This could be asserted if that caller is fixed.
+  if (MOZ_LIKELY(!aChild->IsRootOfAnonymousSubtree())) {
+    oldNextSibling = aPreviousSibling
+      ? aPreviousSibling->GetNextSibling()
+      : container->GetFirstChild();
+  }
 
   mPresContext->RestyleManager()->ContentRemoved(container, aChild, oldNextSibling);
 
   // After removing aChild from tree we should save information about live ancestor
   if (mPointerEventTarget &&
       nsContentUtils::ContentIsDescendantOf(mPointerEventTarget, aChild)) {
     mPointerEventTarget = aMaybeContainer;
   }