Bug 682684: handle frames being deleted when running EditorInitializer when under scriptblocker r=roc
authorRandell Jesup <rjesup@wgate.com>
Mon, 19 Sep 2011 23:14:47 -0400
changeset 77179 c0f7ee4b3358dc4b51ef2f3f01867098fa784cac
parent 77178 575dcce289787d64b6ee6803b538d62210a38ce2
child 77180 ceafc572c5ad64d7cdf7fc6567cfddb3b13e687e
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersroc
bugs682684
milestone9.0a1
Bug 682684: handle frames being deleted when running EditorInitializer when under scriptblocker r=roc
layout/forms/nsTextControlFrame.cpp
layout/forms/nsTextControlFrame.h
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -380,17 +380,19 @@ nsTextControlFrame::EnsureEditorInitiali
   nsresult rv = txtCtrl->CreateEditor();
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Turn on mUseEditor so that subsequent calls will use the
   // editor.
   mUseEditor = PR_TRUE;
 
   // Set the selection to the beginning of the text field.
-  SetSelectionEndPoints(0, 0);
+  if (weakFrame.IsAlive()) {
+    SetSelectionEndPoints(0, 0);
+  }
 
   return NS_OK;
 }
 
 nsresult
 nsTextControlFrame::CreateAnonymousContent(nsTArray<ContentInfo>& aElements)
 {
   NS_ASSERTION(mContent, "We should have a content!");
--- a/layout/forms/nsTextControlFrame.h
+++ b/layout/forms/nsTextControlFrame.h
@@ -302,21 +302,25 @@ protected:
       if (mFrame) {
         // need to block script to avoid bug 669767
         nsAutoScriptBlocker scriptBlocker;
 
         nsCOMPtr<nsIPresShell> shell =
           mFrame->PresContext()->GetPresShell();
         PRBool observes = shell->ObservesNativeAnonMutationsForPrint();
         shell->ObserveNativeAnonMutationsForPrint(PR_TRUE);
-        // This can cause the frame to be destroyed (and call Revoke()
+        // This can cause the frame to be destroyed (and call Revoke())
         mFrame->EnsureEditorInitialized();
         shell->ObserveNativeAnonMutationsForPrint(observes);
 
-        NS_ASSERTION(mFrame,"Frame destroyed even though we had a scriptblocker");
+        // The frame can *still* be destroyed even though we have a scriptblocker
+        // Bug 682684
+        if (!mFrame)
+          return NS_ERROR_FAILURE;
+
         mFrame->FinishedInitializer();
       }
       return NS_OK;
     }
 
     // avoids use of nsWeakFrame
     void Revoke() {
       mFrame = nsnull;