Bug 680922. Don't try to remove anonymous elements from the name map. r=sicking
authorBoris Zbarsky <bzbarsky@mit.edu>
Mon, 19 Sep 2011 22:59:43 -0400
changeset 77174 1cb463c1c7b78de8103d36c01d5e6ed40efee6cd
parent 77173 2dbed30dd67d46cd929a305842938a2cf95f7231
child 77175 7f35e447e8a9c0be1f9e978ec66e5e4ec048de5e
push id3
push userfelipc@gmail.com
push dateFri, 30 Sep 2011 20:09:13 +0000
reviewerssicking
bugs680922
milestone9.0a1
Bug 680922. Don't try to remove anonymous elements from the name map. r=sicking
content/base/src/nsDocument.cpp
content/html/content/crashtests/680922-1.xul
content/html/content/crashtests/680922-binding.xml
content/html/content/crashtests/crashtests.list
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -436,20 +436,19 @@ nsIdentifierMapEntry::AddNameElement(nsI
   }
 
   mNameContentList->AppendElement(aElement);
 }
 
 void
 nsIdentifierMapEntry::RemoveNameElement(Element* aElement)
 {
-  NS_ASSERTION(mNameContentList &&
-               mNameContentList->IndexOf(aElement, PR_FALSE) >= 0,
-               "Attmpting to remove named element that doesn't exist");
-  mNameContentList->RemoveElement(aElement);
+  if (mNameContentList) {
+    mNameContentList->RemoveElement(aElement);
+  }
 }
 
 // Helper structs for the content->subdoc map
 
 class SubDocMapEntry : public PLDHashEntryHdr
 {
 public:
   // Both of these are strong references
@@ -2566,17 +2565,17 @@ void
 nsDocument::RemoveFromNameTable(Element *aElement, nsIAtom* aName)
 {
   // Speed up document teardown
   if (mIdentifierMap.Count() == 0)
     return;
 
   nsIdentifierMapEntry *entry =
     mIdentifierMap.GetEntry(nsDependentAtomString(aName));
-  if (!entry) // Should never be false unless we had OOM when adding the entry
+  if (!entry) // Could be false if the element was anonymous, hence never added
     return;
 
   entry->RemoveNameElement(aElement);
 }
 
 void
 nsDocument::AddToIdTable(Element *aElement, nsIAtom* aId)
 {
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/680922-1.xul
@@ -0,0 +1,9 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<box id="e">
+<box id="b" name="e" style="-moz-binding:url(680922-binding.xml#xbl);">
+</box>
+</box>
+
+</window>
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/680922-binding.xml
@@ -0,0 +1,7 @@
+<bindings xmlns="http://www.mozilla.org/xbl" xmlns:html="http://www.w3.org/1999/xhtml">
+<binding id="xbl" inheritstyle="false">
+<content>
+<html:form id="g" observes="b"/>
+</content>
+</binding>
+</bindings>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@@ -24,10 +24,11 @@ load 604807.html
 load 605264.html
 load 606430-1.html
 load 602117.html
 load 613027.html
 load 614279.html
 load 614988-1.html
 load 620078-1.html
 load 620078-2.html
+load 680922-1.xul
 load 682058.xhtml
 load 682460.html