Bug 645572 - Don't let the frame constructor's update count to become negative. r=sicking a=dveditz
authorEhsan Akhgari <ehsan@mozilla.com>
Fri, 08 Apr 2011 14:29:34 -0700
changeset 27410 8f8185f5888102a4cad7172fd138f36fd4686393
parent 27409 b5e3b71282de22ab2c4c2d4041d8bd1d3f1eb21b
child 27411 ed572ce324ba73c7c9b055e0995f2c1185637ea9
push id2724
push usereakhgari@mozilla.com
push dateSat, 14 May 2011 19:28:10 +0000
reviewerssicking, dveditz
bugs645572
milestone1.9.1.20pre
Bug 645572 - Don't let the frame constructor's update count to become negative. r=sicking a=dveditz
layout/base/nsCSSFrameConstructor.cpp
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -10269,17 +10269,20 @@ nsCSSFrameConstructor::EndUpdate()
 {
   if (mUpdateCount == 1) {
     // This is the end of our last update.  Before we decrement
     // mUpdateCount, recalc quotes and counters as needed.
 
     RecalcQuotesAndCounters();
     NS_ASSERTION(mUpdateCount == 1, "Odd update count");
   }
-  --mUpdateCount;
+  // Negative update counts don't make sense
+  if (mUpdateCount > 0) {
+    --mUpdateCount;
+  }
   if (mFocusSuppressCount) {
     NS_UnsuppressFocusEvent();
     --mFocusSuppressCount;
   }
 }
 
 void
 nsCSSFrameConstructor::RecalcQuotesAndCounters()