Bug 859630 - Use the PresContext's document in FindContentInDocument when the frame doesn't have an associated nsIContent. r=roc
authorMatt Woodrow <mwoodrow@mozilla.com>
Mon, 15 Apr 2013 18:55:36 +1200
changeset 135531 c05b48c2503553226bdefda865f526784f23d88f
parent 135530 3b0cda3057dfc1a3c9a2342ad938a8a7ea6bcf32
child 135532 1077b98a75f14b7570283cc696939209e33fb949
push id3752
push userlsblakk@mozilla.com
push dateMon, 13 May 2013 17:21:10 +0000
treeherdermozilla-aurora@1580544aef0b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs859630
milestone23.0a1
Bug 859630 - Use the PresContext's document in FindContentInDocument when the frame doesn't have an associated nsIContent. r=roc
layout/base/crashtests/859630-1.html
layout/base/crashtests/crashtests.list
layout/base/nsDisplayList.cpp
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/859630-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta charset="UTF-8">
+</head><body>
+<div style="display: table-caption"><iframe></iframe></div>
+
+</body></html>
\ No newline at end of file
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -387,8 +387,9 @@ asserts-if(winWidget,0-2) load 736924-1.
 load 749816-1.html
 load 763223-1.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,100) load 763702.xhtml
 load 770381-1.html
 load 795646.html
 load 813372-1.html
 load 836990-1.html
 pref(layers.force-active,true) load 859526-1.html
+pref(layers.force-active,true) load 859630-1.html
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1390,20 +1390,26 @@ static void Sort(nsDisplayList* aList, i
          aCmp(list1.GetBottom(), list2.GetBottom(), aClosure))) {
       aList->AppendToTop(list1.RemoveBottom());
     } else {
       aList->AppendToTop(list2.RemoveBottom());
     }
   }
 }
 
-static nsIContent* FindContentInDocument(nsIContent* aContent, nsIDocument* aDoc) {
-  nsIContent* c = aContent;
+static nsIContent* FindContentInDocument(nsDisplayItem* aItem, nsIDocument* aDoc) {
+  nsIFrame* frame = aItem->GetUnderlyingFrame();
+  nsIContent* c = frame->GetContent();
   for (;;) {
-    nsIDocument* d = c->OwnerDoc();
+    nsIDocument* d;
+    if (c) {
+      d = c->OwnerDoc();
+    } else {
+      d = frame->PresContext()->Document();
+    }
     if (d == aDoc) {
       return c;
     }
     nsIDocument* parentDoc = d->GetParentDocument();
     if (!parentDoc) {
       return nullptr;
     }
     c = parentDoc->FindContentForSubDocument(d);
@@ -1417,20 +1423,18 @@ static nsIContent* FindContentInDocument
 static bool IsContentLEQ(nsDisplayItem* aItem1, nsDisplayItem* aItem2,
                          void* aClosure) {
   nsIContent* commonAncestor = static_cast<nsIContent*>(aClosure);
   // It's possible that the nsIContent for aItem1 or aItem2 is in a subdocument
   // of commonAncestor, because display items for subdocuments have been
   // mixed into the same list. Ensure that we're looking at content
   // in commonAncestor's document.
   nsIDocument* commonAncestorDoc = commonAncestor->OwnerDoc();
-  nsIContent* content1 = FindContentInDocument(aItem1->GetUnderlyingFrame()->GetContent(),
-                                               commonAncestorDoc);
-  nsIContent* content2 = FindContentInDocument(aItem2->GetUnderlyingFrame()->GetContent(),
-                                               commonAncestorDoc);
+  nsIContent* content1 = FindContentInDocument(aItem1, commonAncestorDoc);
+  nsIContent* content2 = FindContentInDocument(aItem2, commonAncestorDoc);
   if (!content1 || !content2) {
     NS_ERROR("Document trees are mixed up!");
     // Something weird going on
     return true;
   }
   return nsLayoutUtils::CompareTreePosition(content1, content2, commonAncestor) <= 0;
 }