Backed out changeset 8589d9bdd501 (bug 1040735) for B2G gaia-ui-test crashes
authorEd Morley <emorley@mozilla.com>
Fri, 15 Aug 2014 16:03:03 +0100
changeset 199764 5de91aef0d9cc7aa021961fb5bbfcfe591757aa3
parent 199763 a3acc5b4345af3bc4dd99c9e14fd349fa78eac11
child 199765 c3ab83f45b5d23e424001d4bc1717297c6367171
push idunknown
push userunknown
push dateunknown
bugs1040735
milestone34.0a1
backs out8589d9bdd50156d71a3566153459236c16c102ed
Backed out changeset 8589d9bdd501 (bug 1040735) for B2G gaia-ui-test crashes
accessible/base/nsAccessibilityService.cpp
accessible/base/nsAccessibilityService.h
accessible/generic/Accessible.cpp
accessible/tests/mochitest/treeupdate/a11y.ini
accessible/tests/mochitest/treeupdate/test_bug1040735.html
layout/base/RestyleManager.cpp
layout/base/nsCSSFrameConstructor.cpp
layout/xul/nsListBoxBodyFrame.cpp
--- a/accessible/base/nsAccessibilityService.cpp
+++ b/accessible/base/nsAccessibilityService.cpp
@@ -386,32 +386,32 @@ nsAccessibilityService::ContentRangeInse
 
   DocAccessible* docAccessible = GetDocAccessible(aPresShell);
   if (docAccessible)
     docAccessible->ContentInserted(aContainer, aStartChild, aEndChild);
 }
 
 void
 nsAccessibilityService::ContentRemoved(nsIPresShell* aPresShell,
+                                       nsIContent* aContainer,
                                        nsIContent* aChild)
 {
-  nsIContent* container = aChild->GetFlattenedTreeParent();
 #ifdef A11Y_LOG
   if (logging::IsEnabled(logging::eTree)) {
     logging::MsgBegin("TREE", "content removed");
-    logging::Node("container", container);
+    logging::Node("container", aContainer);
     logging::Node("content", aChild);
     logging::MsgEnd();
     logging::Stack();
   }
 #endif
 
   DocAccessible* docAccessible = GetDocAccessible(aPresShell);
   if (docAccessible)
-    docAccessible->ContentRemoved(container, aChild);
+    docAccessible->ContentRemoved(aContainer, aChild);
 }
 
 void
 nsAccessibilityService::UpdateText(nsIPresShell* aPresShell,
                                    nsIContent* aContent)
 {
   DocAccessible* document = GetDocAccessible(aPresShell);
   if (document)
--- a/accessible/base/nsAccessibilityService.h
+++ b/accessible/base/nsAccessibilityService.h
@@ -85,17 +85,18 @@ public:
    * inserted.
    */
   void ContentRangeInserted(nsIPresShell* aPresShell, nsIContent* aContainer,
                             nsIContent* aStartChild, nsIContent* aEndChild);
 
   /**
    * Notification used to update the accessible tree when content is removed.
    */
-  void ContentRemoved(nsIPresShell* aPresShell, nsIContent* aChild);
+  void ContentRemoved(nsIPresShell* aPresShell, nsIContent* aContainer,
+                      nsIContent* aChild);
 
   virtual void UpdateText(nsIPresShell* aPresShell, nsIContent* aContent);
 
   /**
    * Update XUL:tree accessible tree when treeview is changed.
    */
   void TreeViewChanged(nsIPresShell* aPresShell, nsIContent* aContent,
                        nsITreeView* aView);
--- a/accessible/generic/Accessible.cpp
+++ b/accessible/generic/Accessible.cpp
@@ -2533,16 +2533,17 @@ void
 Accessible::BindToParent(Accessible* aParent, uint32_t aIndexInParent)
 {
   NS_PRECONDITION(aParent, "This method isn't used to set null parent!");
 
   if (mParent) {
     if (mParent != aParent) {
       NS_ERROR("Adopting child!");
       mParent->RemoveChild(this);
+      mParent->InvalidateChildrenGroupInfo();
     } else {
       NS_ERROR("Binding to the same parent!");
       return;
     }
   }
 
   mParent = aParent;
   mIndexInParent = aIndexInParent;
--- a/accessible/tests/mochitest/treeupdate/a11y.ini
+++ b/accessible/tests/mochitest/treeupdate/a11y.ini
@@ -1,16 +1,15 @@
 [DEFAULT]
 
 [test_ariadialog.html]
 [test_bug852150.xhtml]
 [test_bug883708.xhtml]
 [test_bug884251.xhtml]
 [test_bug895082.html]
-[test_bug1040735.html]
 [test_canvas.html]
 [test_colorpicker.xul]
 [test_contextmenu.xul]
 [test_cssoverflow.html]
 [test_deck.xul]
 [test_doc.html]
 [test_gencontent.html]
 [test_hidden.html]
deleted file mode 100644
--- a/accessible/tests/mochitest/treeupdate/test_bug1040735.html
+++ /dev/null
@@ -1,43 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>Adopt DOM node from anonymous subtree</title>
-
-  <link rel="stylesheet" type="text/css"
-        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
-
-  <script type="application/javascript"
-          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript"
-          src="../common.js"></script>
-
-  <script type="application/javascript">
-    SimpleTest.expectAssertions(0, 1);
-    function doTest()
-    {
-      document.body.appendChild(document.getElementById("mw_a"));
-      setTimeout(function() { ok(true, "no crash and assertions"); SimpleTest.finish(); } , 0);
-    }
-
-    SimpleTest.waitForExplicitFinish();
-    addA11yLoadEvent(doTest);
-  </script>
-</head>
-
-<body>
-  <a target="_blank"
-     href="https://bugzilla.mozilla.org/show_bug.cgi?id=1040735"
-     title="Bug 1040735 - DOM node reinsertion under anonymous content may trigger a11y child adoption">
-    Bug 1040735</a>
-  <p id="display"></p>
-  <div id="content" style="display: none"></div>
-  <pre id="test">
-  </pre>
-
-  <marquee>
-    <div id="mw_a" style="visibility: hidden;">
-      <div style="visibility: visible;" id="mw_inside"></div>
-    </div>
-  </marquee>
-</body>
-</html>
--- a/layout/base/RestyleManager.cpp
+++ b/layout/base/RestyleManager.cpp
@@ -3036,17 +3036,17 @@ ElementRestyler::SendAccessibilityNotifi
                                        content,
                                        content->GetNextSibling());
     }
   } else if (mOurA11yNotification == eNotifyHidden) {
     nsAccessibilityService* accService = nsIPresShell::AccService();
     if (accService) {
       nsIPresShell* presShell = mFrame->PresContext()->GetPresShell();
       nsIContent* content = mFrame->GetContent();
-      accService->ContentRemoved(presShell, content);
+      accService->ContentRemoved(presShell, content->GetParent(), content);
 
       // Process children staying shown.
       uint32_t visibleContentCount = mVisibleKidsOfHiddenElement.Length();
       for (uint32_t idx = 0; idx < visibleContentCount; idx++) {
         nsIContent* childContent = mVisibleKidsOfHiddenElement[idx];
         accService->ContentRangeInserted(presShell, childContent->GetParent(),
                                          childContent,
                                          childContent->GetNextSibling());
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7782,17 +7782,17 @@ nsCSSFrameConstructor::ContentRemoved(ns
       nsresult rv = RecreateFramesForContent(grandparentFrame->GetContent(), true);
       LAYOUT_PHASE_TEMP_REENTER();
       return rv;
     }
 
 #ifdef ACCESSIBILITY
     nsAccessibilityService* accService = nsIPresShell::AccService();
     if (accService) {
-      accService->ContentRemoved(mPresShell, aChild);
+      accService->ContentRemoved(mPresShell, aContainer, aChild);
     }
 #endif
 
     // Examine the containing-block for the removed content and see if
     // :first-letter style applies.
     nsIFrame* inflowChild = childFrame;
     if (childFrame->GetStateBits() & NS_FRAME_OUT_OF_FLOW) {
       inflowChild = GetPlaceholderFrameFor(childFrame);
--- a/layout/xul/nsListBoxBodyFrame.cpp
+++ b/layout/xul/nsListBoxBodyFrame.cpp
@@ -1465,17 +1465,18 @@ nsListBoxBodyFrame::RemoveChildFrame(nsB
 {
   MOZ_ASSERT(mFrames.ContainsFrame(aFrame));
   MOZ_ASSERT(aFrame != GetContentInsertionFrame());
 
 #ifdef ACCESSIBILITY
   nsAccessibilityService* accService = nsIPresShell::AccService();
   if (accService) {
     nsIContent* content = aFrame->GetContent();
-    accService->ContentRemoved(PresContext()->PresShell(), content);
+    accService->ContentRemoved(PresContext()->PresShell(), content->GetParent(),
+                               content);
   }
 #endif
 
   mFrames.RemoveFrame(aFrame);
   if (mLayoutManager)
     mLayoutManager->ChildrenRemoved(this, aState, aFrame);
   aFrame->Destroy();
 }