Check each next-in-flow if it's an overflow container. b=564968 r=fantasai
authorMats Palmgren <matspal@gmail.com>
Wed, 02 Jun 2010 01:32:59 +0200
changeset 43003 ffcb26b63cfc8f621345350548292d58daa04ac5
parent 43002 bf3c27a3829f78fe52d56a46a70749ffbacfba9e
child 43004 7ecd591492af0449dc2af9dd7f6ed1452785e69a
push idunknown
push userunknown
push dateunknown
reviewersfantasai
bugs564968
milestone1.9.3a5pre
Check each next-in-flow if it's an overflow container. b=564968 r=fantasai
layout/generic/crashtests/564968.xhtml
layout/generic/crashtests/crashtests.list
layout/generic/nsBlockFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/564968.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+    .container {
+      height: 1em;
+    }
+    .overflow {
+      height: 8em;
+    }
+    body {
+      font-family: monospace;
+      height: 8em;
+      line-height: 1em;
+      -moz-column-count: 2;
+      -moz-column-gap: 0;
+    }
+</style>
+<script>
+    function boom()
+    {
+      document.documentElement.offsetHeight;
+      document.getElementById('x').style.display = 'none';
+      document.documentElement.offsetHeight;
+      document.getElementById('y').style.display = 'none';
+    }
+</script>
+</head>
+
+<body style="width: 17ch;" onload="boom();"><div id="x" class="container"></div>This paragraph must be in the first column.<div class="container" id="y"><div class="overflow"></div></div></body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -300,8 +300,9 @@ load 534366-1.html
 load 534366-2.html
 load 541277-1.html
 load 541277-2.html
 load 541714-1.html
 load 541714-2.html
 load 547338.xul
 load 551635-1.html
 load 564368-1.xhtml
+load 564968.xhtml
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -20,17 +20,17 @@
  * Portions created by the Initial Developer are Copyright (C) 1998
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  *   Steve Clark <buster@netscape.com>
  *   Robert O'Callahan <roc+moz@cs.cmu.edu>
  *   L. David Baron <dbaron@dbaron.org>
  *   IBM Corporation
- *   Mats Palmgren <mats.palmgren@bredband.net>
+ *   Mats Palmgren <matspal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -5167,23 +5167,16 @@ nsBlockFrame::DoRemoveFrame(nsIFrame* aD
     }
     else {
       nsContainerFrame::DeleteNextInFlowChild(presContext, aDeletedFrame,
                                               (aFlags & FRAMES_ARE_EMPTY) != 0);
     }
     return NS_OK;
   }
 
-  // If next-in-flow is an overflow container, must remove it first
-  nsIFrame* next = aDeletedFrame->GetNextInFlow();
-  if (next && next->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER) {
-    static_cast<nsContainerFrame*>(next->GetParent())
-      ->DeleteNextInFlowChild(next->PresContext(), next, PR_FALSE);
-  }
-
   nsIPresShell* presShell = presContext->PresShell();
 
   // Find the line that contains deletedFrame
   nsLineList::iterator line_start = mLines.begin(),
                        line_end = mLines.end();
   nsLineList::iterator line = line_start;
   PRBool searchingOverflowList = PR_FALSE;
   // Make sure we look in the overflow lines even if the normal line
@@ -5269,19 +5262,28 @@ nsBlockFrame::DoRemoveFrame(nsIFrame* aD
     // Destroy frame; capture its next continuation first in case we need
     // to destroy that too.
     nsIFrame* deletedNextContinuation = (aFlags & REMOVE_FIXED_CONTINUATIONS) ?
         aDeletedFrame->GetNextContinuation() : aDeletedFrame->GetNextInFlow();
 #ifdef NOISY_REMOVE_FRAME
     printf("DoRemoveFrame: %s line=%p frame=",
            searchingOverflowList?"overflow":"normal", line.get());
     nsFrame::ListTag(stdout, aDeletedFrame);
-    printf(" prevSibling=%p deletedNextContinuation=%p\n", prevSibling, deletedNextContinuation);
+    printf(" prevSibling=%p deletedNextContinuation=%p\n",
+           aDeletedFrame->GetPrevSibling(), deletedNextContinuation);
 #endif
 
+    // If next-in-flow is an overflow container, must remove it first.
+    if (deletedNextContinuation &&
+        deletedNextContinuation->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER) {
+      static_cast<nsContainerFrame*>(deletedNextContinuation->GetParent())
+        ->DeleteNextInFlowChild(presContext, deletedNextContinuation, PR_FALSE);
+      deletedNextContinuation = nsnull;
+    }
+
     aDeletedFrame->Destroy();
     aDeletedFrame = deletedNextContinuation;
 
     PRBool haveAdvancedToNextLine = PR_FALSE;
     // If line is empty, remove it now.
     if (0 == lineChildCount) {
 #ifdef NOISY_REMOVE_FRAME
         printf("DoRemoveFrame: %s line=%p became empty so it will be removed\n",