Bug 424238. Make sure to guard against mutations happening while we notify on opening the <body> and <frameset> tags, just like we do in FlushTags. r+sr=sicking
authorBoris Zbarsky <bzbarsky@mit.edu>
Mon, 25 Aug 2008 13:21:29 -0400
changeset 18382 30b687e0c14b8cdd8e2218caf66730fb10382398
parent 18381 b528bc24d6b7c535afaed1eae6423e5a615db7c8
child 18383 7615810bd8358a97057455dea0f7f8c51199ab63
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs424238
milestone1.9.1a2pre
Bug 424238. Make sure to guard against mutations happening while we notify on opening the <body> and <frameset> tags, just like we do in FlushTags. r+sr=sicking
content/html/document/src/nsHTMLContentSink.cpp
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -2071,22 +2071,28 @@ HTMLContentSink::OpenBody(const nsIParse
     
     PRInt32 insertionPoint =
       mCurrentContext->mStack[parentIndex].mInsertionPoint;
 
     // XXX: I have yet to see a case where numFlushed is non-zero and
     // insertionPoint is not -1, but this code will try to handle
     // those cases too.
 
+    PRBool oldUpdates = mUpdatesInNotification;
+    mUpdatesInNotification = 0;
     if (insertionPoint != -1) {
       NotifyInsert(parent, mBody, insertionPoint - 1);
     } else {
       NotifyAppend(parent, numFlushed);
     }
     mCurrentContext->mStack[parentIndex].mNumFlushed = childCount;
+    if (mUpdatesInNotification > 1) {
+      UpdateChildCounts();
+    }
+    mUpdatesInNotification = oldUpdates;
   }
 
   StartLayout(PR_FALSE);
 
   return NS_OK;
 }
 
 nsresult
@@ -2227,22 +2233,28 @@ HTMLContentSink::OpenFrameset(const nsIP
 
     PRInt32 insertionPoint =
       mCurrentContext->mStack[parentIndex].mInsertionPoint;
 
     // XXX: I have yet to see a case where numFlushed is non-zero and
     // insertionPoint is not -1, but this code will try to handle
     // those cases too.
 
+    PRBool oldUpdates = mUpdatesInNotification;
+    mUpdatesInNotification = 0;
     if (insertionPoint != -1) {
       NotifyInsert(parent, mFrameset, insertionPoint - 1);
     } else {
       NotifyAppend(parent, numFlushed);
     }
     mCurrentContext->mStack[parentIndex].mNumFlushed = childCount;
+    if (mUpdatesInNotification > 1) {
+      UpdateChildCounts();
+    }
+    mUpdatesInNotification = oldUpdates;
   }
   
   return rv;
 }
 
 nsresult
 HTMLContentSink::CloseFrameset()
 {