Bug 502168, r=bz
authorOlli Pettay <Olli.Pettay@helsinki.fi>
Thu, 13 Aug 2009 23:27:37 +0300
changeset 31441 5d0c03667020d717e7dd308157c02a382fd26207
parent 31440 26d7d4a0b5771d4ff395d9cc002d3924f4a572f2
child 31442 546a7d596966764ab845befef992ae19ae66e5ee
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs502168
milestone1.9.3a1pre
Bug 502168, r=bz
content/html/document/reftests/bug502168-1_malformed.html
content/html/document/reftests/bug502168-1_well-formed.html
content/html/document/reftests/reftests.list
content/html/document/src/nsHTMLContentSink.cpp
new file mode 100644
--- /dev/null
+++ b/content/html/document/reftests/bug502168-1_malformed.html
@@ -0,0 +1,10 @@
+<html><head>
+<title> Bug 502168 -  Particular images are displayed multiple times in a formated way - only FF 3.5</title>
+</head><body>
+
+<table><tbody><tr><td >You should see this text only once</td>
+<embed type="*" style="display: none;"/>
+</td></tr></tbody></table>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/html/document/reftests/bug502168-1_well-formed.html
@@ -0,0 +1,9 @@
+<html><head>
+<title> Bug 502168 -  Particular images are displayed multiple times in a formated way - only FF 3.5</title>
+</head><body>
+
+<embed type="*" style="display: none;">
+<table><tbody><tr><td>You should see this text only once</td>
+</tr></tbody></table>
+
+</body></html>
--- a/content/html/document/reftests/reftests.list
+++ b/content/html/document/reftests/reftests.list
@@ -1,4 +1,5 @@
 == bug448564-1_malformed.html bug448564-1_well-formed.html
 == bug448564-1_malformed.html bug448564-1_ideal.html
 
 == bug448564-4a.html          bug448564-4b.html
+== bug502168-1_malformed.html bug502168-1_well-formed.html
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -1358,21 +1358,26 @@ SinkContext::FlushTags()
           mStack[stackPos].mContent->Tag()->GetUTF8String(&tagStr);
 
           SINK_TRACE(gSinkLogModuleInfo, SINK_TRACE_REFLOW,
                      ("SinkContext::FlushTags: tag=%s from newindex=%d at "
                       "stackPos=%d", tagStr,
                       mStack[stackPos].mNumFlushed, stackPos));
         }
 #endif
-        if ((mStack[stackPos].mInsertionPoint != -1) &&
-            (mStackPos > (stackPos + 1))) {
+        if (mStack[stackPos].mInsertionPoint != -1) {
+          // We might have popped the child off our stack already
+          // but not notified on it yet, which is why we have to get it
+          // directly from its parent node.
+
           PRInt32 childIndex = mStack[stackPos].mInsertionPoint - 1;
-          nsIContent* child = mStack[stackPos + 1].mContent;
-          NS_ASSERTION(content->GetChildAt(childIndex) == child,
+          nsIContent* child = content->GetChildAt(childIndex);
+          // Child not on stack anymore; can't assert it's correct
+          NS_ASSERTION(!(mStackPos > (stackPos + 1)) ||
+                       (child == mStack[stackPos + 1].mContent),
                        "Flushing the wrong child.");
           mSink->NotifyInsert(content, child, childIndex);
         } else {
           mSink->NotifyAppend(content, mStack[stackPos].mNumFlushed);
         }
 
         flushed = PR_TRUE;
       }