Bug 1003441 - Check that the new frame is also a nsSubDocumentFrame (i.e. that Init has picked up the detached views). r=roc, a=sledru
authorMats Palmgren <mats@mozilla.com>
Wed, 27 May 2015 22:18:36 +0000
changeset 266166 abcd95bb7212
parent 266165 415472b5a680
child 266167 082a23c146bd
push id4771
push userryanvm@gmail.com
push date2015-06-02 20:21 +0000
treeherdermozilla-beta@082a23c146bd [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc, sledru
bugs1003441
milestone39.0
Bug 1003441 - Check that the new frame is also a nsSubDocumentFrame (i.e. that Init has picked up the detached views). r=roc, a=sledru
layout/generic/crashtests/1003441.xul
layout/generic/crashtests/crashtests.list
layout/generic/nsSubDocumentFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/1003441.xul
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom,0,1)">
+
+<splitter style="all: inherit;">
+    <box/>
+    <box/>
+    <box/>
+    <box/>
+    <iframe id="a" src="aaa"/>
+</splitter>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+
+    <![CDATA[//<![CDATA[
+
+var doc = document;
+function boom(i) {
+  if (i>6)
+    return;
+  var x=doc.getElementsByTagName('*');
+  if (x[i] && x[i+1]) {
+    var temp = x[i+1].getAttribute('style');
+    x[i+1].setAttribute('style', x[i].getAttribute('style'));
+    x[i].setAttribute('style', temp);
+  } else { 
+    return;
+  }
+  i++;
+  setTimeout(boom,50,i);
+}
+
+//]]>
+
+    </script>
+
+    </window>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -554,16 +554,17 @@ load 946167-1.html
 load 947158.html
 test-pref(layout.css.sticky.enabled,true) load 949932.html
 load 970710.html
 load 973701-1.xhtml
 load 973701-2.xhtml
 load 986899.html
 load 1001233.html
 load 1001258-1.html
+load 1003441.xul
 pref(layout.css.grid.enabled,true) load 1015562.html
 asserts(1-2) load 1015563-1.html
 asserts(1-2) load 1015563-2.html
 asserts(0-300) load 1015844.html # bug 574889
 load outline-on-frameset.xhtml
 pref(font.size.inflation.minTwips,200) load 1032450.html
 load 1037903.html
 load 1039454-1.html
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -932,17 +932,17 @@ public:
   NS_IMETHOD Run()
   {
     // Flush frames, to ensure any pending display:none changes are made.
     // Note it can be unsafe to flush if we've destroyed the presentation
     // for some other reason, like if we're shutting down.
     if (!mPresShell->IsDestroying()) {
       mPresShell->FlushPendingNotifications(Flush_Frames);
     }
-    nsIFrame* frame = mFrameElement->GetPrimaryFrame();
+    nsSubDocumentFrame* frame = do_QueryFrame(mFrameElement->GetPrimaryFrame());
     if ((!frame && mHideViewerIfFrameless) ||
         mPresShell->IsDestroying()) {
       // Either the frame element has no nsIFrame or the presshell is being
       // destroyed. Hide the nsFrameLoader, which destroys the presentation,
       // and clear our references to the stashed presentation.
       mFrameLoader->SetDetachedSubdocView(nullptr, nullptr);
       mFrameLoader->Hide();
     }