Backed out 1 changesets (bug 1429088) for crashes, e.g. in reftest/tests/layout/reftests/bugs/309914-1.xul on a CLOSED TREE
authorCoroiu Cristina <ccoroiu@mozilla.com>
Sat, 13 Jan 2018 12:50:05 +0200
changeset 453490 c907622b111580217f7ff0ed099b65452667d559
parent 453489 2b03a2829baec604b9f32488ab3655eaac42acc8
child 453493 8f5c0026b4625352c8b04a3d687f9f9dada3af98
push id1648
push usermtabara@mozilla.com
push dateThu, 01 Mar 2018 12:45:47 +0000
treeherdermozilla-release@cbb9688c2eeb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1429088, 309914
milestone59.0a1
backs out7647a5900c99198390ee3c7e12dac4200caf87a5
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out 1 changesets (bug 1429088) for crashes, e.g. in reftest/tests/layout/reftests/bugs/309914-1.xul on a CLOSED TREE Backed out changeset 7647a5900c99 (bug 1429088)
layout/base/nsCSSFrameConstructor.cpp
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7094,23 +7094,25 @@ IsSpecialFramesetChild(nsIContent* aCont
   return aContent->IsAnyOfHTMLElements(nsGkAtoms::frameset, nsGkAtoms::frame);
 }
 
 static void
 InvalidateCanvasIfNeeded(nsIPresShell* presShell, nsIContent* node);
 
 #ifdef MOZ_XUL
 
-static bool
+static
+bool
 IsXULListBox(nsIContent* aContainer)
 {
-  return aContainer->IsXULElement(nsGkAtoms::listbox);
-}
-
-static nsListBoxBodyFrame*
+  return (aContainer->IsXULElement(nsGkAtoms::listbox));
+}
+
+static
+nsListBoxBodyFrame*
 MaybeGetListBoxBodyFrame(nsIContent* aContainer, nsIContent* aChild)
 {
   if (!aContainer)
     return nullptr;
 
   if (IsXULListBox(aContainer) &&
       aChild->IsXULElement(nsGkAtoms::listitem)) {
     RefPtr<nsXULElement> xulElement = nsXULElement::FromContent(aContainer);
@@ -7610,32 +7612,32 @@ nsCSSFrameConstructor::ContentAppended(n
   if (aInsertionKind == InsertionKind::Async &&
       MaybeConstructLazily(CONTENTAPPEND, aContainer, aFirstNewContent)) {
     if (aContainer->IsStyledByServo()) {
       LazilyStyleNewChildRange(aFirstNewContent, nullptr);
     }
     return;
   }
 
+  // We couldn't construct lazily. Make Servo eagerly traverse the new content
+  // if needed (when aInsertionKind == InsertionKind::Sync, we know that the
+  // styles are up-to-date already).
+  if (aInsertionKind == InsertionKind::Async && aContainer->IsStyledByServo()) {
+    StyleNewChildRange(aFirstNewContent, nullptr);
+  }
+
   LAYOUT_PHASE_TEMP_EXIT();
   InsertionPoint insertion =
     GetRangeInsertionPoint(aContainer, aFirstNewContent, nullptr);
   nsContainerFrame*& parentFrame = insertion.mParentFrame;
   LAYOUT_PHASE_TEMP_REENTER();
   if (!parentFrame) {
     return;
   }
 
-  // We couldn't construct lazily. Make Servo eagerly traverse the new content
-  // if needed (when aInsertionKind == InsertionKind::Sync, we know that the
-  // styles are up-to-date already).
-  if (aInsertionKind == InsertionKind::Async && aContainer->IsStyledByServo()) {
-    StyleNewChildRange(aFirstNewContent, nullptr);
-  }
-
   LAYOUT_PHASE_TEMP_EXIT();
   if (MaybeRecreateForFrameset(parentFrame, aFirstNewContent, nullptr)) {
     LAYOUT_PHASE_TEMP_REENTER();
     return;
   }
   LAYOUT_PHASE_TEMP_REENTER();
 
   if (parentFrame->IsLeaf()) {
@@ -7867,42 +7869,52 @@ nsCSSFrameConstructor::ContentAppended(n
     accService->ContentRangeInserted(mPresShell, aContainer,
                                      aFirstNewContent, nullptr);
   }
 #endif
 }
 
 #ifdef MOZ_XUL
 
+enum content_operation
+{
+    CONTENT_INSERTED,
+    CONTENT_REMOVED
+};
+
 // Helper function to lookup the listbox body frame and send a notification
-// for removal of content.
-static bool
-MaybeNotifyListBoxBodyOfRemoval(nsPresContext* aPresContext,
-                                nsIContent* aContainer,
-                                nsIContent* aChild,
-                                nsIContent* aOldNextSibling,
-                                nsIFrame* aChildFrame)
+// for insertion or removal of content
+static
+bool NotifyListBoxBody(nsPresContext*    aPresContext,
+                         nsIContent*        aContainer,
+                         nsIContent*        aChild,
+                         // Only used for the removed notification
+                         nsIContent*        aOldNextSibling,
+                         nsIFrame*          aChildFrame,
+                         content_operation  aOperation)
 {
   nsListBoxBodyFrame* listBoxBodyFrame =
     MaybeGetListBoxBodyFrame(aContainer, aChild);
-  if (!listBoxBodyFrame) {
-    return false;
-  }
-
-  // Except if we have an aChildFrame and its parent is not the right
-  // thing, then we don't do this.  Pseudo frames are so much fun....
-  if (aChildFrame && aChildFrame->GetParent() != listBoxBodyFrame) {
-    return false;
-  }
-
-  listBoxBodyFrame->OnContentRemoved(
-    aPresContext, aContainer, aChildFrame, aOldNextSibling);
-  return true;
-}
-
+  if (listBoxBodyFrame) {
+    if (aOperation == CONTENT_REMOVED) {
+      // Except if we have an aChildFrame and its parent is not the right
+      // thing, then we don't do this.  Pseudo frames are so much fun....
+      if (!aChildFrame || aChildFrame->GetParent() == listBoxBodyFrame) {
+        listBoxBodyFrame->OnContentRemoved(aPresContext, aContainer,
+                                           aChildFrame, aOldNextSibling);
+        return true;
+      }
+    } else {
+      listBoxBodyFrame->OnContentInserted(aChild);
+      return true;
+    }
+  }
+
+  return false;
+}
 #endif // MOZ_XUL
 
 void
 nsCSSFrameConstructor::ContentInserted(nsIContent* aContainer,
                                        nsIContent* aChild,
                                        nsILayoutHistoryState* aFrameState,
                                        InsertionKind aInsertionKind)
 {
@@ -7991,21 +8003,22 @@ nsCSSFrameConstructor::ContentRangeInser
                aInsertionKind == InsertionKind::Sync,
                "range insert shouldn't be lazy");
   NS_ASSERTION(isSingleInsert || aEndChild,
                "range should not include all nodes after aStartChild");
 
 #ifdef MOZ_XUL
   if (aContainer && IsXULListBox(aContainer)) {
     // For XUL list box, we need to style the new children eagerly.
+    styleNewChildRangeEagerly();
     if (isSingleInsert) {
-      if (nsListBoxBodyFrame* listBoxBodyFrame =
-            MaybeGetListBoxBodyFrame(aContainer, aStartChild)) {
-        styleNewChildRangeEagerly();
-        listBoxBodyFrame->OnContentInserted(aStartChild);
+      if (NotifyListBoxBody(mPresShell->GetPresContext(), aContainer,
+                            // The insert case in NotifyListBoxBody
+                            // doesn't use "old next sibling".
+                            aStartChild, nullptr, nullptr, CONTENT_INSERTED)) {
         return;
       }
     } else {
       // We don't handle a range insert to a listbox parent, issue single
       // ContertInserted calls for each node inserted.
       LAYOUT_PHASE_TEMP_EXIT();
       IssueSingleInsertNofications(aContainer, aStartChild, aEndChild);
       LAYOUT_PHASE_TEMP_REENTER();
@@ -8084,16 +8097,20 @@ nsCSSFrameConstructor::ContentRangeInser
   if (aInsertionKind == InsertionKind::Async &&
       MaybeConstructLazily(CONTENTINSERT, aContainer, aStartChild)) {
     if (aContainer->IsStyledByServo()) {
       LazilyStyleNewChildRange(aStartChild, aEndChild);
     }
     return;
   }
 
+  // We couldn't construct lazily. Make Servo eagerly traverse the new content
+  // if needed.
+  styleNewChildRangeEagerly();
+
   InsertionPoint insertion;
   if (isSingleInsert) {
     // See if we have an XBL insertion point. If so, then that's our
     // real parent frame; if not, then the frame hasn't been built yet
     // and we just bail.
     insertion = GetInsertionPoint(aStartChild);
   } else {
     // Get our insertion point. If we need to issue single ContentInserted's
@@ -8102,21 +8119,16 @@ nsCSSFrameConstructor::ContentRangeInser
     insertion = GetRangeInsertionPoint(aContainer, aStartChild, aEndChild);
     LAYOUT_PHASE_TEMP_REENTER();
   }
 
   if (!insertion.mParentFrame) {
     return;
   }
 
-  // We couldn't construct lazily.
-  //
-  // Make Servo eagerly traverse the new content if needed.
-  styleNewChildRangeEagerly();
-
   bool isAppend, isRangeInsertSafe;
   nsIFrame* prevSibling = GetInsertionPrevSibling(&insertion, aStartChild,
                                                   &isAppend, &isRangeInsertSafe);
 
   // check if range insert is safe
   if (!isSingleInsert && !isRangeInsertSafe) {
     // must fall back to a single ContertInserted for each child in the range
     LAYOUT_PHASE_TEMP_EXIT();
@@ -8543,18 +8555,18 @@ nsCSSFrameConstructor::ContentRemoved(ns
         }
       }
     }
     UnregisterDisplayContentsStyleFor(aChild, aContainer);
     return false;
   }
 
 #ifdef MOZ_XUL
-  if (MaybeNotifyListBoxBodyOfRemoval(
-        presContext, aContainer, aChild, aOldNextSibling, childFrame)) {
+  if (NotifyListBoxBody(presContext, aContainer, aChild, aOldNextSibling,
+                        childFrame, CONTENT_REMOVED)) {
     return false;
   }
 #endif // MOZ_XUL
 
   // If we're removing the root, then make sure to remove things starting at
   // the viewport's child instead of the primary frame (which might even be
   // null if the root had an XBL binding or display:none, even though the
   // frames above it got created).  We do the adjustment after the childFrame