Bug 1400618 part 5 - Destroy the frames before removing the AccessibleCaret anonymous content (to ensure it happens before the UnbindFromTree). r=bz
authorMats Palmgren <mats@mozilla.com>
Tue, 07 Nov 2017 01:20:34 +0100
changeset 434937 e46bd0b42454a446bd1080a4d32f92386d2d2336
parent 434936 82659642e0583a8e493bea4f0a7bfb75dc48accd
child 434938 cd9f14f9ea6d4bcd175874352c402613503a86d8
push id117
push userfmarier@mozilla.com
push dateTue, 28 Nov 2017 20:17:16 +0000
reviewersbz
bugs1400618
milestone58.0a1
Bug 1400618 part 5 - Destroy the frames before removing the AccessibleCaret anonymous content (to ensure it happens before the UnbindFromTree). r=bz MozReview-Commit-ID: Kvudz7bJFEZ
layout/base/AccessibleCaret.cpp
--- a/layout/base/AccessibleCaret.cpp
+++ b/layout/base/AccessibleCaret.cpp
@@ -7,18 +7,20 @@
 #include "AccessibleCaret.h"
 
 #include "AccessibleCaretLogger.h"
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/ToString.h"
 #include "nsCanvasFrame.h"
 #include "nsCaret.h"
+#include "nsCSSFrameConstructor.h"
 #include "nsDOMTokenList.h"
 #include "nsIFrame.h"
+#include "nsPlaceholderFrame.h"
 
 namespace mozilla {
 using namespace dom;
 
 #undef AC_LOG
 #define AC_LOG(message, ...)                                                   \
   AC_LOG_BASE("AccessibleCaret (%p): " message, this, ##__VA_ARGS__);
 
@@ -257,16 +259,27 @@ AccessibleCaret::CreateCaretElement(nsID
 }
 
 void
 AccessibleCaret::RemoveCaretElement(nsIDocument* aDocument)
 {
   CaretElement()->RemoveEventListener(NS_LITERAL_STRING("touchstart"),
                                       mDummyTouchListener, false);
 
+  if (nsIFrame* frame = CaretElement()->GetPrimaryFrame()) {
+    if (frame->HasAnyStateBits(NS_FRAME_OUT_OF_FLOW)) {
+      frame = frame->GetPlaceholderFrame();
+    }
+    nsAutoScriptBlocker scriptBlocker;
+    nsCSSFrameConstructor* fc = frame->PresContext()->PresShell()->FrameConstructor();
+    fc->BeginUpdate();
+    frame->GetParent()->RemoveFrame(nsIFrame::kPrincipalList, frame);
+    fc->EndUpdate();
+  }
+
   ErrorResult rv;
   aDocument->RemoveAnonymousContent(*mCaretElementHolder, rv);
   // It's OK rv is failed since nsCanvasFrame might not exists now.
   rv.SuppressException();
 }
 
 AccessibleCaret::PositionChangedResult
 AccessibleCaret::SetPosition(nsIFrame* aFrame, int32_t aOffset)