108857 - nextChild deleted instead of nextNextChild

Status: RESOLVED INVALID

(Core :: Layout, defect)

Description

[Mike Junkin]

nsContainerFrame::DeleteChildsNextInFlow() method in nsContainerFrame.cpp line 848.

The method finds the next child in flow and then checks that child to see if it
contains a next child also.  In the comments it says that if a next next child
is found then the next next child should be deleted before the next child.  But
after checking for a non-null next next child it then removes the next child. 
The next next child is never touched.  And the next child is used again in the
method after it's removed/deleted.  

Here's the code snippet:

  // If the next-in-flow has a next-in-flow then delete it, too (and
  // delete it first).
  nsIFrame* nextNextInFlow;

  nextInFlow->GetNextInFlow(&nextNextInFlow);
  if (nsnull != nextNextInFlow) {
    parent->DeleteChildsNextInFlow(aPresContext, nextInFlow);
  }

Note also that 'parent' is the parent of 'nextInFlow' not 'nextNextInFlow'.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Um... no.  The method takes an arg (aChild).  It gets the nextInFlow of aChild.
 If that has a nextNextInFlow, it calls itself with nextInFlow as arg instead of
aChild.

Note that this means that it iterates down the flow till there is no next in
flow.  Then it deletes that frame and moves back up the recursion tree deleting
frames.  This seems correct to me...

Note that the method does not use any member vars so it does not matter what
|parent| is.

Comment 2

[Mike Junkin]

Boris Zbarsky pointed out that parent->DeleteChildsNextInFlow doesn't take the 
nextNextInFlow but instead uses the nextInFlow and recursively deletes the 
whole chain of frames.