114220 - text control frames get readded to primary frame map during destruction

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Text control frames get readded to the primary frame map during their
destruction in some cases, after they've been removed.  This can lead to stale
frames (the text control frame, and up its ancestor chain) being in the map. 
See attachment 59623 [details] on bug 105619 for a testcase and bug 105619 comment 57 for
a stack.

I'll attach a patch that prevents this from happening by passing the frame from
frame to content in some cases, as jst suggested.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The change in nsFrameManager.cpp needs to check for non-null ops, i.e.:

#ifdef DEBUG
  if (mPrimaryFrameMap.ops) {
    nsCOMPtr<nsIContent> content;
    aFrame->GetContent(getter_AddRefs(content));
    PrimaryFrameMapEntry *entry = NS_STATIC_CAST(PrimaryFrameMapEntry*,
        PL_DHashTableOperate(&mPrimaryFrameMap, content, PL_DHASH_LOOKUP));
    NS_ASSERTION(!PL_DHASH_ENTRY_IS_BUSY(entry) || entry->frame != aFrame,
                 "frame was not removed from primary frame map before"
                 "destruction or was readded to map after being removed");
  }
#endif

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 60945 [details] [diff] [review]
patch

sr=jst, but please also make nsIGfxTextControlFrame use
NS_DEFINE_STATIC_IID_ACCESSOR() for defining the IID accessor.

Comment 4

[John Keiser (jkeiser)]

Comment on attachment 60945 [details] [diff] [review]
patch

r=jkeiser

Comment 5

[Cathleen]

dbaron landed the fix on 12/10/2001 21:39

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This may have also fixed bug 108704.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Oh, and the fact that I forgot to check in my comment #2 caused bug 114675, but
was easily fixed.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

*** Bug 108704 has been marked as a duplicate of this bug. ***