Created attachment 567016 [details] testcase nsImageMap register mutation observer on map element, mutation observer doesn't get notified when root is removed as part of containing subtree. Steps to reproduce: 1) hover of imagemap, hand cursor appears on imagemap mouseover 2) remove area element, no hand cursor on corresponding imagemap area 3) remove the container of map element from DOM, hand cursor appears on imagemap
Seems like imagemap handling is pretty much static. It is all set when nsImageFrame first time uses imagemap for something, and after that the image frame points to the same map element, even if the id of it changes etc. nsImageMap should probably use ReferencedElement to track the changes.
I guess I could take this.
Created attachment 570119 [details] [diff] [review] patch But we really need to fix image map handling. http://mxr.mozilla.org/mozilla-central/source/accessible/src/html/nsHTMLImageMapAccessible.cpp#181 should be fixed to not use primaryframe of area elements (since we need to get rid of primary frames in that case) After that fixing focus handling, also remove support for <a> elements as synonyms to area etc.
Created attachment 570297 [details] [diff] [review] patch Handle also name/id changes. Uploaded to try
Comment on attachment 570297 [details] [diff] [review] patch Why do we need to null-check mImageFrame in ParentChainChanged but not AttributeChanged? r=me with those made consistent.
mImageFrame is null checked in both places.