Created attachment 567016 [details]
nsImageMap register mutation observer on map element, mutation observer doesn't get notified when root is removed as part of containing subtree.
Steps to reproduce:
1) hover of imagemap, hand cursor appears on imagemap mouseover
2) remove area element, no hand cursor on corresponding imagemap area
3) remove the container of map element from DOM, hand cursor appears on imagemap
Seems like imagemap handling is pretty much static. It is all set when nsImageFrame first time
uses imagemap for something, and after that the image frame points to the same map element, even if
the id of it changes etc.
nsImageMap should probably use ReferencedElement to track the changes.
I guess I could take this.
Created attachment 570119 [details] [diff] [review]
But we really need to fix image map handling.
http://mxr.mozilla.org/mozilla-central/source/accessible/src/html/nsHTMLImageMapAccessible.cpp#181 should be fixed to not use
primaryframe of area elements (since we need to get rid of primary frames in that case)
After that fixing focus handling, also remove support for <a> elements as synonyms to
Created attachment 570297 [details] [diff] [review]
Handle also name/id changes.
Uploaded to try
Comment on attachment 570297 [details] [diff] [review]
Why do we need to null-check mImageFrame in ParentChainChanged but not AttributeChanged?
r=me with those made consistent.
mImageFrame is null checked in both places.
*** Bug 712963 has been marked as a duplicate of this bug. ***