зеркало из https://github.com/mozilla/gecko-dev.git
Fix crashes when dynamically removing input type=file elements by not calling GetValue() during Destroy() since that re-adds the frame to the primary frame map. Bug 203041, 238906, patch originally by mats.palmgren@bredband.net, updated by me, r+sr=bzbarsky.
This commit is contained in:
bryner%brianryner.com
Родитель
6481991845
Коммит
033c0812b5
|
|
@ -97,7 +97,8 @@ NS_NewFileControlFrame(nsIPresShell* aPresShell, nsIFrame** aNewFrame)
|
|||
|
||||
nsFileControlFrame::nsFileControlFrame():
|
||||
mTextFrame(nsnull),
|
||||
mCachedState(nsnull)
|
||||
mCachedState(nsnull),
|
||||
mDidPreDestroy(PR_FALSE)
|
||||
{
|
||||
//Shrink the area around it's contents
|
||||
SetFlags(NS_BLOCK_SHRINK_WRAP);
|
||||
|
|
@ -117,8 +118,8 @@ nsFileControlFrame::~nsFileControlFrame()
|
|||
}
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
|
||||
void
|
||||
nsFileControlFrame::PreDestroy(nsIPresContext* aPresContext)
|
||||
{
|
||||
// Toss the value into the control from the anonymous content, which is about
|
||||
// to get lost.
|
||||
|
|
@ -131,10 +132,32 @@ nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
|
|||
nsCOMPtr<nsITextControlElement> fileInput = do_QueryInterface(mContent);
|
||||
fileInput->TakeTextFrameValue(value);
|
||||
}
|
||||
mDidPreDestroy = PR_TRUE;
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
|
||||
{
|
||||
if (!mDidPreDestroy) {
|
||||
PreDestroy(aPresContext);
|
||||
}
|
||||
mTextFrame = nsnull;
|
||||
return nsAreaFrame::Destroy(aPresContext);
|
||||
}
|
||||
|
||||
void
|
||||
nsFileControlFrame::RemovedAsPrimaryFrame(nsIPresContext* aPresContext)
|
||||
{
|
||||
if (!mDidPreDestroy) {
|
||||
PreDestroy(aPresContext);
|
||||
}
|
||||
#ifdef DEBUG
|
||||
else {
|
||||
NS_ERROR("RemovedAsPrimaryFrame called after PreDestroy");
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
|
||||
nsISupportsArray& aChildList)
|
||||
|
|
|
|||
|
|
@ -88,6 +88,9 @@ public:
|
|||
nsHTMLReflowMetrics& aDesiredSize,
|
||||
const nsHTMLReflowState& aReflowState,
|
||||
nsReflowStatus& aStatus);
|
||||
|
||||
virtual void RemovedAsPrimaryFrame(nsIPresContext* aPresContext);
|
||||
|
||||
NS_IMETHOD Destroy(nsIPresContext *aPresContext);
|
||||
|
||||
#ifdef NS_DEBUG
|
||||
|
|
@ -226,8 +229,16 @@ private:
|
|||
void SyncAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
|
||||
PRBool aWhichControls);
|
||||
|
||||
/**
|
||||
* We call this when we are being destroyed or removed from the PFM.
|
||||
* @param aPresContext the current pres context
|
||||
*/
|
||||
void PreDestroy(nsIPresContext* aPresContext);
|
||||
|
||||
NS_IMETHOD_(nsrefcnt) AddRef() { return NS_OK; }
|
||||
NS_IMETHOD_(nsrefcnt) Release() { return NS_OK; }
|
||||
|
||||
PRBool mDidPreDestroy; // has PreDestroy been called
|
||||
};
|
||||
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -97,7 +97,8 @@ NS_NewFileControlFrame(nsIPresShell* aPresShell, nsIFrame** aNewFrame)
|
|||
|
||||
nsFileControlFrame::nsFileControlFrame():
|
||||
mTextFrame(nsnull),
|
||||
mCachedState(nsnull)
|
||||
mCachedState(nsnull),
|
||||
mDidPreDestroy(PR_FALSE)
|
||||
{
|
||||
//Shrink the area around it's contents
|
||||
SetFlags(NS_BLOCK_SHRINK_WRAP);
|
||||
|
|
@ -117,8 +118,8 @@ nsFileControlFrame::~nsFileControlFrame()
|
|||
}
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
|
||||
void
|
||||
nsFileControlFrame::PreDestroy(nsIPresContext* aPresContext)
|
||||
{
|
||||
// Toss the value into the control from the anonymous content, which is about
|
||||
// to get lost.
|
||||
|
|
@ -131,10 +132,32 @@ nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
|
|||
nsCOMPtr<nsITextControlElement> fileInput = do_QueryInterface(mContent);
|
||||
fileInput->TakeTextFrameValue(value);
|
||||
}
|
||||
mDidPreDestroy = PR_TRUE;
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsFileControlFrame::Destroy(nsIPresContext* aPresContext)
|
||||
{
|
||||
if (!mDidPreDestroy) {
|
||||
PreDestroy(aPresContext);
|
||||
}
|
||||
mTextFrame = nsnull;
|
||||
return nsAreaFrame::Destroy(aPresContext);
|
||||
}
|
||||
|
||||
void
|
||||
nsFileControlFrame::RemovedAsPrimaryFrame(nsIPresContext* aPresContext)
|
||||
{
|
||||
if (!mDidPreDestroy) {
|
||||
PreDestroy(aPresContext);
|
||||
}
|
||||
#ifdef DEBUG
|
||||
else {
|
||||
NS_ERROR("RemovedAsPrimaryFrame called after PreDestroy");
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
NS_IMETHODIMP
|
||||
nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
|
||||
nsISupportsArray& aChildList)
|
||||
|
|
|
|||
|
|
@ -88,6 +88,9 @@ public:
|
|||
nsHTMLReflowMetrics& aDesiredSize,
|
||||
const nsHTMLReflowState& aReflowState,
|
||||
nsReflowStatus& aStatus);
|
||||
|
||||
virtual void RemovedAsPrimaryFrame(nsIPresContext* aPresContext);
|
||||
|
||||
NS_IMETHOD Destroy(nsIPresContext *aPresContext);
|
||||
|
||||
#ifdef NS_DEBUG
|
||||
|
|
@ -226,8 +229,16 @@ private:
|
|||
void SyncAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute,
|
||||
PRBool aWhichControls);
|
||||
|
||||
/**
|
||||
* We call this when we are being destroyed or removed from the PFM.
|
||||
* @param aPresContext the current pres context
|
||||
*/
|
||||
void PreDestroy(nsIPresContext* aPresContext);
|
||||
|
||||
NS_IMETHOD_(nsrefcnt) AddRef() { return NS_OK; }
|
||||
NS_IMETHOD_(nsrefcnt) Release() { return NS_OK; }
|
||||
|
||||
PRBool mDidPreDestroy; // has PreDestroy been called
|
||||
};
|
||||
|
||||
#endif
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче