Backed out changeset 34f280f8fea5 (bug 849524) for crashes on a CLOSED TREE

content/html/content/src/nsHTMLInputElement.cpp

@@ -2599,9 +2599,11 @@ nsHTMLInputElement::SetValueOfRangeForUserEvent(double aValue)
   nsAutoString val;
   ConvertNumberToString(aValue, val);
   SetValueInternal(val, true, true);
-  nsRangeFrame* frame = do_QueryFrame(GetPrimaryFrame());
+  nsIFrame* frame = GetPrimaryFrame();
   if (frame) {
-    frame->UpdateThumbPositionForValueChange();
+    // Trigger reflow to update the position of the thumb:
+    frame->PresContext()->GetPresShell()->
+      FrameNeedsReflow(frame, nsIPresShell::eResize, NS_FRAME_IS_DIRTY);
   }
 }
 

layout/forms/nsRangeFrame.cpp

@@ -378,34 +378,6 @@ nsRangeFrame::GetValueAtEventPoint(nsGUIEvent* aEvent)
   return minimum + (double(contentPoint.x) / double(contentRect.width)) * range;
 }
 
-void
-nsRangeFrame::UpdateThumbPositionForValueChange()
-{
-  if (NS_SUBTREE_DIRTY(this)) {
-    return; // we're going to be updated when we reflow
-  }
-  nsIFrame* thumbFrame = mThumbDiv->GetPrimaryFrame();
-  if (!thumbFrame) {
-    return; // diplay:none?
-  }
-  // TODO in bug 842179 - factor out duplication here and in Reflow.
-  double fraction = GetValueAsFractionOfRange();
-  nsRect contentRect = GetContentRectRelativeToSelf();
-  nsMargin borderAndPadding = GetUsedBorderAndPadding();
-  nsSize thumbSize = thumbFrame->GetSize();
-  nsPoint newPosition(borderAndPadding.left, borderAndPadding.top);
-  if (IsHorizontal()) {
-    newPosition += nsPoint(NSToCoordRound(fraction * contentRect.width) -
-                             thumbSize.width/2,
-                           (contentRect.height - thumbSize.height)/2);
-  } else {
-    newPosition += nsPoint((contentRect.width - thumbSize.width)/2,
-                           NSToCoordRound(fraction * contentRect.height) -
-                             thumbSize.height/2);
-  }
-  thumbFrame->SetPosition(newPosition);
-  SchedulePaint();
-}
 
 NS_IMETHODIMP
 nsRangeFrame::AttributeChanged(int32_t  aNameSpaceID,
@@ -420,7 +392,19 @@ nsRangeFrame::AttributeChanged(int32_t  aNameSpaceID,
        aAttribute == nsGkAtoms::min ||
        aAttribute == nsGkAtoms::max ||
        aAttribute == nsGkAtoms::step)) {
-    UpdateThumbPositionForValueChange();
+    nsIFrame* trackFrame = mTrackDiv->GetPrimaryFrame();
+    if (trackFrame) { // diplay:none?
+      PresContext()->PresShell()->FrameNeedsReflow(trackFrame,
+                                                   nsIPresShell::eResize,
+                                                   NS_FRAME_IS_DIRTY);
+    }
+
+    nsIFrame* thumbFrame = mThumbDiv->GetPrimaryFrame();
+    if (thumbFrame) { // diplay:none?
+      PresContext()->PresShell()->FrameNeedsReflow(thumbFrame,
+                                                   nsIPresShell::eResize,
+                                                   NS_FRAME_IS_DIRTY);
+    }
   }
 
   return nsContainerFrame::AttributeChanged(aNameSpaceID, aAttribute, aModType);

layout/forms/nsRangeFrame.h

@@ -92,13 +92,6 @@ public:
 
   double GetValueAtEventPoint(nsGUIEvent* aEvent);
 
-  /**
-   * Helper to reposition the thumb and schedule a repaint when the value of
-   * the range changes. (This does not reflow, since the position and size of
-   * the thumb do not affect the position or size of any other frames.)
-   */
-  void UpdateThumbPositionForValueChange();
-
 private:
 
   // Helper function which reflows the anonymous div frames.