Merge roc-1.bundle to land 5 patches for roc.

layout/base/crashtests/454751-1.xul

@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="addStyleSheet('window { display: table; }');">
+
+<script type="text/javascript">
+
+function addStyleSheet(text)
+{
+  var sheet = document.createElementNS("http://www.w3.org/1999/xhtml", "style");
+  sheet.appendChild(document.createTextNode(text));
+  document.documentElement.appendChild(sheet);
+}
+
+</script>
+
+<treecols/>
+
+</window>

layout/base/crashtests/crashtests.list

@@ -125,6 +125,7 @@ load 429088-2.html
 load 432752-1.svg
 load 433450-1.html
 load 444925-1.xul
+load 454751-1.xul
 load 455063-1.html
 load 455063-2.html
 load 455063-3.html

layout/base/nsCSSFrameConstructor.cpp

@@ -7683,20 +7683,27 @@ nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal()
             return rv;
           }
         }
-        
-        mInitialContainingBlock = nsnull;
-        mRootElementStyleFrame = nsnull;
+      }
+    }
+    
+    if (rootContent && NS_SUCCEEDED(rv)) {
+      mInitialContainingBlock = nsnull;
+      mRootElementStyleFrame = nsnull;
 
-        // Create the new document element hierarchy
-        nsIFrame* newChild;
-        rv = ConstructDocElementFrame(state, rootContent,
-                                      mDocElementContainingBlock, &newChild);
+      // We don't reuse the old frame constructor state because,
+      // for example, its mPopupItems may be stale
+      nsFrameConstructorState state(mPresShell, mFixedContainingBlock,
+                                    nsnull, nsnull, mTempFrameTreeState);
 
-        // newChild could be null even if |rv| is success, thanks to XBL.
-        if (NS_SUCCEEDED(rv) && newChild) {
-          rv = state.mFrameManager->InsertFrames(mDocElementContainingBlock,
-                                                 nsnull, nsnull, newChild);
-        }
+      // Create the new document element hierarchy
+      nsIFrame* newChild;
+      rv = ConstructDocElementFrame(state, rootContent,
+                                    mDocElementContainingBlock, &newChild);
+
+      // newChild could be null even if |rv| is success, thanks to XBL.
+      if (NS_SUCCEEDED(rv) && newChild) {
+        rv = state.mFrameManager->InsertFrames(mDocElementContainingBlock,
+                                               nsnull, nsnull, newChild);
       }
     }
   }
@@ -11102,6 +11109,13 @@ nsCSSFrameConstructor::RecreateFramesForContent(nsIContent* aContent)
     }
   }
 
+  if (frame) {
+    nsIFrame* nonGeneratedAncestor = nsLayoutUtils::GetNonGeneratedAncestor(frame);
+    if (nonGeneratedAncestor->GetContent() != aContent) {
+      return RecreateFramesForContent(nonGeneratedAncestor->GetContent());
+    }
+  }
+
   nsresult rv = NS_OK;
 
   if (frame && MaybeRecreateContainerForIBSplitterFrame(frame, &rv)) {

layout/base/nsCSSRendering.cpp

@@ -1518,8 +1518,7 @@ nsCSSRendering::PaintBackgroundWithSC(nsPresContext* aPresContext,
   }
 
   nsRect destArea(imageTopLeft + aBorderArea.TopLeft(), imageSize);
-  nsRect fillArea;
-  fillArea.IntersectRect(destArea, bgClipArea);
+  nsRect fillArea = destArea;
   if (repeat & NS_STYLE_BG_REPEAT_X) {
     fillArea.x = bgClipArea.x;
     fillArea.width = bgClipArea.width;
@@ -1528,6 +1527,7 @@ nsCSSRendering::PaintBackgroundWithSC(nsPresContext* aPresContext,
     fillArea.y = bgClipArea.y;
     fillArea.height = bgClipArea.height;
   }
+  fillArea.IntersectRect(fillArea, bgClipArea);
 
   nsLayoutUtils::DrawImage(&aRenderingContext, image,
       destArea, fillArea, anchor + aBorderArea.TopLeft(), dirtyRect);

layout/base/nsLayoutUtils.cpp

@@ -1552,6 +1552,20 @@ nsLayoutUtils::FindNearestBlockAncestor(nsIFrame* aFrame)
   return nsnull;
 }
 
+nsIFrame*
+nsLayoutUtils::GetNonGeneratedAncestor(nsIFrame* aFrame)
+{
+  if (!(aFrame->GetStateBits() & NS_FRAME_GENERATED_CONTENT))
+    return aFrame;
+
+  nsFrameManager* frameManager = aFrame->PresContext()->FrameManager();
+  nsIFrame* f = aFrame;
+  do {
+    f = GetParentOrPlaceholderFor(frameManager, f);
+  } while (f->GetStateBits() & NS_FRAME_GENERATED_CONTENT);
+  return f;
+}
+
 nsIFrame*
 nsLayoutUtils::GetParentOrPlaceholderFor(nsFrameManager* aFrameManager,
                                          nsIFrame* aFrame)

layout/base/nsLayoutUtils.h

@@ -622,6 +622,12 @@ public:
    */
   static nsBlockFrame* FindNearestBlockAncestor(nsIFrame* aFrame);
 
+  /**
+   * Find the nearest ancestor that's not for generated content. Will return
+   * aFrame if aFrame is not for generated content.
+   */
+  static nsIFrame* GetNonGeneratedAncestor(nsIFrame* aFrame);
+
   /**
    * Cast aFrame to an nsBlockFrame* or return null if it's not
    * an nsBlockFrame.

layout/generic/nsTextFrameThebes.cpp

@@ -2995,13 +2995,6 @@ nsTextPaintStyle::InitCommonColors()
   mInitCommonColors = PR_TRUE;
 }
 
-static nsIFrame* GetNonGeneratedAncestor(nsIFrame* f) {
-  while (f->GetStateBits() & NS_FRAME_GENERATED_CONTENT) {
-    f = nsLayoutUtils::GetParentOrPlaceholderFor(f->PresContext()->FrameManager(), f);
-  }
-  return f;
-}
-
 static nsIContent*
 FindElementAncestor(nsINode* aNode)
 {
@@ -3029,7 +3022,7 @@ nsTextPaintStyle::InitSelectionColors()
 
   mInitSelectionColors = PR_TRUE;
 
-  nsIFrame* nonGeneratedAncestor = GetNonGeneratedAncestor(mFrame);
+  nsIFrame* nonGeneratedAncestor = nsLayoutUtils::GetNonGeneratedAncestor(mFrame);
   nsIContent* selectionContent = FindElementAncestor(nonGeneratedAncestor->GetContent());
 
   if (selectionContent &&
@@ -4419,7 +4412,7 @@ nsTextFrame::PaintText(nsIRenderingContext* aRenderingContext, nsPoint aPt,
   }
 
   // Fork off to the (slower) paint-with-selection path if necessary.
-  if (GetNonGeneratedAncestor(this)->GetStateBits() & NS_FRAME_SELECTED_CONTENT) {
+  if (nsLayoutUtils::GetNonGeneratedAncestor(this)->GetStateBits() & NS_FRAME_SELECTED_CONTENT) {
     if (PaintTextWithSelection(ctx, framePt, textBaselinePt,
                                dirtyRect, provider, textPaintStyle))
       return;
@@ -5279,8 +5272,6 @@ nsTextFrame::AddInlineMinWidthForFlow(nsIRenderingContext *aRenderingContext,
   gfxFloat tabWidth = -1;
   PRUint32 start =
     FindStartAfterSkippingWhitespace(&provider, aData, textStyle, &iter, flowEndInTextRun);
-  if (start >= flowEndInTextRun)
-    return;
 
   // XXX Should we consider hyphenation here?
   for (PRUint32 i = start, wordStart = start; i <= flowEndInTextRun; ++i) {
@@ -5342,11 +5333,13 @@ nsTextFrame::AddInlineMinWidthForFlow(nsIRenderingContext *aRenderingContext,
     }
   }
 
-  // Check if we have collapsible whitespace at the end
-  aData->skipWhitespace =
-    IsTrimmableSpace(provider.GetFragment(),
-                     iter.ConvertSkippedToOriginal(flowEndInTextRun - 1),
-                     textStyle);
+  if (start < flowEndInTextRun) {
+    // Check if we have collapsible whitespace at the end
+    aData->skipWhitespace =
+      IsTrimmableSpace(provider.GetFragment(),
+                       iter.ConvertSkippedToOriginal(flowEndInTextRun - 1),
+                       textStyle);
+  }
 }
 
 // XXX Need to do something here to avoid incremental reflow bugs due to
@@ -5398,8 +5391,6 @@ nsTextFrame::AddInlinePrefWidthForFlow(nsIRenderingContext *aRenderingContext,
   gfxFloat tabWidth = -1;
   PRUint32 start =
     FindStartAfterSkippingWhitespace(&provider, aData, textStyle, &iter, flowEndInTextRun);
-  if (start >= flowEndInTextRun)
-    return;
 
   // XXX Should we consider hyphenation here?
   // If newlines and tabs aren't preformatted, nothing to do inside
@@ -5458,10 +5449,12 @@ nsTextFrame::AddInlinePrefWidthForFlow(nsIRenderingContext *aRenderingContext,
   }
 
   // Check if we have collapsible whitespace at the end
-  aData->skipWhitespace =
-    IsTrimmableSpace(provider.GetFragment(),
-                     iter.ConvertSkippedToOriginal(flowEndInTextRun - 1),
-                     textStyle);
+  if (start < flowEndInTextRun) {
+    aData->skipWhitespace =
+      IsTrimmableSpace(provider.GetFragment(),
+                       iter.ConvertSkippedToOriginal(flowEndInTextRun - 1),
+                       textStyle);
+  }
 }
 
 // XXX Need to do something here to avoid incremental reflow bugs due to

layout/reftests/bugs/444375-1-ref.html

@@ -0,0 +1,15 @@
+<html>
+<head>
+<style>
+span {
+  font-size: 200%;
+}
+img {
+  width: 100px; 
+  height: 100px;
+}
+</style>
+</head>
+<body style="width: 150px; border: 1px solid black; white-space:pre;"><table><tbody><tr><td><img>
+<span><img></span></td></tr></tbody></table></body>
+</html>

layout/reftests/bugs/444375-1.html

@@ -0,0 +1,16 @@
+<html>
+<head>
+<style>
+span {
+  font-size: 200%;
+}
+img {
+  width: 100px; 
+  height: 100px;
+}
+</style>
+</head>
+<body style="width: 150px; border: 1px solid black;">
+<table><tbody><tr><td><img> <span> <img></span></td></tr></tbody></table>
+</body>
+</html>

layout/reftests/bugs/460012-1-ref.html

@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<div><span style="border:1px solid red">Y</span></div>
+</body>
+</html>

layout/reftests/bugs/460012-1.html

@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<style>
+div:after { content: 'X'; border:1px solid red; }
+div.foo:after { content: 'Y'; }
+</style>
+</head>
+<body>
+<div id="d"></div>
+<script>
+document.body.offsetTop;
+document.getElementById("d").setAttribute("class", "foo");
+</script>
+</body>
+</html>

layout/reftests/bugs/463952-1-ref.html

@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<div style="background: url(square-outline-32x32.png) repeat-x; width:200px; height:100px;"></div>
+</body>
+</html>

layout/reftests/bugs/463952-1.html

@@ -0,0 +1,11 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<table style="width:200px;" cellpadding="0" cellspacing="0">
+  <tr style="background: url(square-outline-32x32.png) repeat-x;">
+    <td style="height:100px;">
+    <td>
+  </tr>
+</table>
+</body>
+</html>

layout/reftests/bugs/reftest.list

@@ -915,6 +915,7 @@ random == 429849-1.html 429849-1-ref.html # bug 432288
 fails == 441259-2.html 441259-2-ref.html # bug 441400
 == 442542-1.html 442542-1-ref.html
 == 444015-1.html 444015-1-ref.html
+== 444375-1.html 444375-1-ref.html
 == 444928-1.html 444928-1-ref.html
 == 444928-2.html 444928-2-ref.html
 != 444928-3.html 444928-3-notref.html
@@ -963,6 +964,7 @@ fails-if(MOZ_WIDGET_TOOLKIT=="cocoa") == 456147.xul 456147-ref.html # bug 456147
 == 458487-4c.html 458487-4-ref.html
 == 458487-5a.html 458487-5-ref.html
 == 458487-5b.html 458487-5-ref.html
+== 460012-1.html 460012-1-ref.html
 == 461266-1.html 461266-1-ref.html
 fails == 461512-1.html 461512-1-ref.html # Bug 461512
 == 462844-1.html 462844-ref.html
@@ -971,4 +973,5 @@ fails == 461512-1.html 461512-1-ref.html # Bug 461512
 == 462844-4.html 462844-ref.html
 == 463204-1.html 463204-1-ref.html
 == 463217-1.xul 463217-1-ref.xul
+== 463952-1.html 463952-1-ref.html
 == 464811-1.html 464811-1-ref.html

view/src/nsViewManager.cpp

@@ -894,28 +894,12 @@ NS_IMETHODIMP nsViewManager::UpdateView(nsIView *aView, const nsRect &aRect, PRU
     return NS_OK;
   }
 
-  // if this is a floating view, it isn't covered by any widgets other than
-  // its children. In that case we walk up to its parent widget and use
-  // that as the root to update from. This also means we update areas that
-  // may be outside the parent view(s), which is necessary for floats.
-  if (view->GetFloating()) {
-    nsView* widgetParent = view;
-
-    while (!widgetParent->HasWidget()) {
-      widgetParent->ConvertToParentCoords(&damagedRect.x, &damagedRect.y);
-      widgetParent = widgetParent->GetParent();
-    }
-
-    UpdateWidgetArea(widgetParent, nsRegion(damagedRect), nsnull);
-  } else {
-    // Propagate the update to the root widget of the root view manager, since
-    // iframes, for example, can overlap each other and be translucent.  So we
-    // have to possibly invalidate our rect in each of the widgets we have
-    // lying about.
-    damagedRect.MoveBy(ComputeViewOffset(view));
-
-    UpdateWidgetArea(RootViewManager()->GetRootView(), nsRegion(damagedRect), nsnull);
-  }
+  nsView* displayRoot = GetDisplayRootFor(view);
+  // Propagate the update to the displayRoot, since iframes, for example,
+  // can overlap each other and be translucent.  So we have to possibly
+  // invalidate our rect in each of the widgets we have lying about.
+  damagedRect.MoveBy(view->GetOffsetTo(displayRoot));
+  UpdateWidgetArea(displayRoot, nsRegion(damagedRect), nsnull);
 
   RootViewManager()->IncrementUpdateCount();
 
@@ -2029,29 +2013,6 @@ NS_IMETHODIMP nsViewManager::ForceUpdate()
   return NS_OK;
 }
 
-nsPoint nsViewManager::ComputeViewOffset(const nsView *aView)
-{
-  NS_PRECONDITION(aView, "Null view in ComputeViewOffset?");
-  
-  nsPoint origin(0, 0);
-#ifdef DEBUG
-  const nsView* rootView;
-  const nsView* origView = aView;
-#endif
-
-  while (aView) {
-#ifdef DEBUG
-    rootView = aView;
-#endif
-    origin += aView->GetPosition();
-    aView = aView->GetParent();
-  }
-  NS_ASSERTION(rootView ==
-               origView->GetViewManager()->RootViewManager()->GetRootView(),
-               "Unexpected root view");
-  return origin;
-}
-
 void nsViewManager::ViewToWidget(nsView *aView, nsView* aWidgetView, nsRect &aRect) const
 {
   while (aView != aWidgetView) {

view/src/nsViewManager.h

@@ -416,11 +416,6 @@ public: // NOT in nsIViewManager, so private to the view module
 
   nsresult CreateRegion(nsIRegion* *result);
 
-  // return the sum of all view offsets from aView right up to the
-  // root of this view hierarchy (the view with no parent, which might
-  // not be in this view manager).
-  static nsPoint ComputeViewOffset(const nsView *aView);
-
   PRBool IsRefreshEnabled() { return RootViewManager()->mRefreshEnabled; }
 
   nsIViewObserver* GetViewObserver() { return mObserver; }