Bug 592698. We might not have a presshell by this point, so null-check it. r=dbaron

2010-09-15 12:40:11 -07:00 · 2010-09-15 12:40:11 -07:00 · 840fa6f0e1
--- a/layout/style/crashtests/592698-1.html
+++ b/layout/style/crashtests/592698-1.html
@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <iframe id="x"
+          src="data:text/html;charset=utf-8,%3Cdiv%20id%3D%22a%22%3Eaaa"></iframe>
+
+  <script>
+    window.onload = function() {
+      window.frames[0].document.getElementById("a").setAttribute("style",
+        '-moz-transition-property: color;' +
+        '-moz-transition-duration: 10s;' +
+        'transition-property: color;' +
+        'transition-duration: 10s; ' +
+        'color: red;');
+
+      // And start the transition
+      window.frames[0].document.documentElement.getBoundingClientRect();
+
+      // Now kill off the presshell
+      var frame = document.getElementById("x");
+      frame.style.display = "none";
+      document.documentElement.getBoundingClientRect();
+
+      // And wait for the refresh driver to fire
+      setTimeout(function() {
+          document.documentElement.className = "";
+      }, 100);
+    }
+  </script>
+</html>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@ -60,3 +60,4 @@ load 558943-1.xhtml
 load 571105-1.xhtml
 load 573127-1.html
 load 580685.html
+load 592698-1.html
--- a/layout/style/nsTransitionManager.cpp
+++ b/layout/style/nsTransitionManager.cpp
@ -279,13 +279,19 @@ void
 nsTransitionManager::Disconnect()
 {
  // Content nodes might outlive the transition manager.
+  RemoveAllTransitions();
+
+  mPresContext = nsnull;
+}
+
+void
+nsTransitionManager::RemoveAllTransitions()
+{
  while (!PR_CLIST_IS_EMPTY(&mElementTransitions)) {
    ElementTransitions *head = static_cast<ElementTransitions*>(
                                 PR_LIST_HEAD(&mElementTransitions));
    head->Destroy();
  }
-
-  mPresContext = nsnull;
 }

 static PRBool
@ -868,6 +874,14 @@ nsTransitionManager::WillRefresh(mozilla::TimeStamp aTime)
  NS_ABORT_IF_FALSE(mPresContext,
                    "refresh driver should not notify additional observers "
                    "after pres context has been destroyed");
+  if (!mPresContext->GetPresShell()) {
+    // Someone might be keeping mPresContext alive past the point
+    // where it has been torn down; don't bother doing anything in
+    // this case.  But do get rid of all our transitions so we stop
+    // triggering refreshes.
+    RemoveAllTransitions();
+    return;
+  }

  nsTArray<TransitionEventInfo> events;

--- a/layout/style/nsTransitionManager.h
+++ b/layout/style/nsTransitionManager.h
@ -122,6 +122,8 @@ private:
  void WalkTransitionRule(RuleProcessorData* aData,
                          nsCSSPseudoElements::Type aPseudoType);

+  void RemoveAllTransitions();
+
  PRCList mElementTransitions;
  nsPresContext *mPresContext; // weak (non-null from ctor to Disconnect)
 };