Bug 914029 - Fix Assertion failure. r=smaug

This commit is contained in:
Mina Almasry 2013-10-16 12:43:37 -04:00
Родитель d374e623da
Коммит 8f5ad0cbcc
3 изменённых файлов: 117 добавлений и 0 удалений

Просмотреть файл

@ -217,12 +217,47 @@ HTMLFieldSetElement::AddElement(nsGenericHTMLFormElement* aElement)
{
mDependentElements.AppendElement(aElement);
// If the element that we are adding aElement is a fieldset, then all the
// invalid elements in aElement are also invalid elements of this.
HTMLFieldSetElement* fieldSet = FromContent(aElement);
if (fieldSet) {
if (fieldSet->mInvalidElementsCount > 0) {
// The order we call UpdateValidity and adjust mInvalidElementsCount is
// important. We need to first call UpdateValidity in case
// mInvalidElementsCount was 0 before the call and will be incremented to
// 1 and so we need to change state to invalid. After that is done, we
// are free to increment mInvalidElementsCount to the correct amount.
UpdateValidity(false);
mInvalidElementsCount += fieldSet->mInvalidElementsCount - 1;
}
return;
}
// We need to update the validity of the fieldset.
nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(aElement);
if (cvElmt &&
cvElmt->IsCandidateForConstraintValidation() && !cvElmt->IsValid()) {
UpdateValidity(false);
}
#if DEBUG
int32_t debugInvalidElementsCount = 0;
for (uint32_t i = 0; i < mDependentElements.Length(); i++) {
HTMLFieldSetElement* fieldSet = FromContent(mDependentElements[i]);
if (fieldSet) {
debugInvalidElementsCount += fieldSet->mInvalidElementsCount;
continue;
}
nsCOMPtr<nsIConstraintValidation>
cvElmt = do_QueryObject(mDependentElements[i]);
if (cvElmt &&
cvElmt->IsCandidateForConstraintValidation() &&
!(cvElmt->IsValid())) {
debugInvalidElementsCount += 1;
}
}
MOZ_ASSERT(debugInvalidElementsCount == mInvalidElementsCount);
#endif
}
void
@ -230,12 +265,46 @@ HTMLFieldSetElement::RemoveElement(nsGenericHTMLFormElement* aElement)
{
mDependentElements.RemoveElement(aElement);
// If the element that we are removing aElement is a fieldset, then all the
// invalid elements in aElement are also removed from this.
HTMLFieldSetElement* fieldSet = FromContent(aElement);
if (fieldSet) {
if (fieldSet->mInvalidElementsCount > 0) {
// The order we update mInvalidElementsCount and call UpdateValidity is
// important. We need to first decrement mInvalidElementsCount and then
// call UpdateValidity, in case mInvalidElementsCount hits 0 in the call
// of UpdateValidity and we have to change state to valid.
mInvalidElementsCount -= fieldSet->mInvalidElementsCount - 1;
UpdateValidity(true);
}
return;
}
// We need to update the validity of the fieldset.
nsCOMPtr<nsIConstraintValidation> cvElmt = do_QueryObject(aElement);
if (cvElmt &&
cvElmt->IsCandidateForConstraintValidation() && !cvElmt->IsValid()) {
UpdateValidity(true);
}
#if DEBUG
int32_t debugInvalidElementsCount = 0;
for (uint32_t i = 0; i < mDependentElements.Length(); i++) {
HTMLFieldSetElement* fieldSet = FromContent(mDependentElements[i]);
if (fieldSet) {
debugInvalidElementsCount += fieldSet->mInvalidElementsCount;
continue;
}
nsCOMPtr<nsIConstraintValidation>
cvElmt = do_QueryObject(mDependentElements[i]);
if (cvElmt &&
cvElmt->IsCandidateForConstraintValidation() &&
!(cvElmt->IsValid())) {
debugInvalidElementsCount += 1;
}
}
MOZ_ASSERT(debugInvalidElementsCount == mInvalidElementsCount);
#endif
}
void

Просмотреть файл

@ -398,6 +398,7 @@ support-files =
[test_mod_attributes_reflection.html]
[test_mozaudiochannel.html]
[test_named_options.html]
[test_nested_invalid_fieldsets.html]
[test_object_attributes_reflection.html]
[test_object_plugin_nav.html]
[test_ol_attributes_reflection.html]

Просмотреть файл

@ -0,0 +1,47 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=914029
-->
<head>
<meta charset="utf-8">
<title>Test for Bug 914029</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<script type="application/javascript">
/** Test for Bug 914029 **/
var innerFieldset = document.createElement("fieldset");
var outerFieldset = document.createElement("fieldset");
var textarea = document.createElement("textarea");
textarea.setAttribute("required", "");
innerFieldset.appendChild(textarea);
outerFieldset.appendChild(innerFieldset);
SpecialPowers.forceGC();
ok(true, "This page did not crash - dynamically added nested invalid fieldsets" +
" work correctly.");
var innerFieldset = document.createElement("fieldset");
var outerFieldset = document.createElement("fieldset");
var textarea = document.createElement("textarea");
var textarea2 = document.createElement("textarea");
textarea.setAttribute("required", "");
innerFieldset.appendChild(textarea);
innerFieldset.appendChild(textarea2);
outerFieldset.appendChild(innerFieldset);
SpecialPowers.forceGC();
ok(true, "This page did not crash - dynamically added nested invalid fieldsets" +
" work correctly.");
</script>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=914029">Mozilla Bug 914029</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
</pre>
</body>
</html>