Add asserts to catch dangerous cases. Bug 398108, r+sr+a=dbaron

layout/base/nsCSSFrameConstructor.cpp

@@ -1864,6 +1864,9 @@ nsIXBLService * nsCSSFrameConstructor::GetXBLService()
 void
 nsCSSFrameConstructor::NotifyDestroyingFrame(nsIFrame* aFrame)
 {
+  NS_PRECONDITION(mUpdateCount != 0,
+                  "Should be in an update while destroying frames");
+
   if (aFrame->GetStateBits() & NS_FRAME_GENERATED_CONTENT) {
     if (mQuoteList.DestroyNodesFor(aFrame))
       QuotesDirty();
@@ -6672,6 +6675,9 @@ nsCSSFrameConstructor::InitAndRestoreFrame(const nsFrameConstructorState& aState
                                            nsIFrame*                aNewFrame,
                                            PRBool                   aAllowCounters)
 {
+  NS_PRECONDITION(mUpdateCount != 0,
+                  "Should be in an update while creating frames");
+  
   nsresult rv = NS_OK;
   
   NS_ASSERTION(aNewFrame, "Null frame cannot be initialized");
@@ -8445,6 +8451,9 @@ nsCSSFrameConstructor::ContentAppended(nsIContent*     aContainer,
                                        PRInt32         aNewIndexInContainer)
 {
   AUTO_LAYOUT_PHASE_ENTRY_POINT(mPresShell->GetPresContext(), FrameC);
+  NS_PRECONDITION(mUpdateCount != 0,
+                  "Should be in an update while creating frames");
+
 #ifdef DEBUG
   if (gNoisyContentUpdates) {
     printf("nsCSSFrameConstructor::ContentAppended container=%p index=%d\n",
@@ -8809,6 +8818,9 @@ nsCSSFrameConstructor::ContentInserted(nsIContent*            aContainer,
                                        nsILayoutHistoryState* aFrameState)
 {
   AUTO_LAYOUT_PHASE_ENTRY_POINT(mPresShell->GetPresContext(), FrameC);
+  NS_PRECONDITION(mUpdateCount != 0,
+                  "Should be in an update while creating frames");
+
   // XXXldb Do we need to re-resolve style to handle the CSS2 + combinator and
   // the :empty pseudo-class?
 #ifdef DEBUG
@@ -9375,6 +9387,9 @@ nsCSSFrameConstructor::ContentRemoved(nsIContent*     aContainer,
                                       PRBool          aInReinsertContent)
 {
   AUTO_LAYOUT_PHASE_ENTRY_POINT(mPresShell->GetPresContext(), FrameC);
+  NS_PRECONDITION(mUpdateCount != 0,
+                  "Should be in an update while destroying frames");
+
   // XXXldb Do we need to re-resolve style to handle the CSS2 + combinator and
   // the :empty pseudo-class?
 
@@ -13096,9 +13111,11 @@ nsCSSFrameConstructor::LazyGenerateChildrenEvent::Run()
     menuPopupFrame->SetGeneratedChildren();
 #endif
 
+    nsCSSFrameConstructor* fc = mPresShell->FrameConstructor();
+    fc->BeginUpdate();
+
     nsFrameItems childItems;
     nsFrameConstructorState state(mPresShell, nsnull, nsnull, nsnull);
-    nsCSSFrameConstructor* fc = mPresShell->FrameConstructor();
     nsresult rv = fc->ProcessChildren(state, mContent, frame, PR_FALSE,
                                       childItems, PR_FALSE);
     if (NS_FAILED(rv))
@@ -13108,6 +13125,8 @@ nsCSSFrameConstructor::LazyGenerateChildrenEvent::Run()
                               PR_FALSE, childItems);
     frame->SetInitialChildList(nsnull, childItems.childList);
 
+    fc->EndUpdate();
+
     if (mCallback)
       mCallback(mContent, frame, mArg);
 

layout/base/nsCSSFrameConstructor.h

@@ -1024,17 +1024,13 @@ private:
                         PRUint8&               aDisplay);
 
   void QuotesDirty() {
-    if (mUpdateCount != 0)
-      mQuotesDirty = PR_TRUE;
-    else
-      mQuoteList.RecalcAll();
+    NS_PRECONDITION(mUpdateCount != 0, "Instant quote updates are bad news");
+    mQuotesDirty = PR_TRUE;
   }
 
   void CountersDirty() {
-    if (mUpdateCount != 0)
-      mCountersDirty = PR_TRUE;
-    else
-      mCounterManager.RecalcAll();
+    NS_PRECONDITION(mUpdateCount != 0, "Instant counter updates are bad news");
+    mCountersDirty = PR_TRUE;
   }
 
 public:

layout/base/nsPresShell.cpp

@@ -2365,6 +2365,9 @@ PresShell::InitialReflow(nscoord aWidth, nscoord aHeight)
     MOZ_TIMER_RESET(mFrameCreationWatch);
     MOZ_TIMER_START(mFrameCreationWatch);
 
+    WillCauseReflow();
+    mFrameConstructor->BeginUpdate();
+
     if (!rootFrame) {
       // Have style sheet processor construct a frame for the
       // precursors to the root content object's frame
@@ -2384,6 +2387,9 @@ PresShell::InitialReflow(nscoord aWidth, nscoord aHeight)
     // Destroy() to get called, bug 337586.
     NS_ENSURE_STATE(!mHaveShutDown);
 
+    mFrameConstructor->EndUpdate();
+    DidCauseReflow();
+
     // Run the XBL binding constructors for any new frames we've constructed
     mDocument->BindingManager()->ProcessAttachedQueue();
 
@@ -6035,15 +6041,20 @@ void
 PresShell::WillDoReflow()
 {
   // We just reflowed, tell the caret that its frame might have moved.
+  // XXXbz that comment makes no sense
   if (mCaret) {
     mCaret->InvalidateOutsideCaret();
     mCaret->UpdateCaretPosition();
   }
+
+  mFrameConstructor->BeginUpdate();
 }
 
 void
 PresShell::DidDoReflow()
 {
+  mFrameConstructor->EndUpdate();
+  
   HandlePostedReflowCallbacks();
   // Null-check mViewManager in case this happens during Destroy.  See
   // bugs 244435 and 238546.