Patch from jst@citec.fi r=troy@netscape.com

Part of a fix for crash when expanding/collapsing toolbars. Change to
DeletingFrameSubtree() to make sure it examines the additional child
list as well as the principal child list

layout/base/nsCSSFrameConstructor.cpp

@@ -6724,59 +6724,67 @@ DeletingFrameSubtree(nsIPresContext*  aPresContext,
     aFrameManager->SetPrimaryFrameFor(content, nsnull);
     aFrameManager->ClearAllUndisplayedContentIn(content);
     
-    // Recursively walk aFrame's child frames looking for placeholder frames
-    nsIFrame* childFrame;
-    aFrame->FirstChild(nsnull, &childFrame);
-    while (childFrame) {
-      nsIAtom*  frameType;
-      PRBool    isPlaceholder;
-  
-      // See if it's a placeholder frame
-      childFrame->GetFrameType(&frameType);
-      isPlaceholder = (nsLayoutAtoms::placeholderFrame == frameType);
-      NS_IF_RELEASE(frameType);
-  
-      if (isPlaceholder) {
-        // Get the out-of-flow frame
-        nsIFrame* outOfFlowFrame = ((nsPlaceholderFrame*)childFrame)->GetOutOfFlowFrame();
-        NS_ASSERTION(outOfFlowFrame, "no out-of-flow frame");
-  
-        // Remove the mapping from the out-of-flow frame to its placeholder
-        aFrameManager->SetPlaceholderFrameFor(outOfFlowFrame, nsnull);
-        
-        // Recursively find and delete any of its out-of-flow frames, and remove
-        // the mapping from content objects to frames
-        DeletingFrameSubtree(aPresContext, aPresShell, aFrameManager, aRemovedFrame,
-                             outOfFlowFrame);
-        
-        // Don't delete the out-of-flow frame if aRemovedFrame is one of its
-        // ancestor frames, because when aRemovedFrame is deleted it will delete
-        // its child frames including this out-of-flow frame
-        if (!IsAncestorFrame(outOfFlowFrame, aRemovedFrame)) {
-          // Get the out-of-flow frame's parent
-          nsIFrame* parentFrame;
-          outOfFlowFrame->GetParent(&parentFrame);
-  
-          // Get the child list name for the out-of-flow frame
-          nsIAtom* listName;
-          GetChildListNameFor(parentFrame, outOfFlowFrame, &listName);
-  
-          // Ask the parent to delete the out-of-flow frame
-          aFrameManager->RemoveFrame(*aPresContext, *aPresShell, parentFrame,
-                                     listName, outOfFlowFrame);
-          NS_IF_RELEASE(listName);
+    nsIAtom*  childListName = nsnull;
+    PRInt32   childListIndex = 0;
+
+    do {
+      // Recursively walk aFrame's child frames looking for placeholder frames
+      nsIFrame* childFrame;
+      aFrame->FirstChild(childListName, &childFrame);
+      while (childFrame) {
+        nsIAtom*  frameType;
+        PRBool    isPlaceholder;
+    
+        // See if it's a placeholder frame
+        childFrame->GetFrameType(&frameType);
+        isPlaceholder = (nsLayoutAtoms::placeholderFrame == frameType);
+        NS_IF_RELEASE(frameType);
+    
+        if (isPlaceholder) {
+          // Get the out-of-flow frame
+          nsIFrame* outOfFlowFrame = ((nsPlaceholderFrame*)childFrame)->GetOutOfFlowFrame();
+          NS_ASSERTION(outOfFlowFrame, "no out-of-flow frame");
+    
+          // Remove the mapping from the out-of-flow frame to its placeholder
+          aFrameManager->SetPlaceholderFrameFor(outOfFlowFrame, nsnull);
+          
+          // Recursively find and delete any of its out-of-flow frames, and remove
+          // the mapping from content objects to frames
+          DeletingFrameSubtree(aPresContext, aPresShell, aFrameManager, aRemovedFrame,
+                               outOfFlowFrame);
+          
+          // Don't delete the out-of-flow frame if aRemovedFrame is one of its
+          // ancestor frames, because when aRemovedFrame is deleted it will delete
+          // its child frames including this out-of-flow frame
+          if (!IsAncestorFrame(outOfFlowFrame, aRemovedFrame)) {
+            // Get the out-of-flow frame's parent
+            nsIFrame* parentFrame;
+            outOfFlowFrame->GetParent(&parentFrame);
+    
+            // Get the child list name for the out-of-flow frame
+            nsIAtom* listName;
+            GetChildListNameFor(parentFrame, outOfFlowFrame, &listName);
+    
+            // Ask the parent to delete the out-of-flow frame
+            aFrameManager->RemoveFrame(*aPresContext, *aPresShell, parentFrame,
+                                       listName, outOfFlowFrame);
+            NS_IF_RELEASE(listName);
+          }
+    
+        } else {
+          // Recursively find and delete any of its out-of-flow frames, and remove
+          // the mapping from content objects to frames
+          DeletingFrameSubtree(aPresContext, aPresShell, aFrameManager, aRemovedFrame,
+                               childFrame);
         }
-  
-      } else {
-        // Recursively find and delete any of its out-of-flow frames, and remove
-        // the mapping from content objects to frames
-        DeletingFrameSubtree(aPresContext, aPresShell, aFrameManager, aRemovedFrame,
-                             childFrame);
+    
+        // Get the next sibling child frame
+        childFrame->GetNextSibling(&childFrame);
       }
-  
-      // Get the next sibling child frame
-      childFrame->GetNextSibling(&childFrame);
-    }
+
+      NS_IF_RELEASE(childListName);
+      aFrame->GetAdditionalChildListName(childListIndex++, &childListName);
+    } while (childListName);
   }
 
   return NS_OK;

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -6724,59 +6724,67 @@ DeletingFrameSubtree(nsIPresContext*  aPresContext,
     aFrameManager->SetPrimaryFrameFor(content, nsnull);
     aFrameManager->ClearAllUndisplayedContentIn(content);
     
-    // Recursively walk aFrame's child frames looking for placeholder frames
-    nsIFrame* childFrame;
-    aFrame->FirstChild(nsnull, &childFrame);
-    while (childFrame) {
-      nsIAtom*  frameType;
-      PRBool    isPlaceholder;
-  
-      // See if it's a placeholder frame
-      childFrame->GetFrameType(&frameType);
-      isPlaceholder = (nsLayoutAtoms::placeholderFrame == frameType);
-      NS_IF_RELEASE(frameType);
-  
-      if (isPlaceholder) {
-        // Get the out-of-flow frame
-        nsIFrame* outOfFlowFrame = ((nsPlaceholderFrame*)childFrame)->GetOutOfFlowFrame();
-        NS_ASSERTION(outOfFlowFrame, "no out-of-flow frame");
-  
-        // Remove the mapping from the out-of-flow frame to its placeholder
-        aFrameManager->SetPlaceholderFrameFor(outOfFlowFrame, nsnull);
-        
-        // Recursively find and delete any of its out-of-flow frames, and remove
-        // the mapping from content objects to frames
-        DeletingFrameSubtree(aPresContext, aPresShell, aFrameManager, aRemovedFrame,
-                             outOfFlowFrame);
-        
-        // Don't delete the out-of-flow frame if aRemovedFrame is one of its
-        // ancestor frames, because when aRemovedFrame is deleted it will delete
-        // its child frames including this out-of-flow frame
-        if (!IsAncestorFrame(outOfFlowFrame, aRemovedFrame)) {
-          // Get the out-of-flow frame's parent
-          nsIFrame* parentFrame;
-          outOfFlowFrame->GetParent(&parentFrame);
-  
-          // Get the child list name for the out-of-flow frame
-          nsIAtom* listName;
-          GetChildListNameFor(parentFrame, outOfFlowFrame, &listName);
-  
-          // Ask the parent to delete the out-of-flow frame
-          aFrameManager->RemoveFrame(*aPresContext, *aPresShell, parentFrame,
-                                     listName, outOfFlowFrame);
-          NS_IF_RELEASE(listName);
+    nsIAtom*  childListName = nsnull;
+    PRInt32   childListIndex = 0;
+
+    do {
+      // Recursively walk aFrame's child frames looking for placeholder frames
+      nsIFrame* childFrame;
+      aFrame->FirstChild(childListName, &childFrame);
+      while (childFrame) {
+        nsIAtom*  frameType;
+        PRBool    isPlaceholder;
+    
+        // See if it's a placeholder frame
+        childFrame->GetFrameType(&frameType);
+        isPlaceholder = (nsLayoutAtoms::placeholderFrame == frameType);
+        NS_IF_RELEASE(frameType);
+    
+        if (isPlaceholder) {
+          // Get the out-of-flow frame
+          nsIFrame* outOfFlowFrame = ((nsPlaceholderFrame*)childFrame)->GetOutOfFlowFrame();
+          NS_ASSERTION(outOfFlowFrame, "no out-of-flow frame");
+    
+          // Remove the mapping from the out-of-flow frame to its placeholder
+          aFrameManager->SetPlaceholderFrameFor(outOfFlowFrame, nsnull);
+          
+          // Recursively find and delete any of its out-of-flow frames, and remove
+          // the mapping from content objects to frames
+          DeletingFrameSubtree(aPresContext, aPresShell, aFrameManager, aRemovedFrame,
+                               outOfFlowFrame);
+          
+          // Don't delete the out-of-flow frame if aRemovedFrame is one of its
+          // ancestor frames, because when aRemovedFrame is deleted it will delete
+          // its child frames including this out-of-flow frame
+          if (!IsAncestorFrame(outOfFlowFrame, aRemovedFrame)) {
+            // Get the out-of-flow frame's parent
+            nsIFrame* parentFrame;
+            outOfFlowFrame->GetParent(&parentFrame);
+    
+            // Get the child list name for the out-of-flow frame
+            nsIAtom* listName;
+            GetChildListNameFor(parentFrame, outOfFlowFrame, &listName);
+    
+            // Ask the parent to delete the out-of-flow frame
+            aFrameManager->RemoveFrame(*aPresContext, *aPresShell, parentFrame,
+                                       listName, outOfFlowFrame);
+            NS_IF_RELEASE(listName);
+          }
+    
+        } else {
+          // Recursively find and delete any of its out-of-flow frames, and remove
+          // the mapping from content objects to frames
+          DeletingFrameSubtree(aPresContext, aPresShell, aFrameManager, aRemovedFrame,
+                               childFrame);
         }
-  
-      } else {
-        // Recursively find and delete any of its out-of-flow frames, and remove
-        // the mapping from content objects to frames
-        DeletingFrameSubtree(aPresContext, aPresShell, aFrameManager, aRemovedFrame,
-                             childFrame);
+    
+        // Get the next sibling child frame
+        childFrame->GetNextSibling(&childFrame);
       }
-  
-      // Get the next sibling child frame
-      childFrame->GetNextSibling(&childFrame);
-    }
+
+      NS_IF_RELEASE(childListName);
+      aFrame->GetAdditionalChildListName(childListIndex++, &childListName);
+    } while (childListName);
   }
 
   return NS_OK;