dom table methods, moved align="char" data members from nsReflowState to nsHTMLReflowState

content/html/content/src/GenericElementCollection.cpp

@@ -27,6 +27,7 @@ GenericElementCollection::GenericElementCollection(nsIContent *aParent,
 {
   mParent = aParent;
   mTag = aTag;
+  NS_IF_ADDREF(mTag);
 }
 
 GenericElementCollection::~GenericElementCollection()

content/html/content/src/nsHTMLTableCellElement.cpp

@@ -211,13 +211,15 @@ nsHTMLTableCellElement::GetCellIndex(PRInt32* aCellIndex)
   row->GetCells(&cells);
   PRUint32 numCells;
   cells->GetLength(&numCells);
-  for (PRUint32 i = 0; i < numCells; i++) {
+  PRBool found = PR_FALSE;
+  for (PRUint32 i = 0; (i < numCells) && !found; i++) {
     nsIDOMNode *node = nsnull;
     cells->Item(i, &node);
     if (this == node) {
       *aCellIndex = i;
-      break;
+	  found = PR_TRUE;
     }
+	NS_IF_RELEASE(node);
   }
   NS_RELEASE(cells);
   NS_RELEASE(row);
@@ -229,35 +231,39 @@ NS_IMETHODIMP
 nsHTMLTableCellElement::SetCellIndex(PRInt32 aCellIndex)
 {
   PRInt32 oldIndex;
-  GetCellIndex(&oldIndex);
-  if (oldIndex == aCellIndex) {        // no change in index, don't do anything
+  nsresult result = GetCellIndex(&oldIndex);
+  if ((-1 == oldIndex) || (oldIndex == aCellIndex) || (NS_OK != result)) {
     return NS_OK;
   }
 
   nsIDOMHTMLTableRowElement* row = nsnull;
   GetRow(&row);
-
-  row->DeleteCell(oldIndex);       // delete this from the row
-
   nsIDOMHTMLCollection *cells = nsnull;
   row->GetCells(&cells);
-  PRUint32 numCells;
-  cells->GetLength(&numCells);
-  nsIDOMNode *returnNode;
-  if (numCells <= 0) {
-    row->AppendChild(this, &returnNode); // add this back into the row
-  } else {
-    PRInt32 newIndex = oldIndex;
-    if (aCellIndex <= 0) {
-      newIndex = 0;
-    } else if ((PRUint32)aCellIndex >= numCells) {
-      newIndex = numCells - 1;
-    } else if (aCellIndex > oldIndex) {
-      newIndex--;                   // since this got removed before GetLength was called
-    }
-    nsIDOMNode *refNode;
-    cells->Item(newIndex, &refNode);
-    row->InsertBefore(this, refNode, &returnNode); // add this back into the row
+  PRUint32 numCellsU;
+  cells->GetLength(&numCellsU);
+  PRInt32 numCells = numCellsU;
+
+  // check if it really moves
+  if ( !(((0 == oldIndex) && (aCellIndex <= 0)) || ((numCells-1 == oldIndex) && (aCellIndex >= numCells-1)))) {
+    AddRef(); // don't use NS_ADDREF_THIS
+    row->DeleteCell(oldIndex);       // delete this from the row
+    numCells--;
+    nsIDOMNode *returnNode;
+    if ((numCells <= 0) || (aCellIndex >= numCells)) {
+      row->AppendChild(this, &returnNode); // add this back into the row
+		} else {
+      PRInt32 newIndex = aCellIndex;
+      if (aCellIndex <= 0) {
+        newIndex = 0;
+			} else if (aCellIndex > oldIndex) {
+        newIndex--;
+			}
+      nsIDOMNode *refNode;
+      cells->Item(newIndex, &refNode);
+      row->InsertBefore(this, refNode, &returnNode); // add this back into the row
+      NS_IF_RELEASE(refNode);
+		}
   }
 
   NS_RELEASE(cells);

content/html/content/src/nsHTMLTableElement.cpp

@@ -212,74 +212,73 @@ TableRowsCollection::GetLength(PRUint32* aLength)
         NS_RELEASE(content);
         NS_RELEASE(node);
         tbodies->Item(index, &node);
-        NS_RELEASE(tbodies);
       }
+      NS_RELEASE(tbodies);
     }
   }
   return rv;
 }
 
+// increments aReturn refcnt by 1
 NS_IMETHODIMP 
 TableRowsCollection::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
 {
-  *aReturn=nsnull;
+  *aReturn = nsnull;
   nsresult rv = NS_OK;
   PRUint32 count = 0;
-  PRUint32 rowsInHead;
-  if (nsnull!=mParent)
-  {
-    // count the rows in the thead, tfoot, and all tbodies
+ 
+  if (nsnull != mParent) {
     nsIDOMHTMLTableSectionElement *rowGroup;
+
+    // check the thead
     mParent->GetTHead(&rowGroup);
-    if (nsnull!=rowGroup)
-    {
-      nsIContent *content=nsnull;
+    if (nsnull != rowGroup) {
+      nsIContent *content = nsnull;
       rowGroup->QueryInterface(kIContentIID, (void **)&content);
       GenericElementCollection head(content, nsHTMLAtoms::tr);
+      PRUint32 rowsInHead;
       head.GetLength(&rowsInHead);
       count = rowsInHead;
-      if (count>aIndex)
-      {
-        head.Item(aIndex, aReturn);
-        return NS_OK;
-      }
       NS_RELEASE(content);
       NS_RELEASE(rowGroup);
+      if (count > aIndex) {
+        head.Item(aIndex, aReturn);
+        return NS_OK; 
+      }
     }
+
+	// check the tbodies
     nsIDOMHTMLCollection *tbodies;
     mParent->GetTBodies(&tbodies);
-    if (nsnull!=tbodies)
-    {
+    if (nsnull != tbodies) {
       rowGroup = nsnull;
       nsIDOMNode *node;
       PRUint32 index=0;
       tbodies->Item(index, &node);
-      while (nsnull!=node)
-      {
-        nsIContent *content=nsnull;
+      while (nsnull != node) {
+        nsIContent *content = nsnull;
         node->QueryInterface(kIContentIID, (void **)&content);
-        NS_ADDREF(nsHTMLAtoms::tr);
         GenericElementCollection body(content, nsHTMLAtoms::tr);
+        NS_RELEASE(content);
+        NS_RELEASE(node);
         PRUint32 rows;
         body.GetLength(&rows);
-        if ((count+rows)>aIndex)
-        {
+        if ((count+rows) > aIndex) {
           body.Item(aIndex-count, aReturn);
-          return NS_OK;
+          NS_RELEASE(tbodies);
+		  return NS_OK;
         }
         count += rows;
         index++;
-        NS_RELEASE(content);
-        NS_RELEASE(node);
         tbodies->Item(index, &node);
-        NS_RELEASE(tbodies);
       }
+      NS_RELEASE(tbodies);
     }
-    // if it is to be found, it must be in the tfoot
+
+    // check the tfoot
     mParent->GetTFoot(&rowGroup);
-    if (nsnull!=rowGroup)
-    {
-      nsIContent *content=nsnull;
+    if (nsnull != rowGroup) {
+      nsIContent *content = nsnull;
       rowGroup->QueryInterface(kIContentIID, (void **)&content);
       GenericElementCollection foot(content, nsHTMLAtoms::tr);
       foot.Item(aIndex-count, aReturn);
@@ -519,7 +518,7 @@ nsHTMLTableElement::GetRows(nsIDOMHTMLCollection** aValue)
 {
   if (nsnull==mRows)
   {
-    NS_ADDREF(nsHTMLAtoms::tr);
+    // XXX why was this here NS_ADDREF(nsHTMLAtoms::tr);
     mRows = new TableRowsCollection(this);
     NS_ADDREF(mRows); // this table's reference, released in the destructor
   }

content/html/content/src/nsHTMLTableRowElement.cpp

@@ -238,13 +238,15 @@ nsHTMLTableRowElement::GetRowIndex(PRInt32* aValue)
     table->GetRows(&rows);
     PRUint32 numRows;
     rows->GetLength(&numRows);
-    for (PRUint32 i = 0; i < numRows; i++) {
+	PRBool found = PR_FALSE;
+    for (PRUint32 i = 0; (i < numRows) && !found; i++) {
       nsIDOMNode *node = nsnull;
       rows->Item(i, &node);
       if (this == node) {
         *aValue = i;
-        break;
+        found = PR_TRUE;
       }
+	  NS_IF_RELEASE(node);
     }
     NS_RELEASE(rows);
     NS_RELEASE(table);
@@ -274,28 +276,33 @@ nsHTMLTableRowElement::SetRowIndex(PRInt32 aValue)
   table->GetRows(&rows);
   PRUint32 numRowsU;
   rows->GetLength(&numRowsU);
-  PRInt32 numRows = numRowsU;
+  PRInt32 numRows = numRowsU; // numRows will be > 0 since this must be a row
 
   // check if it really moves
   if ( !(((0 == oldIndex) && (aValue <= 0)) || ((numRows-1 == oldIndex) && (aValue >= numRows-1)))) {
+    nsIDOMNode *section = nsnull;
+    nsIDOMNode* refRow = nsnull;
+	PRInt32 refIndex = aValue;
+    if (aValue < numRows) {
+	  refIndex = 0;
+    } else {
+	  refIndex = numRows-1;
+	}
+	rows->Item(refIndex, &refRow);
+    refRow->GetParentNode(&section);
+
     AddRef(); // don't use NS_ADDREF_THIS
     table->DeleteRow(oldIndex);     // delete this from the table
-    numRows--;
     nsIDOMNode *returnNode;
-    if ((numRows <= 0) || (aValue >= numRows)) {
-      table->AppendChild(this, &returnNode); // add this back into the table
+    if (aValue >= numRows) {
+      section->AppendChild(this, &returnNode); // add this back into the table
     } else {
-      PRInt32 newIndex = aValue;
-      if (aValue <= 0) {
-        newIndex = 0;
-      } else if (aValue > oldIndex) {
-        newIndex--;                   // since this got removed before GetLength was called
-      }
-      nsIDOMNode *refNode;
-      rows->Item(newIndex, &refNode);
-      table->InsertBefore(this, refNode, &returnNode); // add this back into the table
+      section->InsertBefore(this, refRow, &returnNode); // add this back into the table
     }
     Release(); // from addref above, can't use NS_RELEASE
+
+    NS_RELEASE(section);
+    NS_RELEASE(refRow);  // XXX is this right, check nsHTMLTableElement also
   }
 
   NS_RELEASE(rows);
@@ -315,13 +322,15 @@ nsHTMLTableRowElement::GetSectionRowIndex(PRInt32* aValue)
     section->GetRows(&rows);
     PRUint32 numRows;
     rows->GetLength(&numRows);
-    for (PRUint32 i = 0; i < numRows; i++) {
+	PRBool found = PR_FALSE;
+    for (PRUint32 i = 0; (i < numRows) && !found; i++) {
       nsIDOMNode *node = nsnull;
       rows->Item(i, &node);
       if (this == node) {
         *aValue = i;
-        break;
+        found = PR_TRUE;
       }
+	  NS_IF_RELEASE(node);
     } 
     NS_RELEASE(rows);
     NS_RELEASE(section);
@@ -350,7 +359,7 @@ nsHTMLTableRowElement::SetSectionRowIndex(PRInt32 aValue)
   section->GetRows(&rows);
   PRUint32 numRowsU;
   rows->GetLength(&numRowsU);
-  PRInt32 numRows = numRowsU;
+  PRInt32 numRows = numRowsU; 
 
   // check if it really moves
   if ( !(((0 == oldIndex) && (aValue <= 0)) || ((numRows-1 == oldIndex) && (aValue >= numRows-1)))) {
@@ -370,6 +379,7 @@ nsHTMLTableRowElement::SetSectionRowIndex(PRInt32 aValue)
       nsIDOMNode *refNode;
       rows->Item(newIndex, &refNode);
       section->InsertBefore(this, refNode, &returnNode); // add this back into the section
+	  NS_IF_RELEASE(refNode);
     }
     Release(); // from addref above, can't use NS_RELEASE
   }

content/html/content/src/nsHTMLTableSectionElement.cpp

@@ -153,7 +153,7 @@ nsHTMLTableSectionElement::GetRows(nsIDOMHTMLCollection** aValue)
 {
   *aValue = nsnull;
   if (nsnull == mRows) {
-    NS_ADDREF(nsHTMLAtoms::tr);
+    //XXX why was this here NS_ADDREF(nsHTMLAtoms::tr);
     mRows = new GenericElementCollection(this, nsHTMLAtoms::tr);
     NS_ADDREF(mRows); // this table's reference, released in the destructor
   }
@@ -187,6 +187,7 @@ nsHTMLTableSectionElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
         nsIDOMNode *refRow;
         rows->Item(refIndex, &refRow);
         rv = InsertBefore(rowNode, refRow, (nsIDOMNode **)aValue);
+		NS_RELEASE(refRow);
       } else {
         rv = AppendChild(rowNode, (nsIDOMNode **)aValue);
       }

content/html/style/src/nsHTMLStyleSheet.cpp

@@ -2242,7 +2242,9 @@ HTMLStyleSheetImpl::GetFrameFor(nsIPresShell* aPresShell, nsIPresContext* aPresC
 
     if (display->IsBlockLevel() && IsScrollable(aPresContext, display)) {
       frame->FirstChild(nsnull, frame);
-    }
+    } else if (NS_STYLE_DISPLAY_TABLE == display->mDisplay) { // we got an outer table frame, need an inner
+      frame->FirstChild(nsnull, frame);                       // the inner frame is always the 1st child
+    }    
   }
 
   return frame;

layout/base/public/nsIFrameReflow.h

@@ -102,11 +102,6 @@ struct nsReflowState {
                        availableHeight;   // the available space in which to reflow
   nsIRenderingContext* rendContext;       // rendering context to use for measurement
   PRPackedBool         isTopOfPage;       // is the current context at the top of a page?
-  // the following data members are relevant if nsStyleText.mTextAlign is NS_STYLE_TEXT_ALIGN_CHAR
-  PRPackedBool         useAlignCharOffset;// if true, the reflow honors alignCharOffset and does not
-                                          // set it. if false, the reflow sets alignCharOffset
-  nscoord              alignCharOffset;   // distance from reference edge (as specified in nsStyleDisplay.mDirection) 
-                                          // to the align character (which will be specified in nsStyleTable)
 
   // Note: there is no copy constructor, so the compiler can generate an
   // optimal one.

layout/html/base/src/nsIHTMLReflow.h

@@ -166,6 +166,12 @@ struct nsHTMLReflowState : nsReflowState {
   // line-height value then this field will be "-1".
   nscoord          mLineHeight;
 
+  // the following data members are relevant if nsStyleText.mTextAlign == NS_STYLE_TEXT_ALIGN_CHAR
+  nscoord          mAlignCharOffset;   // distance from reference edge (as specified in nsStyleDisplay.mDirection) 
+                                       // to the align character (which will be specified in nsStyleTable)
+  PRPackedBool     mUseAlignCharOffset;// if true, the reflow honors alignCharOffset and does not
+                                       // set it. if false, the reflow sets alignCharOffset
+
   // Constructs an initial reflow state (no parent reflow state) for a
   // non-incremental reflow command. Sets reflowType to eReflowType_Block
   nsHTMLReflowState(nsIPresContext&      aPresContext,

layout/html/content/src/GenericElementCollection.cpp

@@ -27,6 +27,7 @@ GenericElementCollection::GenericElementCollection(nsIContent *aParent,
 {
   mParent = aParent;
   mTag = aTag;
+  NS_IF_ADDREF(mTag);
 }
 
 GenericElementCollection::~GenericElementCollection()

layout/html/content/src/nsHTMLTableCellElement.cpp

@@ -211,13 +211,15 @@ nsHTMLTableCellElement::GetCellIndex(PRInt32* aCellIndex)
   row->GetCells(&cells);
   PRUint32 numCells;
   cells->GetLength(&numCells);
-  for (PRUint32 i = 0; i < numCells; i++) {
+  PRBool found = PR_FALSE;
+  for (PRUint32 i = 0; (i < numCells) && !found; i++) {
     nsIDOMNode *node = nsnull;
     cells->Item(i, &node);
     if (this == node) {
       *aCellIndex = i;
-      break;
+	  found = PR_TRUE;
     }
+	NS_IF_RELEASE(node);
   }
   NS_RELEASE(cells);
   NS_RELEASE(row);
@@ -229,35 +231,39 @@ NS_IMETHODIMP
 nsHTMLTableCellElement::SetCellIndex(PRInt32 aCellIndex)
 {
   PRInt32 oldIndex;
-  GetCellIndex(&oldIndex);
-  if (oldIndex == aCellIndex) {        // no change in index, don't do anything
+  nsresult result = GetCellIndex(&oldIndex);
+  if ((-1 == oldIndex) || (oldIndex == aCellIndex) || (NS_OK != result)) {
     return NS_OK;
   }
 
   nsIDOMHTMLTableRowElement* row = nsnull;
   GetRow(&row);
-
-  row->DeleteCell(oldIndex);       // delete this from the row
-
   nsIDOMHTMLCollection *cells = nsnull;
   row->GetCells(&cells);
-  PRUint32 numCells;
-  cells->GetLength(&numCells);
-  nsIDOMNode *returnNode;
-  if (numCells <= 0) {
-    row->AppendChild(this, &returnNode); // add this back into the row
-  } else {
-    PRInt32 newIndex = oldIndex;
-    if (aCellIndex <= 0) {
-      newIndex = 0;
-    } else if ((PRUint32)aCellIndex >= numCells) {
-      newIndex = numCells - 1;
-    } else if (aCellIndex > oldIndex) {
-      newIndex--;                   // since this got removed before GetLength was called
-    }
-    nsIDOMNode *refNode;
-    cells->Item(newIndex, &refNode);
-    row->InsertBefore(this, refNode, &returnNode); // add this back into the row
+  PRUint32 numCellsU;
+  cells->GetLength(&numCellsU);
+  PRInt32 numCells = numCellsU;
+
+  // check if it really moves
+  if ( !(((0 == oldIndex) && (aCellIndex <= 0)) || ((numCells-1 == oldIndex) && (aCellIndex >= numCells-1)))) {
+    AddRef(); // don't use NS_ADDREF_THIS
+    row->DeleteCell(oldIndex);       // delete this from the row
+    numCells--;
+    nsIDOMNode *returnNode;
+    if ((numCells <= 0) || (aCellIndex >= numCells)) {
+      row->AppendChild(this, &returnNode); // add this back into the row
+		} else {
+      PRInt32 newIndex = aCellIndex;
+      if (aCellIndex <= 0) {
+        newIndex = 0;
+			} else if (aCellIndex > oldIndex) {
+        newIndex--;
+			}
+      nsIDOMNode *refNode;
+      cells->Item(newIndex, &refNode);
+      row->InsertBefore(this, refNode, &returnNode); // add this back into the row
+      NS_IF_RELEASE(refNode);
+		}
   }
 
   NS_RELEASE(cells);

layout/html/content/src/nsHTMLTableElement.cpp

@@ -212,74 +212,73 @@ TableRowsCollection::GetLength(PRUint32* aLength)
         NS_RELEASE(content);
         NS_RELEASE(node);
         tbodies->Item(index, &node);
-        NS_RELEASE(tbodies);
       }
+      NS_RELEASE(tbodies);
     }
   }
   return rv;
 }
 
+// increments aReturn refcnt by 1
 NS_IMETHODIMP 
 TableRowsCollection::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
 {
-  *aReturn=nsnull;
+  *aReturn = nsnull;
   nsresult rv = NS_OK;
   PRUint32 count = 0;
-  PRUint32 rowsInHead;
-  if (nsnull!=mParent)
-  {
-    // count the rows in the thead, tfoot, and all tbodies
+ 
+  if (nsnull != mParent) {
     nsIDOMHTMLTableSectionElement *rowGroup;
+
+    // check the thead
     mParent->GetTHead(&rowGroup);
-    if (nsnull!=rowGroup)
-    {
-      nsIContent *content=nsnull;
+    if (nsnull != rowGroup) {
+      nsIContent *content = nsnull;
       rowGroup->QueryInterface(kIContentIID, (void **)&content);
       GenericElementCollection head(content, nsHTMLAtoms::tr);
+      PRUint32 rowsInHead;
       head.GetLength(&rowsInHead);
       count = rowsInHead;
-      if (count>aIndex)
-      {
-        head.Item(aIndex, aReturn);
-        return NS_OK;
-      }
       NS_RELEASE(content);
       NS_RELEASE(rowGroup);
+      if (count > aIndex) {
+        head.Item(aIndex, aReturn);
+        return NS_OK; 
+      }
     }
+
+	// check the tbodies
     nsIDOMHTMLCollection *tbodies;
     mParent->GetTBodies(&tbodies);
-    if (nsnull!=tbodies)
-    {
+    if (nsnull != tbodies) {
       rowGroup = nsnull;
       nsIDOMNode *node;
       PRUint32 index=0;
       tbodies->Item(index, &node);
-      while (nsnull!=node)
-      {
-        nsIContent *content=nsnull;
+      while (nsnull != node) {
+        nsIContent *content = nsnull;
         node->QueryInterface(kIContentIID, (void **)&content);
-        NS_ADDREF(nsHTMLAtoms::tr);
         GenericElementCollection body(content, nsHTMLAtoms::tr);
+        NS_RELEASE(content);
+        NS_RELEASE(node);
         PRUint32 rows;
         body.GetLength(&rows);
-        if ((count+rows)>aIndex)
-        {
+        if ((count+rows) > aIndex) {
           body.Item(aIndex-count, aReturn);
-          return NS_OK;
+          NS_RELEASE(tbodies);
+		  return NS_OK;
         }
         count += rows;
         index++;
-        NS_RELEASE(content);
-        NS_RELEASE(node);
         tbodies->Item(index, &node);
-        NS_RELEASE(tbodies);
       }
+      NS_RELEASE(tbodies);
     }
-    // if it is to be found, it must be in the tfoot
+
+    // check the tfoot
     mParent->GetTFoot(&rowGroup);
-    if (nsnull!=rowGroup)
-    {
-      nsIContent *content=nsnull;
+    if (nsnull != rowGroup) {
+      nsIContent *content = nsnull;
       rowGroup->QueryInterface(kIContentIID, (void **)&content);
       GenericElementCollection foot(content, nsHTMLAtoms::tr);
       foot.Item(aIndex-count, aReturn);
@@ -519,7 +518,7 @@ nsHTMLTableElement::GetRows(nsIDOMHTMLCollection** aValue)
 {
   if (nsnull==mRows)
   {
-    NS_ADDREF(nsHTMLAtoms::tr);
+    // XXX why was this here NS_ADDREF(nsHTMLAtoms::tr);
     mRows = new TableRowsCollection(this);
     NS_ADDREF(mRows); // this table's reference, released in the destructor
   }

layout/html/content/src/nsHTMLTableRowElement.cpp

@@ -238,13 +238,15 @@ nsHTMLTableRowElement::GetRowIndex(PRInt32* aValue)
     table->GetRows(&rows);
     PRUint32 numRows;
     rows->GetLength(&numRows);
-    for (PRUint32 i = 0; i < numRows; i++) {
+	PRBool found = PR_FALSE;
+    for (PRUint32 i = 0; (i < numRows) && !found; i++) {
       nsIDOMNode *node = nsnull;
       rows->Item(i, &node);
       if (this == node) {
         *aValue = i;
-        break;
+        found = PR_TRUE;
       }
+	  NS_IF_RELEASE(node);
     }
     NS_RELEASE(rows);
     NS_RELEASE(table);
@@ -274,28 +276,33 @@ nsHTMLTableRowElement::SetRowIndex(PRInt32 aValue)
   table->GetRows(&rows);
   PRUint32 numRowsU;
   rows->GetLength(&numRowsU);
-  PRInt32 numRows = numRowsU;
+  PRInt32 numRows = numRowsU; // numRows will be > 0 since this must be a row
 
   // check if it really moves
   if ( !(((0 == oldIndex) && (aValue <= 0)) || ((numRows-1 == oldIndex) && (aValue >= numRows-1)))) {
+    nsIDOMNode *section = nsnull;
+    nsIDOMNode* refRow = nsnull;
+	PRInt32 refIndex = aValue;
+    if (aValue < numRows) {
+	  refIndex = 0;
+    } else {
+	  refIndex = numRows-1;
+	}
+	rows->Item(refIndex, &refRow);
+    refRow->GetParentNode(&section);
+
     AddRef(); // don't use NS_ADDREF_THIS
     table->DeleteRow(oldIndex);     // delete this from the table
-    numRows--;
     nsIDOMNode *returnNode;
-    if ((numRows <= 0) || (aValue >= numRows)) {
-      table->AppendChild(this, &returnNode); // add this back into the table
+    if (aValue >= numRows) {
+      section->AppendChild(this, &returnNode); // add this back into the table
     } else {
-      PRInt32 newIndex = aValue;
-      if (aValue <= 0) {
-        newIndex = 0;
-      } else if (aValue > oldIndex) {
-        newIndex--;                   // since this got removed before GetLength was called
-      }
-      nsIDOMNode *refNode;
-      rows->Item(newIndex, &refNode);
-      table->InsertBefore(this, refNode, &returnNode); // add this back into the table
+      section->InsertBefore(this, refRow, &returnNode); // add this back into the table
     }
     Release(); // from addref above, can't use NS_RELEASE
+
+    NS_RELEASE(section);
+    NS_RELEASE(refRow);  // XXX is this right, check nsHTMLTableElement also
   }
 
   NS_RELEASE(rows);
@@ -315,13 +322,15 @@ nsHTMLTableRowElement::GetSectionRowIndex(PRInt32* aValue)
     section->GetRows(&rows);
     PRUint32 numRows;
     rows->GetLength(&numRows);
-    for (PRUint32 i = 0; i < numRows; i++) {
+	PRBool found = PR_FALSE;
+    for (PRUint32 i = 0; (i < numRows) && !found; i++) {
       nsIDOMNode *node = nsnull;
       rows->Item(i, &node);
       if (this == node) {
         *aValue = i;
-        break;
+        found = PR_TRUE;
       }
+	  NS_IF_RELEASE(node);
     } 
     NS_RELEASE(rows);
     NS_RELEASE(section);
@@ -350,7 +359,7 @@ nsHTMLTableRowElement::SetSectionRowIndex(PRInt32 aValue)
   section->GetRows(&rows);
   PRUint32 numRowsU;
   rows->GetLength(&numRowsU);
-  PRInt32 numRows = numRowsU;
+  PRInt32 numRows = numRowsU; 
 
   // check if it really moves
   if ( !(((0 == oldIndex) && (aValue <= 0)) || ((numRows-1 == oldIndex) && (aValue >= numRows-1)))) {
@@ -370,6 +379,7 @@ nsHTMLTableRowElement::SetSectionRowIndex(PRInt32 aValue)
       nsIDOMNode *refNode;
       rows->Item(newIndex, &refNode);
       section->InsertBefore(this, refNode, &returnNode); // add this back into the section
+	  NS_IF_RELEASE(refNode);
     }
     Release(); // from addref above, can't use NS_RELEASE
   }

layout/html/content/src/nsHTMLTableSectionElement.cpp

@@ -153,7 +153,7 @@ nsHTMLTableSectionElement::GetRows(nsIDOMHTMLCollection** aValue)
 {
   *aValue = nsnull;
   if (nsnull == mRows) {
-    NS_ADDREF(nsHTMLAtoms::tr);
+    //XXX why was this here NS_ADDREF(nsHTMLAtoms::tr);
     mRows = new GenericElementCollection(this, nsHTMLAtoms::tr);
     NS_ADDREF(mRows); // this table's reference, released in the destructor
   }
@@ -187,6 +187,7 @@ nsHTMLTableSectionElement::InsertRow(PRInt32 aIndex, nsIDOMHTMLElement** aValue)
         nsIDOMNode *refRow;
         rows->Item(refIndex, &refRow);
         rv = InsertBefore(rowNode, refRow, (nsIDOMNode **)aValue);
+		NS_RELEASE(refRow);
       } else {
         rv = AppendChild(rowNode, (nsIDOMNode **)aValue);
       }

layout/html/style/src/nsHTMLStyleSheet.cpp

@@ -2242,7 +2242,9 @@ HTMLStyleSheetImpl::GetFrameFor(nsIPresShell* aPresShell, nsIPresContext* aPresC
 
     if (display->IsBlockLevel() && IsScrollable(aPresContext, display)) {
       frame->FirstChild(nsnull, frame);
-    }
+    } else if (NS_STYLE_DISPLAY_TABLE == display->mDisplay) { // we got an outer table frame, need an inner
+      frame->FirstChild(nsnull, frame);                       // the inner frame is always the 1st child
+    }    
   }
 
   return frame;

layout/html/tests/TableIncrementalReflow.html

@@ -254,6 +254,13 @@ function changeCellStyle() {
   dump("SCRIPT: changed width for first CELL to 400\n");
 }
 
+function setCellIndex() {
+  dump("\nSCRIPT: starting setCellIndex\n");
+  var cell = document.getElementsByTagName("TD")[0];
+  cell.cellIndex = 99;
+  dump("SCRIPT: ending setCellIndex - placed 1st cell at end\n");
+}
+
 function AddALot() {
   dump("\nSCRIPT: starting AddALot\n");
   var table = document.getElementsByTagName("TABLE")[0];
@@ -325,6 +332,7 @@ delete removes the first object of [type].
 <INPUT TYPE="button" NAME="Ins Cell" VALUE="InsertCell" onClick="insertCell()" width=100>
 <INPUT TYPE="button" NAME="App Cell" VALUE="AppendCell" onClick="appendCell()" width=100>
 <INPUT TYPE="button" NAME="Del Cell" VALUE="DeleteCell" onClick="deleteCell()" width=100>
+<INPUT TYPE="button" NAME="Set Cell Index" VALUE="Set Cell Index" onClick="setCellIndex()" width=100>
 <br>
 <INPUT TYPE="button" NAME="Add a lot" VALUE="AddALot" onClick="AddALot()" width=100>
 <br>

layout/style/nsHTMLStyleSheet.cpp

@@ -2242,7 +2242,9 @@ HTMLStyleSheetImpl::GetFrameFor(nsIPresShell* aPresShell, nsIPresContext* aPresC
 
     if (display->IsBlockLevel() && IsScrollable(aPresContext, display)) {
       frame->FirstChild(nsnull, frame);
-    }
+    } else if (NS_STYLE_DISPLAY_TABLE == display->mDisplay) { // we got an outer table frame, need an inner
+      frame->FirstChild(nsnull, frame);                       // the inner frame is always the 1st child
+    }    
   }
 
   return frame;