Avoing crashing due to outdated text pointers by never poking at dirty text frames, b=307875, r+sr=bzbarsky

layout/generic/nsTextFrame.cpp

@@ -1061,6 +1061,21 @@ DrawSelectionIterator::IsBeforeOrAfter()
 
 //----------------------------------------------------------------------
 
+#if defined(DEBUG_rbs) || defined(DEBUG_bzbarsky)
+static void
+VerifyNotDirty(nsFrameState state)
+{
+  PRBool isZero = state & NS_FRAME_FIRST_REFLOW;
+  PRBool isDirty = state & NS_FRAME_IS_DIRTY;
+  if (!isZero && isDirty)
+    NS_WARNING("internal offsets may be out-of-sync");
+}
+#define DEBUG_VERIFY_NOT_DIRTY(state) \
+VerifyNotDirty(state)
+#else
+#define DEBUG_VERIFY_NOT_DIRTY(state)
+#endif
+
 nsresult
 NS_NewTextFrame(nsIPresShell* aPresShell, nsIFrame** aNewFrame)
 {
@@ -3449,6 +3464,10 @@ nsTextFrame::GetPosition(nsPresContext*  aPresContext,
   // initialize out param
   *aNewContent = nsnull;
 
+  DEBUG_VERIFY_NOT_DIRTY(mState);
+  if (mState & NS_FRAME_IS_DIRTY)
+    return NS_ERROR_UNEXPECTED;
+
   nsIPresShell *shell = aPresContext->GetPresShell();
   if (shell) {
     nsCOMPtr<nsIRenderingContext> rendContext;      
@@ -3609,6 +3628,10 @@ nsTextFrame::GetContentAndOffsetsFromPoint(nsPresContext*  aPresContext,
   aContentOffsetEnd = 0;
   aBeginFrameContent = 0;
 
+  DEBUG_VERIFY_NOT_DIRTY(mState);
+  if (mState & NS_FRAME_IS_DIRTY)
+    return NS_ERROR_UNEXPECTED;
+
   nsPoint newPoint;
   newPoint.y = aPoint.y;
   if (aPoint.x < 0)
@@ -3636,6 +3659,10 @@ nsTextFrame::SetSelected(nsPresContext* aPresContext,
                          PRBool aSelected,
                          nsSpread aSpread)
 {
+  DEBUG_VERIFY_NOT_DIRTY(mState);
+  if (mState & NS_FRAME_IS_DIRTY)
+    return NS_ERROR_UNEXPECTED;
+
   if (aSelected && ParentDisablesSelection())
     return NS_OK;
 
@@ -3782,9 +3809,14 @@ nsTextFrame::GetPointFromOffset(nsPresContext* aPresContext,
   if (!aPresContext || !inRendContext || !outPoint)
     return NS_ERROR_NULL_POINTER;
 
-  if (mContentLength <= 0) {
   outPoint->x = 0;
   outPoint->y = 0;
+
+  DEBUG_VERIFY_NOT_DIRTY(mState);
+  if (mState & NS_FRAME_IS_DIRTY)
+    return NS_ERROR_UNEXPECTED;
+
+  if (mContentLength <= 0) {
     return NS_OK;
   }
 
@@ -3894,6 +3926,10 @@ nsTextFrame::GetChildFrameContainingOffset(PRInt32 inContentOffset,
                                            PRInt32* outFrameContentOffset,
                                            nsIFrame **outChildFrame)
 {
+  DEBUG_VERIFY_NOT_DIRTY(mState);
+  if (mState & NS_FRAME_IS_DIRTY)
+    return NS_ERROR_UNEXPECTED;
+
   if (nsnull == outChildFrame)
     return NS_ERROR_NULL_POINTER;
   PRInt32 contentOffset = inContentOffset;
@@ -3953,6 +3989,10 @@ nsTextFrame::GetChildFrameContainingOffset(PRInt32 inContentOffset,
 NS_IMETHODIMP
 nsTextFrame::PeekOffset(nsPresContext* aPresContext, nsPeekOffsetStruct *aPos) 
 {
+  DEBUG_VERIFY_NOT_DIRTY(mState);
+  if (mState & NS_FRAME_IS_DIRTY)
+    return NS_ERROR_UNEXPECTED;
+
 #ifdef IBMBIDI
   // XXX TODO: - this explanation may not be accurate
   //           - need to better explain what aPos->mPreferLeft means