Destroy the pushed floats list in nsBlockFrame::DestroyFrom. (Bug 585598) r=roc a2.0=blocking

2010-08-19 09:38:00 -04:00 · 2010-08-19 09:38:00 -04:00 · f4944f292c
--- a/layout/generic/crashtests/585598-1.xhtml
+++ b/layout/generic/crashtests/585598-1.xhtml
@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-print">
+<span style="float: left;page-break-before: right;">
+<select style="float: left;">
+</select>
+</span>
+
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -328,3 +328,4 @@ load 564968.xhtml
 load 570160.html
 load 571618-1.svg
 load 574958.xhtml
+load 585598-1.xhtml
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@ -316,6 +316,11 @@ nsBlockFrame::DestroyFrom(nsIFrame* aDestructRoot)
  // Now clear mFrames, since we've destroyed all the frames in it.
  mFrames.Clear();

+  nsFrameList* pushedFloats = RemovePushedFloats();
+  if (pushedFloats) {
+    pushedFloats->DestroyFrom(aDestructRoot);
+  }
+
  // destroy overflow lines now
  nsLineList* overflowLines = RemoveOverflowLines();
  if (overflowLines) {