Discard aPrevFrame if it's the mPopupFrame since it's on a different lists. b=394800 r=enndeakin sr=bzbarsky a=dbaron

2007-10-19 22:43:38 -07:00 · 2007-10-19 22:43:38 -07:00 · f07d92fd7d
--- a/layout/xul/base/src/nsBoxFrame.cpp
+++ b/layout/xul/base/src/nsBoxFrame.cpp
@ -1032,6 +1032,8 @@ nsBoxFrame::InsertFrames(nsIAtom*        aListName,
 {
   NS_ASSERTION(!aPrevFrame || aPrevFrame->GetParent() == this,
                "inserting after sibling frame with different parent");
+   NS_ASSERTION(!aPrevFrame || mFrames.ContainsFrame(aPrevFrame),
+                "inserting after sibling frame not in our child list");
   NS_PRECONDITION(!aListName, "We don't support out-of-flow kids");
   nsBoxLayoutState state(PresContext());

--- a/layout/xul/base/src/nsMenuFrame.cpp
+++ b/layout/xul/base/src/nsMenuFrame.cpp
@ -1198,6 +1198,9 @@ nsMenuFrame::InsertFrames(nsIAtom*        aListName,
                       NS_FRAME_HAS_DIRTY_CHILDREN);
    rv = NS_OK;
  } else {
+    if (NS_UNLIKELY(aPrevFrame == mPopupFrame)) {
+      aPrevFrame = nsnull;
+    }
    rv = nsBoxFrame::InsertFrames(aListName, aPrevFrame, aFrameList);  
  }

--- a/layout/xul/test/Makefile.in
+++ b/layout/xul/test/Makefile.in
@ -45,6 +45,7 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk

 _TEST_FILES =	test_bug372685.xul \
+		test_bug394800.xhtml \
 		$(NULL)

 libs:: $(_TEST_FILES)
--- a/layout/xul/test/test_bug394800.xhtml
+++ b/layout/xul/test/test_bug394800.xhtml
@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=394800
+-->
+  <title>Test Mozilla bug 394800</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+
+<script class="testbody" type="application/javascript">
+
+function do_test()
+{
+  var x = document.getElementById("x");
+  x.parentNode.removeChild(x);
+  is(0, 0, "this is a crash/assertion test, so we're ok if we survived this far");
+  SimpleTest.finish();
+}
+
+SimpleTest.waitForExplicitFinish();
+</script>
+</head>
+
+<body>
+
+<xul:menulist><xul:tooltip/><div><span><xul:hbox id="x"/></span></div></xul:menulist>
+
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=394800">Mozilla Bug 394800</a>
+<p id="display"></p>
+
+<pre id="test">
+</pre>
+
+<script>
+  addLoadEvent(do_test);
+</script>
+
+</body>
+</html>