b=432467, firefox segfaults in plone kupu editor [@ nsDocAccessible::FlushPendingEvents], on Tablet PC [@arena_dalloc_small] (steps to reproduce in comment #26), p=Ginn Chen <ginn.chen@sun.com>, r=surkov

This commit is contained in:
Marco Zehe 2008-06-05 11:49:51 +02:00
Родитель 7db00d7cb1
Коммит 57c354816b
2 изменённых файлов: 11 добавлений и 3 удалений

Просмотреть файл

@ -85,7 +85,8 @@ nsIAtom *nsDocAccessible::gLastFocusedFrameType = nsnull;
//-----------------------------------------------------
nsDocAccessible::nsDocAccessible(nsIDOMNode *aDOMNode, nsIWeakReference* aShell):
nsHyperTextAccessibleWrap(aDOMNode, aShell), mWnd(nsnull),
mScrollPositionChangedTicks(0), mIsContentLoaded(PR_FALSE), mIsLoadCompleteFired(PR_FALSE)
mScrollPositionChangedTicks(0), mIsContentLoaded(PR_FALSE),
mIsLoadCompleteFired(PR_FALSE), mInFlushPendingEvents(PR_FALSE)
{
// For GTK+ native window, we do nothing here.
if (!mDOMNode)
@ -589,7 +590,10 @@ NS_IMETHODIMP nsDocAccessible::Shutdown()
mEventsToFire.Clear();
// Make sure we release the kung fu death grip which is always
// there when there are still events left to be fired
NS_RELEASE_THIS();
// If FlushPendingEvents() is in call stack,
// kung fu death grip will be released there.
if (!mInFlushPendingEvents)
NS_RELEASE_THIS();
}
}
@ -1505,6 +1509,7 @@ nsDocAccessible::FireDelayedAccessibleEvent(nsIAccessibleEvent *aEvent)
NS_IMETHODIMP nsDocAccessible::FlushPendingEvents()
{
mInFlushPendingEvents = PR_TRUE;
PRUint32 length = mEventsToFire.Count();
NS_ASSERTION(length, "How did we get here without events to fire?");
nsCOMPtr<nsIPresShell> presShell = GetPresShell();
@ -1625,7 +1630,8 @@ NS_IMETHODIMP nsDocAccessible::FlushPendingEvents()
#endif
nsCOMPtr<nsIAccessibleCaretMoveEvent> caretMoveEvent =
new nsAccCaretMoveEvent(accessible, caretOffset);
NS_ENSURE_TRUE(caretMoveEvent, NS_ERROR_OUT_OF_MEMORY);
if (!caretMoveEvent)
break; // Out of memory, break out to release kung fu death grip
FireAccessibleEvent(caretMoveEvent);
@ -1661,6 +1667,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPendingEvents()
// After a flood of events, reset so that user input flag is off
nsAccEvent::ResetLastInputState();
mInFlushPendingEvents = PR_FALSE;
return NS_OK;
}

Просмотреть файл

@ -221,6 +221,7 @@ class nsDocAccessible : public nsHyperTextAccessibleWrap,
protected:
PRBool mIsAnchor;
PRBool mIsAnchorJumped;
PRBool mInFlushPendingEvents;
static PRUint32 gLastFocusedAccessiblesState;
static nsIAtom *gLastFocusedFrameType;
};