Fix for 51264. r=danm, a=ben

layout/base/nsFrameManager.cpp

@@ -53,6 +53,9 @@
 #include "nsIContent.h"
 #include "nsINameSpaceManager.h"
 #include "nsIXMLContent.h"
+#include "nsIDocument.h"
+#include "nsIBindingManager.h"
+#include "nsIScrollableFrame.h"
 
 #define NEW_CONTEXT_PARENTAGE_INVARIANT
 
@@ -299,6 +302,8 @@ public:
   NS_IMETHOD RemoveFrameProperty(nsIFrame* aFrame,
                                  nsIAtom*  aPropertyName);
 
+  NS_IMETHOD GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aParent, nsIFrame* aChild, nsIFrame** aResult);
+
 #ifdef NS_DEBUG
   NS_IMETHOD DebugVerifyStyleTree(nsIPresContext* aPresContext, nsIFrame* aFrame);
 #endif
@@ -701,6 +706,23 @@ FrameManager::AppendFrames(nsIPresContext* aPresContext,
                            nsIAtom*        aListName,
                            nsIFrame*       aFrameList)
 {
+  nsIFrame* insertionPoint = nsnull;
+  GetInsertionPoint(&aPresShell, aParentFrame, aFrameList, &insertionPoint);
+  if (insertionPoint) {
+    // First append the frames.
+    nsresult rv = insertionPoint->AppendFrames(aPresContext, aPresShell, aListName, aFrameList);
+
+    // Now reparent the style contexts to keep the frames in sync.
+    nsIFrame* walkit = aFrameList;
+    nsCOMPtr<nsIStyleContext> styleContext;
+    insertionPoint->GetStyleContext(getter_AddRefs(styleContext));
+    while (walkit) {
+      aPresContext->ReParentStyleContext(walkit, styleContext);
+      walkit->GetNextSibling(&walkit);
+    }
+    return rv;
+  }
+
   return aParentFrame->AppendFrames(aPresContext, aPresShell, aListName,
                                     aFrameList);
 }
@@ -713,6 +735,23 @@ FrameManager::InsertFrames(nsIPresContext* aPresContext,
                            nsIFrame*       aPrevFrame,
                            nsIFrame*       aFrameList)
 {
+  nsIFrame* insertionPoint = nsnull;
+  GetInsertionPoint(&aPresShell, aParentFrame, aFrameList, &insertionPoint);
+  if (insertionPoint) {
+    // First insert the frames.
+    nsresult rv = insertionPoint->InsertFrames(aPresContext, aPresShell, aListName, aPrevFrame, aFrameList);
+    
+    // Now reparent the style contexts to keep the frames in sync.
+    nsIFrame* walkit = aFrameList;
+    nsCOMPtr<nsIStyleContext> styleContext;
+    insertionPoint->GetStyleContext(getter_AddRefs(styleContext));
+    while (walkit) {
+      aPresContext->ReParentStyleContext(walkit, styleContext);
+      walkit->GetNextSibling(&walkit);
+    }
+    return rv;
+  }
+
   return aParentFrame->InsertFrames(aPresContext, aPresShell, aListName,
                                     aPrevFrame, aFrameList);
 }
@@ -724,6 +763,11 @@ FrameManager::RemoveFrame(nsIPresContext* aPresContext,
                           nsIAtom*        aListName,
                           nsIFrame*       aOldFrame)
 {
+  nsIFrame* insertionPoint = nsnull;
+  GetInsertionPoint(&aPresShell, aParentFrame, aOldFrame, &insertionPoint);
+  if (insertionPoint)
+    return insertionPoint->RemoveFrame(aPresContext, aPresShell, aListName, aOldFrame);
+
   return aParentFrame->RemoveFrame(aPresContext, aPresShell, aListName,
                                    aOldFrame);
 }
@@ -2278,6 +2322,76 @@ FrameManager::RemoveFrameProperty(nsIFrame* aFrame,
   return result;
 }
 
+NS_IMETHODIMP
+FrameManager::GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aParent, nsIFrame* aChild, nsIFrame** aResult)
+{
+  *aResult = nsnull;
+
+  nsCOMPtr<nsIContent> content;
+  aParent->GetContent(getter_AddRefs(content));
+  if (!content)
+    return NS_OK;
+  nsCOMPtr<nsIDocument> document;
+  content->GetDocument(*getter_AddRefs(document));
+  if (!document)
+    return NS_OK;
+
+  nsCOMPtr<nsIBindingManager> bindingManager;
+  document->GetBindingManager(getter_AddRefs(bindingManager));
+  if (!bindingManager)
+    return NS_OK;
+
+  nsCOMPtr<nsIContent> insertionElement;
+  nsIFrame* frame = nsnull;
+  if (aChild) {
+    nsCOMPtr<nsIContent> currContent;
+    aChild->GetContent(getter_AddRefs(currContent));
+
+    // Check to see if the content is anonymous.
+    nsCOMPtr<nsIContent> bindingParent;
+    currContent->GetBindingParent(getter_AddRefs(bindingParent));
+    if (bindingParent == content)
+      return NS_OK; // It is anonymous. Don't use the insertion point, since that's only
+                    // for the explicit kids.
+
+    bindingManager->GetInsertionPoint(content, currContent, getter_AddRefs(insertionElement));
+    if (insertionElement) {
+      aShell->GetPrimaryFrameFor(insertionElement, &frame);
+      if (frame) {
+        nsCOMPtr<nsIScrollableFrame> scroll(do_QueryInterface(frame));
+        if (scroll)
+          scroll->GetScrolledFrame(nsnull, frame);
+        if (frame != aParent) {
+          nsIFrame* nestedPoint = nsnull;
+          GetInsertionPoint(aShell, frame, aChild, &nestedPoint);
+          *aResult = nestedPoint ? nestedPoint : frame;
+        }
+      }
+      return NS_OK;
+    }
+  }
+  else {
+    PRBool dummy;
+    bindingManager->GetSingleInsertionPoint(content, getter_AddRefs(insertionElement), &dummy);
+    if (insertionElement) {
+      aShell->GetPrimaryFrameFor(insertionElement, &frame);
+      if (frame) {
+        nsCOMPtr<nsIScrollableFrame> scroll(do_QueryInterface(frame));
+        if (scroll)
+          scroll->GetScrolledFrame(nsnull, frame);
+        if (frame != aParent) {
+          nsIFrame* nestedPoint = nsnull;
+          GetInsertionPoint(aShell, frame, aChild, &nestedPoint);
+          *aResult = nestedPoint ? nestedPoint : frame;
+        }
+      }
+      return NS_OK;
+    }
+  }
+
+  return NS_OK;
+}
+
 //----------------------------------------------------------------------
 
 MOZ_DECL_CTOR_COUNTER(UndisplayedMap);

layout/base/public/nsIFrameManager.h

@@ -231,6 +231,8 @@ public:
   NS_IMETHOD RemoveFrameProperty(nsIFrame* aFrame,
                                  nsIAtom*  aPropertyName) = 0;
 
+  NS_IMETHOD GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aParent, nsIFrame* aChild, nsIFrame** aResult)=0;
+
 #ifdef NS_DEBUG
   /**
    * DEBUG ONLY method to verify integrity of style tree versus frame tree

layout/html/base/src/nsFrameManager.cpp

@@ -53,6 +53,9 @@
 #include "nsIContent.h"
 #include "nsINameSpaceManager.h"
 #include "nsIXMLContent.h"
+#include "nsIDocument.h"
+#include "nsIBindingManager.h"
+#include "nsIScrollableFrame.h"
 
 #define NEW_CONTEXT_PARENTAGE_INVARIANT
 
@@ -299,6 +302,8 @@ public:
   NS_IMETHOD RemoveFrameProperty(nsIFrame* aFrame,
                                  nsIAtom*  aPropertyName);
 
+  NS_IMETHOD GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aParent, nsIFrame* aChild, nsIFrame** aResult);
+
 #ifdef NS_DEBUG
   NS_IMETHOD DebugVerifyStyleTree(nsIPresContext* aPresContext, nsIFrame* aFrame);
 #endif
@@ -701,6 +706,23 @@ FrameManager::AppendFrames(nsIPresContext* aPresContext,
                            nsIAtom*        aListName,
                            nsIFrame*       aFrameList)
 {
+  nsIFrame* insertionPoint = nsnull;
+  GetInsertionPoint(&aPresShell, aParentFrame, aFrameList, &insertionPoint);
+  if (insertionPoint) {
+    // First append the frames.
+    nsresult rv = insertionPoint->AppendFrames(aPresContext, aPresShell, aListName, aFrameList);
+
+    // Now reparent the style contexts to keep the frames in sync.
+    nsIFrame* walkit = aFrameList;
+    nsCOMPtr<nsIStyleContext> styleContext;
+    insertionPoint->GetStyleContext(getter_AddRefs(styleContext));
+    while (walkit) {
+      aPresContext->ReParentStyleContext(walkit, styleContext);
+      walkit->GetNextSibling(&walkit);
+    }
+    return rv;
+  }
+
   return aParentFrame->AppendFrames(aPresContext, aPresShell, aListName,
                                     aFrameList);
 }
@@ -713,6 +735,23 @@ FrameManager::InsertFrames(nsIPresContext* aPresContext,
                            nsIFrame*       aPrevFrame,
                            nsIFrame*       aFrameList)
 {
+  nsIFrame* insertionPoint = nsnull;
+  GetInsertionPoint(&aPresShell, aParentFrame, aFrameList, &insertionPoint);
+  if (insertionPoint) {
+    // First insert the frames.
+    nsresult rv = insertionPoint->InsertFrames(aPresContext, aPresShell, aListName, aPrevFrame, aFrameList);
+    
+    // Now reparent the style contexts to keep the frames in sync.
+    nsIFrame* walkit = aFrameList;
+    nsCOMPtr<nsIStyleContext> styleContext;
+    insertionPoint->GetStyleContext(getter_AddRefs(styleContext));
+    while (walkit) {
+      aPresContext->ReParentStyleContext(walkit, styleContext);
+      walkit->GetNextSibling(&walkit);
+    }
+    return rv;
+  }
+
   return aParentFrame->InsertFrames(aPresContext, aPresShell, aListName,
                                     aPrevFrame, aFrameList);
 }
@@ -724,6 +763,11 @@ FrameManager::RemoveFrame(nsIPresContext* aPresContext,
                           nsIAtom*        aListName,
                           nsIFrame*       aOldFrame)
 {
+  nsIFrame* insertionPoint = nsnull;
+  GetInsertionPoint(&aPresShell, aParentFrame, aOldFrame, &insertionPoint);
+  if (insertionPoint)
+    return insertionPoint->RemoveFrame(aPresContext, aPresShell, aListName, aOldFrame);
+
   return aParentFrame->RemoveFrame(aPresContext, aPresShell, aListName,
                                    aOldFrame);
 }
@@ -2278,6 +2322,76 @@ FrameManager::RemoveFrameProperty(nsIFrame* aFrame,
   return result;
 }
 
+NS_IMETHODIMP
+FrameManager::GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aParent, nsIFrame* aChild, nsIFrame** aResult)
+{
+  *aResult = nsnull;
+
+  nsCOMPtr<nsIContent> content;
+  aParent->GetContent(getter_AddRefs(content));
+  if (!content)
+    return NS_OK;
+  nsCOMPtr<nsIDocument> document;
+  content->GetDocument(*getter_AddRefs(document));
+  if (!document)
+    return NS_OK;
+
+  nsCOMPtr<nsIBindingManager> bindingManager;
+  document->GetBindingManager(getter_AddRefs(bindingManager));
+  if (!bindingManager)
+    return NS_OK;
+
+  nsCOMPtr<nsIContent> insertionElement;
+  nsIFrame* frame = nsnull;
+  if (aChild) {
+    nsCOMPtr<nsIContent> currContent;
+    aChild->GetContent(getter_AddRefs(currContent));
+
+    // Check to see if the content is anonymous.
+    nsCOMPtr<nsIContent> bindingParent;
+    currContent->GetBindingParent(getter_AddRefs(bindingParent));
+    if (bindingParent == content)
+      return NS_OK; // It is anonymous. Don't use the insertion point, since that's only
+                    // for the explicit kids.
+
+    bindingManager->GetInsertionPoint(content, currContent, getter_AddRefs(insertionElement));
+    if (insertionElement) {
+      aShell->GetPrimaryFrameFor(insertionElement, &frame);
+      if (frame) {
+        nsCOMPtr<nsIScrollableFrame> scroll(do_QueryInterface(frame));
+        if (scroll)
+          scroll->GetScrolledFrame(nsnull, frame);
+        if (frame != aParent) {
+          nsIFrame* nestedPoint = nsnull;
+          GetInsertionPoint(aShell, frame, aChild, &nestedPoint);
+          *aResult = nestedPoint ? nestedPoint : frame;
+        }
+      }
+      return NS_OK;
+    }
+  }
+  else {
+    PRBool dummy;
+    bindingManager->GetSingleInsertionPoint(content, getter_AddRefs(insertionElement), &dummy);
+    if (insertionElement) {
+      aShell->GetPrimaryFrameFor(insertionElement, &frame);
+      if (frame) {
+        nsCOMPtr<nsIScrollableFrame> scroll(do_QueryInterface(frame));
+        if (scroll)
+          scroll->GetScrolledFrame(nsnull, frame);
+        if (frame != aParent) {
+          nsIFrame* nestedPoint = nsnull;
+          GetInsertionPoint(aShell, frame, aChild, &nestedPoint);
+          *aResult = nestedPoint ? nestedPoint : frame;
+        }
+      }
+      return NS_OK;
+    }
+  }
+
+  return NS_OK;
+}
+
 //----------------------------------------------------------------------
 
 MOZ_DECL_CTOR_COUNTER(UndisplayedMap);

layout/xul/base/src/nsBoxFrame.cpp

@@ -1059,11 +1059,6 @@ nsBoxFrame::RemoveFrame(nsIPresContext* aPresContext,
                            nsIAtom* aListName,
                            nsIFrame* aOldFrame)
 {
-  nsIFrame* insertionPoint = nsnull;
-  GetInsertionPoint(&aPresShell, this, aOldFrame, &insertionPoint);
-  if (insertionPoint)
-    return insertionPoint->RemoveFrame(aPresContext, aPresShell, aListName, aOldFrame);
-
   SanityCheck(mFrames);
 
   // remove child from our info list
@@ -1088,23 +1083,6 @@ nsBoxFrame::InsertFrames(nsIPresContext* aPresContext,
                             nsIFrame* aPrevFrame,
                             nsIFrame* aFrameList)
 {
-   nsIFrame* insertionPoint = nsnull;
-   GetInsertionPoint(&aPresShell, this, aFrameList, &insertionPoint);
-   if (insertionPoint) {
-     // First insert the frames.
-     nsresult rv = insertionPoint->InsertFrames(aPresContext, aPresShell, aListName, aPrevFrame, aFrameList);
-     
-     // Now reparent the style contexts to keep the frames in sync.
-     nsIFrame* walkit = aFrameList;
-     nsCOMPtr<nsIStyleContext> styleContext;
-     insertionPoint->GetStyleContext(getter_AddRefs(styleContext));
-     while (walkit) {
-       aPresContext->ReParentStyleContext(walkit, styleContext);
-       walkit->GetNextSibling(&walkit);
-     }
-     return rv;
-   }
-
    SanityCheck(mFrames);
 
    nsIBox* prevBox = GetBox(aPrevFrame);
@@ -1139,23 +1117,6 @@ nsBoxFrame::AppendFrames(nsIPresContext* aPresContext,
                            nsIAtom*        aListName,
                            nsIFrame*       aFrameList)
 {
-   nsIFrame* insertionPoint = nsnull;
-   GetInsertionPoint(&aPresShell, this, aFrameList, &insertionPoint);
-   if (insertionPoint) {
-     // First append the frames.
-     nsresult rv = insertionPoint->AppendFrames(aPresContext, aPresShell, aListName, aFrameList);
-
-     // Now reparent the style contexts to keep the frames in sync.
-     nsIFrame* walkit = aFrameList;
-     nsCOMPtr<nsIStyleContext> styleContext;
-     insertionPoint->GetStyleContext(getter_AddRefs(styleContext));
-     while (walkit) {
-       aPresContext->ReParentStyleContext(walkit, styleContext);
-       walkit->GetNextSibling(&walkit);
-     }
-     return rv;
-   }
-
    SanityCheck(mFrames);
 
     // append them after
@@ -1857,72 +1818,6 @@ nsBoxFrame::GetCursor(nsIPresContext* aPresContext,
     return rv;
 }
 
-void
-nsBoxFrame::GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aParent, nsIFrame* aChild, nsIFrame** aResult)
-{
-  *aResult = nsnull;
-
-  nsCOMPtr<nsIContent> content;
-  aParent->GetContent(getter_AddRefs(content));
-  if (!content)
-    return;
-  nsCOMPtr<nsIDocument> document;
-  content->GetDocument(*getter_AddRefs(document));
-  if (!document)
-    return;
-
-  nsCOMPtr<nsIBindingManager> bindingManager;
-  document->GetBindingManager(getter_AddRefs(bindingManager));
-  if (!bindingManager)
-    return;
-  nsCOMPtr<nsIContent> insertionElement;
-  nsIFrame* frame = nsnull;
-  if (aChild) {
-    nsCOMPtr<nsIContent> currContent;
-    aChild->GetContent(getter_AddRefs(currContent));
-
-    // Check to see if the content is anonymous.
-    nsCOMPtr<nsIContent> bindingParent;
-    currContent->GetBindingParent(getter_AddRefs(bindingParent));
-    if (bindingParent == content)
-      return; // It is anonymous. Don't use the insertion point, since that's only
-              // for the explicit kids.
-
-    bindingManager->GetInsertionPoint(content, currContent, getter_AddRefs(insertionElement));
-    if (insertionElement) {
-      aShell->GetPrimaryFrameFor(insertionElement, &frame);
-      if (frame) {
-        nsCOMPtr<nsIScrollableFrame> scroll(do_QueryInterface(frame));
-        if (scroll)
-          scroll->GetScrolledFrame(nsnull, frame);
-        if (frame != aParent) {
-          nsIFrame* nestedPoint = nsnull;
-          GetInsertionPoint(aShell, frame, aChild, &nestedPoint);
-          *aResult = nestedPoint ? nestedPoint : frame;
-        }
-      }
-      return;
-    }
-  }
-  else {
-    PRBool dummy;
-    bindingManager->GetSingleInsertionPoint(content, getter_AddRefs(insertionElement), &dummy);
-    if (insertionElement) {
-      aShell->GetPrimaryFrameFor(insertionElement, &frame);
-      if (frame) {
-        nsCOMPtr<nsIScrollableFrame> scroll(do_QueryInterface(frame));
-        if (scroll)
-          scroll->GetScrolledFrame(nsnull, frame);
-        if (frame != aParent) {
-          nsIFrame* nestedPoint = nsnull;
-          GetInsertionPoint(aShell, frame, aChild, &nestedPoint);
-          *aResult = nestedPoint ? nestedPoint : frame;
-        }
-      }
-      return;
-    }
-  }
-}
 
 //XXX the event come's in in view relative coords, but really should
 //be in frame relative coords by the time it hits our frame.

layout/xul/base/src/nsBoxFrame.h

@@ -208,8 +208,6 @@ protected:
   
     NS_IMETHOD  Destroy(nsIPresContext* aPresContext);
 
-    static void GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aParent, nsIFrame* aChild, nsIFrame** aResult);
-
     nsSize mPrefSize;
     nsSize mMinSize;
     nsSize mMaxSize;

layout/xul/base/src/nsMenuBarFrame.cpp

@@ -39,6 +39,7 @@
 #include "nsMenuFrame.h"
 #include "nsIView.h"
 #include "nsIViewManager.h"
+#include "nsIFrameManager.h"
 #include "nsMenuPopupFrame.h"
 
 static NS_DEFINE_IID(kIFrameIID, NS_IFRAME_IID);
@@ -213,6 +214,14 @@ nsMenuBarFrame::ToggleMenuActiveState()
   }
 }
 
+static void GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aFrame, nsIFrame* aChild,
+                              nsIFrame** aResult)
+{
+  nsCOMPtr<nsIFrameManager> frameManager;
+  aShell->GetFrameManager(getter_AddRefs(frameManager));
+  frameManager->GetInsertionPoint(aShell, aFrame, aChild, aResult);
+}
+
 nsIMenuFrame*
 nsMenuBarFrame::FindMenuWithShortcut(PRUint32 aLetter)
 {

layout/xul/base/src/nsMenuPopupFrame.cpp

@@ -52,6 +52,7 @@
 #include "nsIComponentManager.h"
 #include "nsBoxLayoutState.h"
 #include "nsIScrollableView.h"
+#include "nsIFrameManager.h"
 
 static NS_DEFINE_IID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
 static NS_DEFINE_IID(kILookAndFeelIID, NS_ILOOKANDFEEL_IID);
@@ -740,6 +741,13 @@ nsMenuPopupFrame::SyncViewWithFrame(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
+static void GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aFrame, nsIFrame* aChild,
+                              nsIFrame** aResult)
+{
+  nsCOMPtr<nsIFrameManager> frameManager;
+  aShell->GetFrameManager(getter_AddRefs(frameManager));
+  frameManager->GetInsertionPoint(aShell, aFrame, aChild, aResult);
+}
 
 NS_IMETHODIMP
 nsMenuPopupFrame::GetNextMenuItem(nsIMenuFrame* aStart, nsIMenuFrame** aResult)