bug 176030 - Make Destroy fix up prev/next-in-flow pointers. a=roc, sr=bzbarsky, r=bernd.

layout/generic/nsBlockFrame.cpp

@@ -5112,7 +5112,6 @@ nsBlockFrame::DoRemoveOutOfFlowFrame(nsIPresContext* aPresContext,
     block->mFloaters.RemoveFrame(aFrame);
   }
   // Destroy aFrame
-  nsSplittableFrame::RemoveFromFlow(aFrame);
   aFrame->Destroy(aPresContext);
 }
 
@@ -5210,11 +5209,6 @@ nsBlockFrame::DoRemoveFrame(nsIPresContext* aPresContext,
       // to destroy that too.
       nsIFrame* nextInFlow;
       aDeletedFrame->GetNextInFlow(&nextInFlow);
-      nsSplittableType st;
-      aDeletedFrame->IsSplittable(st);
-      if (NS_FRAME_NOT_SPLITTABLE != st) {
-        nsSplittableFrame::RemoveFromFlow(aDeletedFrame);
-      }
 #ifdef NOISY_REMOVE_FRAME
       printf("DoRemoveFrame: line=%p frame=", line);
       nsFrame::ListTag(stdout, aDeletedFrame);

layout/generic/nsContainerFrame.cpp

@@ -139,8 +139,8 @@ nsContainerFrame::Destroy(nsIPresContext* aPresContext)
   // Delete the primary child list
   mFrames.DestroyFrames(aPresContext);
 
-  // Base class will destroy the frame
-  return nsFrame::Destroy(aPresContext);
+  // Destroy the frame and remove the flow pointers
+  return nsSplittableFrame::Destroy(aPresContext);
 }
 
 /////////////////////////////////////////////////////////////////////////////
@@ -1101,7 +1101,7 @@ nsContainerFrame::DeleteNextInFlowChild(nsIPresContext* aPresContext,
     }
   }
 
-  // Delete the next-in-flow frame
+  // Delete the next-in-flow frame and its descendants.
   aNextInFlow->Destroy(aPresContext);
 
 #ifdef NS_DEBUG

layout/generic/nsInlineFrame.cpp

@@ -288,11 +288,6 @@ nsInlineFrame::RemoveFrame(nsIPresContext* aPresContext,
       // command.
       nsIFrame* oldFrameNextInFlow;
       aOldFrame->GetNextInFlow(&oldFrameNextInFlow);
-      nsSplittableType st;
-      aOldFrame->IsSplittable(st);
-      if (NS_FRAME_NOT_SPLITTABLE != st) {
-        nsSplittableFrame::RemoveFromFlow(aOldFrame);
-      }
       parent->mFrames.DestroyFrame(aPresContext, aOldFrame);
       aOldFrame = oldFrameNextInFlow;
       if (nsnull != aOldFrame) {

layout/generic/nsSplittableFrame.cpp

@@ -60,6 +60,18 @@ nsSplittableFrame::Init(nsIPresContext*  aPresContext,
   return rv;
 }
 
+NS_IMETHODIMP
+nsSplittableFrame::Destroy(nsIPresContext* aPresContext)
+{
+  // Disconnect from the flow list
+  if (mPrevInFlow || mNextInFlow) {
+    RemoveFromFlow(this);
+  }
+
+  // Let the base class destroy the frame
+  return nsFrame::Destroy(aPresContext);
+}
+
 NS_IMETHODIMP
 nsSplittableFrame::IsSplittable(nsSplittableType& aIsSplittable) const
 {

layout/generic/nsSplittableFrame.h

@@ -50,6 +50,9 @@ public:
                   nsIFrame*        aPrevInFlow);
   
   NS_IMETHOD  IsSplittable(nsSplittableType& aIsSplittable) const;
+
+  NS_IMETHOD Destroy(nsIPresContext* aPresContext);
+
 #ifdef DEBUG
   NS_IMETHOD  SizeOf(nsISizeOfHandler* aHandler, PRUint32* aResult) const;
 #endif

layout/generic/nsTextFrame.cpp

@@ -415,6 +415,8 @@ public:
                    nsFramePaintLayer    aWhichLayer,
                    PRUint32             aFlags);
 
+  NS_IMETHOD Destroy(nsIPresContext* aPresContext);
+
   NS_IMETHOD GetCursor(nsIPresContext* aPresContext,
                        nsPoint& aPoint,
                        PRInt32& aCursor);
@@ -863,6 +865,16 @@ NS_IMETHODIMP nsTextFrame::QueryInterface(const nsIID& aIID,
   return nsFrame::QueryInterface(aIID, aInstancePtrResult);
 }
 
+NS_IMETHODIMP
+nsTextFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (mNextInFlow) {
+    mNextInFlow->SetPrevInFlow(nsnull);
+  }
+  // Let the base class destroy the frame
+  return nsFrame::Destroy(aPresContext);
+}
+
 class nsContinuingTextFrame : public nsTextFrame {
 public:
   NS_IMETHOD Init(nsIPresContext*  aPresContext,
@@ -871,6 +883,8 @@ public:
                   nsIStyleContext* aContext,
                   nsIFrame*        aPrevInFlow);
 
+  NS_IMETHOD Destroy(nsIPresContext* aPresContext);
+
   NS_IMETHOD GetPrevInFlow(nsIFrame** aPrevInFlow) const {
     *aPrevInFlow = mPrevInFlow;
     return NS_OK;
@@ -937,6 +951,16 @@ nsContinuingTextFrame::Init(nsIPresContext*  aPresContext,
   return rv;
 }
 
+NS_IMETHODIMP
+nsContinuingTextFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (mPrevInFlow || mNextInFlow) {
+    nsSplittableFrame::RemoveFromFlow(this);
+  }
+  // Let the base class destroy the frame
+  return nsFrame::Destroy(aPresContext);
+}
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsContinuingTextFrame::SizeOf(nsISizeOfHandler* aHandler, PRUint32* aResult) const

layout/html/base/src/nsBlockFrame.cpp

@@ -5112,7 +5112,6 @@ nsBlockFrame::DoRemoveOutOfFlowFrame(nsIPresContext* aPresContext,
     block->mFloaters.RemoveFrame(aFrame);
   }
   // Destroy aFrame
-  nsSplittableFrame::RemoveFromFlow(aFrame);
   aFrame->Destroy(aPresContext);
 }
 
@@ -5210,11 +5209,6 @@ nsBlockFrame::DoRemoveFrame(nsIPresContext* aPresContext,
       // to destroy that too.
       nsIFrame* nextInFlow;
       aDeletedFrame->GetNextInFlow(&nextInFlow);
-      nsSplittableType st;
-      aDeletedFrame->IsSplittable(st);
-      if (NS_FRAME_NOT_SPLITTABLE != st) {
-        nsSplittableFrame::RemoveFromFlow(aDeletedFrame);
-      }
 #ifdef NOISY_REMOVE_FRAME
       printf("DoRemoveFrame: line=%p frame=", line);
       nsFrame::ListTag(stdout, aDeletedFrame);

layout/html/base/src/nsContainerFrame.cpp

@@ -139,8 +139,8 @@ nsContainerFrame::Destroy(nsIPresContext* aPresContext)
   // Delete the primary child list
   mFrames.DestroyFrames(aPresContext);
 
-  // Base class will destroy the frame
-  return nsFrame::Destroy(aPresContext);
+  // Destroy the frame and remove the flow pointers
+  return nsSplittableFrame::Destroy(aPresContext);
 }
 
 /////////////////////////////////////////////////////////////////////////////
@@ -1101,7 +1101,7 @@ nsContainerFrame::DeleteNextInFlowChild(nsIPresContext* aPresContext,
     }
   }
 
-  // Delete the next-in-flow frame
+  // Delete the next-in-flow frame and its descendants.
   aNextInFlow->Destroy(aPresContext);
 
 #ifdef NS_DEBUG

layout/html/base/src/nsInlineFrame.cpp

@@ -288,11 +288,6 @@ nsInlineFrame::RemoveFrame(nsIPresContext* aPresContext,
       // command.
       nsIFrame* oldFrameNextInFlow;
       aOldFrame->GetNextInFlow(&oldFrameNextInFlow);
-      nsSplittableType st;
-      aOldFrame->IsSplittable(st);
-      if (NS_FRAME_NOT_SPLITTABLE != st) {
-        nsSplittableFrame::RemoveFromFlow(aOldFrame);
-      }
       parent->mFrames.DestroyFrame(aPresContext, aOldFrame);
       aOldFrame = oldFrameNextInFlow;
       if (nsnull != aOldFrame) {

layout/html/base/src/nsSplittableFrame.cpp

@@ -60,6 +60,18 @@ nsSplittableFrame::Init(nsIPresContext*  aPresContext,
   return rv;
 }
 
+NS_IMETHODIMP
+nsSplittableFrame::Destroy(nsIPresContext* aPresContext)
+{
+  // Disconnect from the flow list
+  if (mPrevInFlow || mNextInFlow) {
+    RemoveFromFlow(this);
+  }
+
+  // Let the base class destroy the frame
+  return nsFrame::Destroy(aPresContext);
+}
+
 NS_IMETHODIMP
 nsSplittableFrame::IsSplittable(nsSplittableType& aIsSplittable) const
 {

layout/html/base/src/nsSplittableFrame.h

@@ -50,6 +50,9 @@ public:
                   nsIFrame*        aPrevInFlow);
   
   NS_IMETHOD  IsSplittable(nsSplittableType& aIsSplittable) const;
+
+  NS_IMETHOD Destroy(nsIPresContext* aPresContext);
+
 #ifdef DEBUG
   NS_IMETHOD  SizeOf(nsISizeOfHandler* aHandler, PRUint32* aResult) const;
 #endif

layout/html/base/src/nsTextFrame.cpp

@@ -415,6 +415,8 @@ public:
                    nsFramePaintLayer    aWhichLayer,
                    PRUint32             aFlags);
 
+  NS_IMETHOD Destroy(nsIPresContext* aPresContext);
+
   NS_IMETHOD GetCursor(nsIPresContext* aPresContext,
                        nsPoint& aPoint,
                        PRInt32& aCursor);
@@ -863,6 +865,16 @@ NS_IMETHODIMP nsTextFrame::QueryInterface(const nsIID& aIID,
   return nsFrame::QueryInterface(aIID, aInstancePtrResult);
 }
 
+NS_IMETHODIMP
+nsTextFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (mNextInFlow) {
+    mNextInFlow->SetPrevInFlow(nsnull);
+  }
+  // Let the base class destroy the frame
+  return nsFrame::Destroy(aPresContext);
+}
+
 class nsContinuingTextFrame : public nsTextFrame {
 public:
   NS_IMETHOD Init(nsIPresContext*  aPresContext,
@@ -871,6 +883,8 @@ public:
                   nsIStyleContext* aContext,
                   nsIFrame*        aPrevInFlow);
 
+  NS_IMETHOD Destroy(nsIPresContext* aPresContext);
+
   NS_IMETHOD GetPrevInFlow(nsIFrame** aPrevInFlow) const {
     *aPrevInFlow = mPrevInFlow;
     return NS_OK;
@@ -937,6 +951,16 @@ nsContinuingTextFrame::Init(nsIPresContext*  aPresContext,
   return rv;
 }
 
+NS_IMETHODIMP
+nsContinuingTextFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (mPrevInFlow || mNextInFlow) {
+    nsSplittableFrame::RemoveFromFlow(this);
+  }
+  // Let the base class destroy the frame
+  return nsFrame::Destroy(aPresContext);
+}
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsContinuingTextFrame::SizeOf(nsISizeOfHandler* aHandler, PRUint32* aResult) const

layout/html/table/src/nsTableRowGroupFrame.cpp

@@ -1051,17 +1051,6 @@ nsTableRowGroupFrame::UndoContinuedRow(nsIPresContext*  aPresContext,
   aRow->GetNextSibling((nsIFrame**)&next);
   rowBefore->SetNextSibling(next);
 
-  // Remove the next-in-flow of the row, its cells and their cell blocks.
-  for (nsTableCellFrame* cell = aRow->GetFirstCell(); cell; cell->GetNextCell()) {
-    nsIFrame* cellBlock;
-    cell->FirstChild(aPresContext, nsnull, &cellBlock);
-    if (cellBlock) {
-      nsSplittableFrame::RemoveFromFlow(cellBlock);
-    }
-    nsSplittableFrame::RemoveFromFlow(cell);
-  }
-  nsSplittableFrame::RemoveFromFlow(aRow);
-
   // Destroy the row, its cells, and their cell blocks. Cell blocks that have split
   // will not have reflowed yet to pick up content from any overflow lines.
   aRow->Destroy(aPresContext);

layout/tables/nsTableRowGroupFrame.cpp

@@ -1051,17 +1051,6 @@ nsTableRowGroupFrame::UndoContinuedRow(nsIPresContext*  aPresContext,
   aRow->GetNextSibling((nsIFrame**)&next);
   rowBefore->SetNextSibling(next);
 
-  // Remove the next-in-flow of the row, its cells and their cell blocks.
-  for (nsTableCellFrame* cell = aRow->GetFirstCell(); cell; cell->GetNextCell()) {
-    nsIFrame* cellBlock;
-    cell->FirstChild(aPresContext, nsnull, &cellBlock);
-    if (cellBlock) {
-      nsSplittableFrame::RemoveFromFlow(cellBlock);
-    }
-    nsSplittableFrame::RemoveFromFlow(cell);
-  }
-  nsSplittableFrame::RemoveFromFlow(aRow);
-
   // Destroy the row, its cells, and their cell blocks. Cell blocks that have split
   // will not have reflowed yet to pick up content from any overflow lines.
   aRow->Destroy(aPresContext);