corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1845223 - Destroy ContainStyleScopes before recalculating counters & quotes during frame destruction r=emilio

Browse Source 
Instead of recalculating quotes and counter before destroying contain
style scopes, calculate them after. This prevents stale frame pointers
from sticking around during counter and quote recalculation.

Differential Revision: https://phabricator.services.mozilla.com/D188254
This commit is contained in:
Martin Robinson
2023-09-14 20:41:45 +00:00
parent e901524775
commit a03065ffcd
2 changed files with 32 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
layout/base/nsCSSFrameConstructor.cpp
View File

@@ -1478,6 +1478,10 @@ nsCSSFrameConstructor::nsCSSFrameConstructor(Document* aDocument,
}
void nsCSSFrameConstructor::NotifyDestroyingFrame(nsIFrame* aFrame) {
if (aFrame->StyleDisplay()->IsContainStyle()) {
mContainStyleScopeManager.DestroyScopesFor(aFrame);
}
if (aFrame->HasAnyStateBits(NS_FRAME_GENERATED_CONTENT) &&
mContainStyleScopeManager.DestroyQuoteNodesFor(aFrame)) {
QuotesDirty();
@@ -1491,10 +1495,6 @@ void nsCSSFrameConstructor::NotifyDestroyingFrame(nsIFrame* aFrame) {
CountersDirty();
}
if (aFrame->StyleDisplay()->IsContainStyle()) {
mContainStyleScopeManager.DestroyScopesFor(aFrame);
}
RestyleManager()->NotifyDestroyingFrame(aFrame);
}
@@ -3703,7 +3703,8 @@ nsCSSFrameConstructor::FindCanvasData(const Element& aElement,
return &sCanvasData;
}
static MOZ_NEVER_INLINE void DestroyFramesInList(PresShell* aPs, nsFrameList& aList) {
static MOZ_NEVER_INLINE void DestroyFramesInList(PresShell* aPs,
nsFrameList& aList) {
nsIFrame::DestroyContext context(aPs);
aList.DestroyFrames(context);
}