The nsCSSValue in nsGenericHTMLElement::MapBackgroundInto is a temporary. This causes a problem after Bug 697230 landed, because the nsCSSValue::Image we put into that value is destroyed once we're done doing style stuff. Previously the nsImageLoader would grab the request off the nsCSSValue::Image and hold it alive. Bug 697230 changed the behavior here; now when the nsCSSValue::Image is destroyed it tells the image loader to drop the request. The result is that all the references to the request are dropped and the frame is never told it has a background.
The solution is to keep the nsCSSValue::Image alive longer. This patch adds two new types of nsAttrValue. The first is an nsCSSValue::URL. A ParseBackgroundAttribute method is added on nsGenericHTMLElement that the relevant elements (body/td/th/table/tr/tbody/thead/tfoot) call that parses background into an nsCSSValue::URL. The second is an nsCSSValue::Image. nsGenericHTMLElement::MapBackgroundInto attempts to convert the nsCSSValue::URL into an nsCSSValue::Image by kicking off the image load. The result is that image loads are only started when the element is actually visible. This also mirrors the way background-image works. This also allows us to fix two longstanding bugs in this code. Since MapBackgroundInto doesn't have a pointer to the actual element, it relied on grabbing the principal of the document. Now we can grab the principal of the node in ParseBackgroundAttribute. MapBackgroundInto also has no way to get at the element's base URI (to honor xml:base), which is now possible in ParseBackgroundAttribute.
nsCSSValue::[Image|URL] have also been moved to be mozilla::css::[Image|URL]Value. nsAttrValue.h is included in external linkage code, so it can't include nsCSSValue.h to get the declarations of nsCSSValue::[Image|URL], and nested classes can't be forward declared. Moving the classes to a namespace solves the problem.
Finally some old inoperative quirks mode code was removed. This code has done nothing since Bug 273078 was landed in 2004.
This patch adds a change hint to signal that one of the offsets on a
frame has been changed. When processing the hint, we do one of the
following things based on the position property of the frame.
* For static frames, we ignore the offset changes completely, as they
will not change the layout.
* For relative positioned frames, this patch refactors the
nsHTMLReflowState::ComputeRelativeOffsets function so that it can be
used from other callers, and it uses that to compute the new relative
offsets, and uses the offsets computed previously to compute the new
position of the frame.
* For absolute positioned frames, we set up a fake parent reflow state
object, and then we create a new reflow state object for the frame in
question. This setup is similar to what nsFrame::BoxReflow does.
Once we have the new reflow state object, we use it to compute the
absolute offsets, and then we use the computed offsets to set the new
position of the frame. The offset computation is similar to what
nsAbsoluteContainingBlock::ReflowAbsoluteFrame does. In some cases
where it is possible for the dimensions of the frame to change based
on the offset changes, we fall back to a full reflow.
