Bug 1389645: Don't incorrectly set lazy frame construction bits in ContentAppended and ContentRangeInserted. draft
authorEmilio Cobos Álvarez <emilio@crisal.io>
Fri, 25 Aug 2017 16:50:03 +0200
changeset 653082 c84a33f918ff9f17a555c8bf98ea85a16d08bdf2
parent 653081 832296cf0d86166965cb83e944b263fb461d1392
child 728256 307cbb6142b756faa121b3735d6dd583c14df02f
push id76234
push userbmo:emilio+bugs@crisal.io
push dateFri, 25 Aug 2017 14:52:07 +0000
bugs1389645
milestone57.0a1
Bug 1389645: Don't incorrectly set lazy frame construction bits in ContentAppended and ContentRangeInserted. Before this patch, we may get into that piece of code reentrantly from lazy frame construction itself leaving stale dirty bits around that we really don't want. MozReview-Commit-ID: 2wtKeF3o0Gr
layout/base/nsCSSFrameConstructor.cpp
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7680,17 +7680,17 @@ nsCSSFrameConstructor::ContentAppended(n
 
   if (!isNewShadowTreeContent) {
     // See comment in ContentRangeInserted for why this is necessary.
     if (!GetContentInsertionFrameFor(aContainer) &&
         !aContainer->IsActiveChildrenElement()) {
       // We're punting on frame construction because there's no container frame.
       // The Servo-backed style system handles this case like the lazy frame
       // construction case.
-      if (isNewlyAddedContentForServo) {
+      if (isNewlyAddedContentForServo && aAllowLazyConstruction) {
         LazilyStyleNewChildRange(aFirstNewContent, nullptr);
       }
       return;
     }
 
     if (aAllowLazyConstruction &&
         MaybeConstructLazily(CONTENTAPPEND, aContainer, aFirstNewContent)) {
       if (isNewlyAddedContentForServo) {
@@ -8164,17 +8164,17 @@ nsCSSFrameConstructor::ContentRangeInser
     nsContainerFrame* parentFrame = GetContentInsertionFrameFor(aContainer);
     // The xbl:children element won't have a frame, but default content can have the children as
     // a parent. While its uncommon to change the structure of the default content itself, a label,
     // for example, can be reframed by having its value attribute set or removed.
     if (!parentFrame && !aContainer->IsActiveChildrenElement()) {
       // We're punting on frame construction because there's no container frame.
       // The Servo-backed style system handles this case like the lazy frame
       // construction case.
-      if (isNewlyAddedContentForServo) {
+      if (isNewlyAddedContentForServo && aAllowLazyConstruction) {
         LazilyStyleNewChildRange(aStartChild, aEndChild);
       }
       return;
     }
 
     // Otherwise, we've got parent content. Find its frame.
     NS_ASSERTION(!parentFrame || parentFrame->GetContent() == aContainer ||
                  GetDisplayContentsStyleFor(aContainer), "New XBL code is possibly wrong!");