Bug 1420547: Fix removal of <area> elements from an image map. r?bz draft
authorEmilio Cobos Álvarez <emilio@crisal.io>
Wed, 13 Dec 2017 01:58:48 +0100
changeset 713799 d1922e351eea2868ab80e1fbaa7d207723673191
parent 713798 2a4ce01d57cbb4fc301b0cab83824d23d77c0ed0
child 713800 d33d7bb985f4c1c86a996c8d354e7fdb1e5bfd8f
push id93751
push userbmo:emilio@crisal.io
push dateWed, 20 Dec 2017 23:52:04 +0000
reviewersbz
bugs1420547
milestone59.0a1
Bug 1420547: Fix removal of <area> elements from an image map. r?bz This code was relying on nsImageFrame::ContentRemoved running before it. MozReview-Commit-ID: Imjhd9exjQS
layout/base/nsCSSFrameConstructor.cpp
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -8433,16 +8433,17 @@ nsCSSFrameConstructor::ContentRemoved(ns
     }
   }
 #endif
 
   nsIFrame* childFrame = aChild->GetPrimaryFrame();
   if (!childFrame || childFrame->GetContent() != aChild) {
     // XXXbz the GetContent() != aChild check is needed due to bug 135040.
     // Remove it once that's fixed.
+    childFrame = nullptr;
     UnregisterDisplayNoneStyleFor(aChild, aContainer);
   }
   MOZ_ASSERT(!childFrame || !GetDisplayContentsStyleFor(aChild),
              "display:contents nodes shouldn't have a frame");
   if (!childFrame && GetDisplayContentsStyleFor(aChild)) {
     if (HasGeneratedContent(aChild)) {
       nsIContent* ancestor = aChild->GetFlattenedTreeParent();
       MOZ_ASSERT(ancestor, "display: contents on the root?");