From 09ccc1e701fb6e53cecb717cf26a32db7f8a820b Mon Sep 17 00:00:00 2001
From: "dbaron%dbaron.org"
 <dbaron%dbaron.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 17 Jan 2007 09:24:19 +0000
Subject: [PATCH] Fix error tracking size of circularly linked list of
 counters, causing mis-sorting.  b=367220  r+sr=roc

git-svn-id: svn://10.0.0.236/trunk@218502 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/layout/base/nsGenConList.cpp | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/mozilla/layout/base/nsGenConList.cpp b/mozilla/layout/base/nsGenConList.cpp
index 455b956cfa3..9c1af45d9cb 100644
--- a/mozilla/layout/base/nsGenConList.cpp
+++ b/mozilla/layout/base/nsGenConList.cpp
@@ -69,14 +69,14 @@ nsGenConList::DestroyNodesFor(nsIFrame* aFrame)
   while (mFirstNode->mPseudoFrame == aFrame) {
     destroyed = PR_TRUE;
     node = Next(mFirstNode);
-    if (node == mFirstNode) { // Last link
+    PRBool isLastNode = node == mFirstNode; // before they're dangling
+    Remove(mFirstNode);
+    delete mFirstNode;
+    if (isLastNode) {
       mFirstNode = nsnull;
-      delete node;
       return PR_TRUE;
     }
     else {
-      Remove(mFirstNode);
-      delete mFirstNode;
       mFirstNode = node;
     }
   }
@@ -134,6 +134,7 @@ nsGenConList::NodeAfter(const nsGenConNode* aNode1, const nsGenConNode* aNode2)
       return pseudoType1 == 1;
     }
   }
+  // XXX Switch to the frame version of DoCompareTreePosition?
   PRInt32 cmp = nsLayoutUtils::DoCompareTreePosition(content1, content2,
                                                      pseudoType1, -pseudoType2);
   NS_ASSERTION(cmp != 0, "same content, different frames");
@@ -152,6 +153,7 @@ nsGenConList::Insert(nsGenConNode* aNode)
       // Binary search.
 
       // the range of indices at which |aNode| could end up.
+      // (We already know it can't be at index mSize.)
       PRUint32 first = 0, last = mSize - 1;
 
       // A cursor to avoid walking more than the length of the list.
@@ -189,4 +191,9 @@ nsGenConList::Insert(nsGenConNode* aNode)
     mFirstNode = aNode;
   }
   ++mSize;
+
+  NS_ASSERTION(aNode == mFirstNode || NodeAfter(aNode, Prev(aNode)),
+               "sorting error");
+  NS_ASSERTION(IsLast(aNode) || NodeAfter(Next(aNode), aNode),
+               "sorting error");
 }