bug 176030 - Make Destroy fix up prev/next-in-flow pointers. a=roc, sr=bzbarsky, r=bernd.

git-svn-id: svn://10.0.0.236/trunk@132710 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/html/base/src/nsTextFrame.cpp

@@ -415,6 +415,8 @@ public:
                    nsFramePaintLayer    aWhichLayer,
                    PRUint32             aFlags);
 
+  NS_IMETHOD Destroy(nsIPresContext* aPresContext);
+
   NS_IMETHOD GetCursor(nsIPresContext* aPresContext,
                        nsPoint& aPoint,
                        PRInt32& aCursor);
@@ -863,6 +865,16 @@ NS_IMETHODIMP nsTextFrame::QueryInterface(const nsIID& aIID,
   return nsFrame::QueryInterface(aIID, aInstancePtrResult);
 }
 
+NS_IMETHODIMP
+nsTextFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (mNextInFlow) {
+    mNextInFlow->SetPrevInFlow(nsnull);
+  }
+  // Let the base class destroy the frame
+  return nsFrame::Destroy(aPresContext);
+}
+
 class nsContinuingTextFrame : public nsTextFrame {
 public:
   NS_IMETHOD Init(nsIPresContext*  aPresContext,
@@ -871,6 +883,8 @@ public:
                   nsIStyleContext* aContext,
                   nsIFrame*        aPrevInFlow);
 
+  NS_IMETHOD Destroy(nsIPresContext* aPresContext);
+
   NS_IMETHOD GetPrevInFlow(nsIFrame** aPrevInFlow) const {
     *aPrevInFlow = mPrevInFlow;
     return NS_OK;
@@ -937,6 +951,16 @@ nsContinuingTextFrame::Init(nsIPresContext*  aPresContext,
   return rv;
 }
 
+NS_IMETHODIMP
+nsContinuingTextFrame::Destroy(nsIPresContext* aPresContext)
+{
+  if (mPrevInFlow || mNextInFlow) {
+    nsSplittableFrame::RemoveFromFlow(this);
+  }
+  // Let the base class destroy the frame
+  return nsFrame::Destroy(aPresContext);
+}
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsContinuingTextFrame::SizeOf(nsISizeOfHandler* aHandler, PRUint32* aResult) const