Bug 315127. Go back to allocating NS_NewDirectionalFrame on the heap, to fix crash regression. r+sr=dbaron

git-svn-id: svn://10.0.0.236/trunk@184225 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/generic/nsBidiFrames.cpp

@@ -90,10 +90,20 @@ nsDirectionalFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
   return rv;
 }
 
+void*
+nsDirectionalFrame::operator new(size_t aSize) CPP_THROW_NEW
+{
+  void* frame = ::operator new(aSize);
+  if (frame) {
+    memset(frame, 0, aSize);
+  }
+  return frame;
+}
+
 nsIFrame*
 NS_NewDirectionalFrame(nsIPresShell* aPresShell, PRUnichar aChar)
 {
-  return new (aPresShell) nsDirectionalFrame(aChar);
+  return new nsDirectionalFrame(aChar);
 }
 
 #endif /* IBMBIDI */

mozilla/layout/generic/nsBidiFrames.h

@@ -57,6 +57,8 @@ protected:
 public:
   nsDirectionalFrame(PRUnichar aChar);
 
+  void* operator new(size_t aSize) CPP_THROW_NEW;
+
   static const nsIID& GetIID();
 
   NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);