From 7c5bcb4672d7ea0d2f045b5f7de841f8ff385f48 Mon Sep 17 00:00:00 2001
From: "roc+%cs.cmu.edu" <roc+%cs.cmu.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sun, 6 Nov 2005 22:47:10 +0000
Subject: [PATCH] Bug 315127. Go back to allocating NS_NewDirectionalFrame on
 the heap, to fix crash regression. r+sr=dbaron

git-svn-id: svn://10.0.0.236/trunk@184225 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/layout/generic/nsBidiFrames.cpp | 12 +++++++++++-
 mozilla/layout/generic/nsBidiFrames.h   |  2 ++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/mozilla/layout/generic/nsBidiFrames.cpp b/mozilla/layout/generic/nsBidiFrames.cpp
index ba7a98ed52f..a7da32b42ac 100644
--- a/mozilla/layout/generic/nsBidiFrames.cpp
+++ b/mozilla/layout/generic/nsBidiFrames.cpp
@@ -90,10 +90,20 @@ nsDirectionalFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
   return rv;
 }
 
+void*
+nsDirectionalFrame::operator new(size_t aSize) CPP_THROW_NEW
+{
+  void* frame = ::operator new(aSize);
+  if (frame) {
+    memset(frame, 0, aSize);
+  }
+  return frame;
+}
+
 nsIFrame*
 NS_NewDirectionalFrame(nsIPresShell* aPresShell, PRUnichar aChar)
 {
-  return new (aPresShell) nsDirectionalFrame(aChar);
+  return new nsDirectionalFrame(aChar);
 }
 
 #endif /* IBMBIDI */
diff --git a/mozilla/layout/generic/nsBidiFrames.h b/mozilla/layout/generic/nsBidiFrames.h
index 5485dc8517b..67a99268d61 100644
--- a/mozilla/layout/generic/nsBidiFrames.h
+++ b/mozilla/layout/generic/nsBidiFrames.h
@@ -57,6 +57,8 @@ protected:
 public:
   nsDirectionalFrame(PRUnichar aChar);
 
+  void* operator new(size_t aSize) CPP_THROW_NEW;
+
   static const nsIID& GetIID();
 
   NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);