Issue #1860 - Follow-up: Make sure we don't add duplicate frames

Changing to vector makes manipulating display list items more risky.
This is to make sure we don't inadvertently end up with duplicates in
the list of display items avoiding double-free scenarios.

1 files changed, 6 insertions, 1 deletions

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index aa49c74cee..ff4661e1c8 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -162,7 +162,12 @@ void
 FrameLayerBuilder::DisplayItemData::AddFrame(nsIFrame* aFrame)
 {
   MOZ_RELEASE_ASSERT(mLayer);
-  mFrameList.AppendElement(aFrame);
+  
+  // Make sure we don't add duplicate frames as we're storing these as vectors.
+  // See UXP Issue #1860
+  if (!mFrameList.Contains(aFrame)) {
+    mFrameList.AppendElement(aFrame);
+  }
 
   nsTArray<DisplayItemData*>* array =
     aFrame->GetProperty(FrameLayerBuilder::LayerManagerDataProperty());