erge for backout

content/base/src/nsDocument.cpp

@@ -312,6 +312,11 @@ nsIdentifierMapEntry::~nsIdentifierMapEntry()
   if (mNameContentList && mNameContentList != NAME_NOT_VALID) {
     NS_RELEASE(mNameContentList);
   }
+
+  for (PRInt32 i = 0; i < mIdContentList.Count(); ++i) {
+    nsIContent* content = static_cast<nsIContent*>(mIdContentList[i]);
+    NS_RELEASE(content);
+  }
 }
 
 void
@@ -325,6 +330,12 @@ nsIdentifierMapEntry::Traverse(nsCycleCollectionTraversalCallback* aCallback)
 
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*aCallback, "mIdentifierMap mDocAllList");
   aCallback->NoteXPCOMChild(static_cast<nsIDOMNodeList*>(mDocAllList));
+
+  for (PRInt32 i = 0; i < mIdContentList.Count(); ++i) {
+    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(*aCallback,
+                                       "mIdentifierMap mIdContentList element");
+    aCallback->NoteXPCOMChild(static_cast<nsIContent*>(mIdContentList[i]));
+  }
 }
 
 void
@@ -430,6 +441,7 @@ nsIdentifierMapEntry::AddIdContent(nsIContent* aContent)
   if (mIdContentList.Count() == 0) {
     if (!mIdContentList.AppendElement(aContent))
       return PR_FALSE;
+    NS_ADDREF(aContent);
     NS_ASSERTION(currentContent == nsnull, "How did that happen?");
     FireChangeCallbacks(nsnull, aContent);
     return PR_TRUE;
@@ -462,6 +474,7 @@ nsIdentifierMapEntry::AddIdContent(nsIContent* aContent)
 
   if (!mIdContentList.InsertElementAt(aContent, start))
     return PR_FALSE;
+  NS_ADDREF(aContent);
   if (start == 0) {
     nsIContent* oldContent =
       static_cast<nsIContent*>(mIdContentList.SafeElementAt(1));
@@ -482,6 +495,7 @@ nsIdentifierMapEntry::RemoveIdContent(nsIContent* aContent)
   nsIContent* currentContent = static_cast<nsIContent*>(mIdContentList.SafeElementAt(0));
   if (!mIdContentList.RemoveElement(aContent))
     return PR_FALSE;
+  NS_RELEASE(aContent);
   if (currentContent == aContent) {
     FireChangeCallbacks(currentContent,
                         static_cast<nsIContent*>(mIdContentList.SafeElementAt(0)));
@@ -2389,11 +2403,6 @@ nsDocument::ContentAppended(nsIDocument* aDocument,
 {
   NS_ASSERTION(aDocument == this, "unexpected doc");
 
-  if (aContainer->GetBindingParent()) {
-    // Anonymous node; bail out
-    return;
-  }
-
   for (nsINode::ChildIterator iter(aContainer, aNewIndexInContainer);
        !iter.IsDone();
        iter.Next()) {
@@ -2411,11 +2420,6 @@ nsDocument::ContentInserted(nsIDocument* aDocument,
 
   NS_ABORT_IF_FALSE(aContent, "Null content!");
 
-  if (aContent->GetBindingParent()) {
-    // Anonymous node; bail out
-    return;
-  }
-
   RegisterNamedItems(aContent);
 }
 
@@ -2429,11 +2433,6 @@ nsDocument::ContentRemoved(nsIDocument* aDocument,
 
   NS_ABORT_IF_FALSE(aChild, "Null content!");
 
-  if (aChild->GetBindingParent()) {
-    // Anonymous node; bail out
-    return;
-  }
-
   UnregisterNamedItems(aChild);
 }
 
@@ -2445,11 +2444,6 @@ nsDocument::AttributeWillChange(nsIDocument* aDocument,
   NS_ABORT_IF_FALSE(aContent, "Null content!");
   NS_PRECONDITION(aAttribute, "Must have an attribute that's changing!");
 
-  if (aContent->GetBindingParent()) {
-    // Anonymous node; bail out
-    return;
-  }
-
   if (aNameSpaceID != kNameSpaceID_None)
     return;
   if (aAttribute == nsGkAtoms::name) {
@@ -2470,11 +2464,6 @@ nsDocument::AttributeChanged(nsIDocument* aDocument,
   NS_ABORT_IF_FALSE(aContent, "Null content!");
   NS_PRECONDITION(aAttribute, "Must have an attribute that's changing!");
 
-  if (aContent->GetBindingParent()) {
-    // Anonymous node; bail out
-    return;
-  }
-
   if (aNameSpaceID != kNameSpaceID_None)
     return;
   if (aAttribute == nsGkAtoms::name) {
@@ -6967,6 +6956,10 @@ nsDocument::Destroy()
   // XXX We really should let cycle collection do this, but that currently still
   //     leaks (see https://bugzilla.mozilla.org/show_bug.cgi?id=406684).
   nsContentUtils::ReleaseWrapper(static_cast<nsINode*>(this), this);
+
+  // Try really really hard to make sure we don't leak things through
+  // mIdentifierMap
+  mIdentifierMap.Clear();
 }
 
 void

content/base/src/nsDocument.h

@@ -320,7 +320,8 @@ public:
 private:
   void FireChangeCallbacks(nsIContent* aOldContent, nsIContent* aNewContent);
 
-  // empty if there are no nodes with this ID
+  // empty if there are no nodes with this ID.
+  // The content nodes are stored addrefed.
   nsSmallVoidArray mIdContentList;
   // NAME_NOT_VALID if this id cannot be used as a 'name'
   nsBaseContentList *mNameContentList;

content/base/test/Makefile.in

@@ -318,7 +318,6 @@ _TEST_FILES = 	test_bug5141.html \
 		bug466409-empty.css \
 		test_bug466409.html \
 		test_classList.html \
-		test_bug489925.xhtml \
 		test_bug514487.html \
 		test_range_bounds.html \
 		$(NULL)

content/base/test/test_bug489925.xhtml

@@ -1,87 +0,0 @@
-<html xmlns="http://www.w3.org/1999/xhtml">
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=489925
--->
-<head>
-  <title>Test for Bug 489925</title>
-  <script type="application/javascript" src="/MochiKit/packed.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-
-  <bindings xmlns="http://www.mozilla.org/xbl">
-    <binding id="t1">
-      <content>
-        <h:span anonid="test" xmlns:h="http://www.w3.org/1999/xhtml">
-          <children/>
-        </h:span>
-      </content>
-      <implementation>
-        <constructor>
-          document.getAnonymousElementByAttribute(this, "anonid", "test").id = "test1";
-        </constructor>
-      </implementation>
-    </binding>
-
-    <binding id="t2">
-      <content>
-        <h:span anonid="test" xmlns:h="http://www.w3.org/1999/xhtml">
-          <children/>
-        </h:span>
-      </content>
-      <implementation>
-        <constructor>
-          var s = document.createElement("span");
-          s.id = "test2";
-          document.getAnonymousElementByAttribute(this, "anonid", "test").appendChild(s);
-        </constructor>
-      </implementation>
-    </binding>
-
-    <binding id="t3">
-      <content>
-        <h:span anonid="test" xmlns:h="http://www.w3.org/1999/xhtml">
-          <children/>
-        </h:span>
-      </content>
-      <implementation>
-        <constructor>
-          var s = document.createElement("span");
-          s.id = "test3";
-          var p = document.getAnonymousElementByAttribute(this, "anonid", "test");
-          p.appendChild(document.createTextNode("testing"));
-          p.insertBefore(s, p.lastChild);
-        </constructor>
-      </implementation>
-    </binding>
-  </bindings>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=489925">Mozilla Bug 489925</a>
-<p id="display">
-  <span style="-moz-binding: url(#t1)"/>
-  <span style="-moz-binding: url(#t2)"/>
-  <span style="-moz-binding: url(#t3)"/>
-</p>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-<script type="application/javascript">
-<![CDATA[
-
-/** Test for Bug 489925 **/
-SimpleTest.waitForExplicitFinish();
-addLoadEvent(function() {
- is($("test1"), null, "Setting id should not add anonymous element to table");
- is($("test2"), null, "Append should not add anonymous element to table");
- is($("test3"), null, "Insert should not add anonymous element to table");
- SimpleTest.finish();
-});
-
-
-
-]]>
-</script>
-</pre>
-</body>
-</html>

js/src/xpconnect/src/XPCNativeWrapper.cpp

@@ -418,7 +418,7 @@ XPC_NW_DelProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     }
   );
 
-  return ThrowException(NS_ERROR_XPC_SECURITY_MANAGER_VETO, cx);
+  return JS_TRUE;
 }
 
 JSBool

modules/plugin/test/mochitest/test_npruntime_npninvokedefault.html

@@ -52,7 +52,7 @@
     ["Boolean", new Boolean(false), true],
     ["Boolean", { "value": false }, true],
     // Date object
-    ["Date", "December 17, 1995 03:24:00", Date("December 17, 1995 03:24:00")],
+    // ["Date", "December 17, 1995 03:24:00", Date("December 17, 1995 03:24:00")],
     // Function object
     ["Function", "return 3", Function("return 3")],
     ["Function", "window.alert('test')", Function("window.alert('test')")],