bug 1460794, ensure the right document is used for DOMSubtreeModified event, r=hsivonen

--HG--
extra : rebase_source : 1363016f0a6da8ca2f5be4d0a21e1ee0a6376c1c
This commit is contained in:
Olli Pettay 2018-05-13 00:46:45 +03:00
Родитель d741942911
Коммит 41366ba801
7 изменённых файлов: 32 добавлений и 20 удалений

Просмотреть файл

@ -2342,13 +2342,11 @@ FragmentOrElement::FireNodeRemovedForChildren()
return;
}
nsCOMPtr<nsIDocument> owningDoc = doc;
nsCOMPtr<nsINode> child;
for (child = GetFirstChild();
child && child->GetParentNode() == this;
child = child->GetNextSibling()) {
nsContentUtils::MaybeFireNodeRemoved(child, this, doc);
nsContentUtils::MaybeFireNodeRemoved(child, this);
}
}

Просмотреть файл

@ -0,0 +1,19 @@
<script>
function go() {
b.addEventListener("DOMAttrModified", eh2);
e.setAttribute("lang", "en-us");
}
function eh1() {
a.getSVGDocument().adoptNode(c);
}
function eh2() {
d.addEventListener("DOMNodeRemoved", eh1);
d.innerHTML = undefined;
}
</script>
<body onload=go()>
<iframe id="a"></iframe>
<a id="c"/>
<g id="d">
<mask id="b"/>
<font-face-format id="e">

Просмотреть файл

@ -243,3 +243,4 @@ load 1449601.html
load 1445670.html
load 1458016.html
pref(dom.webcomponents.shadowdom.enabled,true) load 1459688.html
load 1460794.html

Просмотреть файл

@ -4731,12 +4731,11 @@ nsContentUtils::HasMutationListeners(nsIDocument* aDocument,
}
void
nsContentUtils::MaybeFireNodeRemoved(nsINode* aChild, nsINode* aParent,
nsIDocument* aOwnerDoc)
nsContentUtils::MaybeFireNodeRemoved(nsINode* aChild, nsINode* aParent)
{
MOZ_ASSERT(aChild, "Missing child");
MOZ_ASSERT(aChild->GetParentNode() == aParent, "Wrong parent");
MOZ_ASSERT(aChild->OwnerDoc() == aOwnerDoc, "Wrong owner-doc");
MOZ_ASSERT(aChild->OwnerDoc() == aParent->OwnerDoc(), "Wrong owner-doc");
// Having an explicit check here since it's an easy mistake to fall into,
// and there might be existing code with problems. We'd rather be safe
@ -4757,7 +4756,7 @@ nsContentUtils::MaybeFireNodeRemoved(nsINode* aChild, nsINode* aParent,
if (!(aChild->IsContent() && aChild->AsContent()->IsInNativeAnonymousSubtree()) &&
!sDOMNodeRemovedSuppressCount) {
NS_ERROR("Want to fire DOMNodeRemoved event, but it's not safe");
WarnScriptWasIgnored(aOwnerDoc);
WarnScriptWasIgnored(aChild->OwnerDoc());
}
return;
}
@ -4767,7 +4766,7 @@ nsContentUtils::MaybeFireNodeRemoved(nsINode* aChild, nsINode* aParent,
InternalMutationEvent mutation(true, eLegacyNodeRemoved);
mutation.mRelatedNode = do_QueryInterface(aParent);
mozAutoSubtreeModified subtree(aOwnerDoc, aParent);
mozAutoSubtreeModified subtree(aParent->OwnerDoc(), aParent);
EventDispatcher::Dispatch(aChild, nullptr, &mutation);
}
}
@ -5268,7 +5267,7 @@ nsContentUtils::SetNodeTextContent(nsIContent* aContent,
skipFirst = false;
continue;
}
nsContentUtils::MaybeFireNodeRemoved(child, aContent, doc);
nsContentUtils::MaybeFireNodeRemoved(child, aContent);
}
}
}

Просмотреть файл

@ -1343,10 +1343,8 @@ public:
*
* @param aChild The node to fire DOMNodeRemoved at.
* @param aParent The parent of aChild.
* @param aOwnerDoc The ownerDocument of aChild.
*/
static void MaybeFireNodeRemoved(nsINode* aChild, nsINode* aParent,
nsIDocument* aOwnerDoc);
static void MaybeFireNodeRemoved(nsINode* aChild, nsINode* aParent);
/**
* This method creates and dispatches a trusted event.

Просмотреть файл

@ -7038,8 +7038,7 @@ nsIDocument::AdoptNode(nsINode& aAdoptedNode, ErrorResult& rv)
{
nsINode* parent = adoptedNode->GetParentNode();
if (parent) {
nsContentUtils::MaybeFireNodeRemoved(adoptedNode, parent,
adoptedNode->OwnerDoc());
nsContentUtils::MaybeFireNodeRemoved(adoptedNode, parent);
}
}

Просмотреть файл

@ -532,7 +532,7 @@ nsINode::RemoveChild(nsINode& aOldChild, ErrorResult& aError)
}
if (aOldChild.GetParentNode() == this) {
nsContentUtils::MaybeFireNodeRemoved(&aOldChild, this, OwnerDoc());
nsContentUtils::MaybeFireNodeRemoved(&aOldChild, this);
}
int32_t index = ComputeIndexOf(&aOldChild);
@ -593,8 +593,7 @@ nsINode::Normalize()
for (uint32_t i = 0; i < nodes.Length(); ++i) {
nsINode* parentNode = nodes[i]->GetParentNode();
if (parentNode) { // Node may have already been removed.
nsContentUtils::MaybeFireNodeRemoved(nodes[i], parentNode,
doc);
nsContentUtils::MaybeFireNodeRemoved(nodes[i], parentNode);
}
}
}
@ -1904,15 +1903,14 @@ nsINode::ReplaceOrInsertBefore(bool aReplace, nsINode* aNewChild,
// If we're replacing, fire for node-to-be-replaced.
// If aRefChild == aNewChild then we'll fire for it in check below
if (aReplace && aRefChild != aNewChild) {
nsContentUtils::MaybeFireNodeRemoved(aRefChild, this, OwnerDoc());
nsContentUtils::MaybeFireNodeRemoved(aRefChild, this);
}
// If the new node already has a parent, fire for removing from old
// parent
nsINode* oldParent = aNewChild->GetParentNode();
if (oldParent) {
nsContentUtils::MaybeFireNodeRemoved(aNewChild, oldParent,
aNewChild->OwnerDoc());
nsContentUtils::MaybeFireNodeRemoved(aNewChild, oldParent);
}
// If we're inserting a fragment, fire for all the children of the