From 41f95294f54ce23942d9fa94cc9ea3d58793a45d Mon Sep 17 00:00:00 2001
From: Ryan VanderMeulen <ryanvm@gmail.com>
Date: Tue, 23 May 2017 15:31:16 -0400
Subject: [PATCH] Backed out changeset eeb73d8c0542 (bug 1364570) for static
 analysis failures on a CLOSED TREE.

---
 dom/events/AsyncEventDispatcher.cpp      | 16 -------------
 dom/events/AsyncEventDispatcher.h        |  6 -----
 uriloader/prefetch/nsPrefetchService.cpp | 29 +++++++++---------------
 3 files changed, 11 insertions(+), 40 deletions(-)

diff --git a/dom/events/AsyncEventDispatcher.cpp b/dom/events/AsyncEventDispatcher.cpp
index 439ed7688297..091a889cbb0a 100644
--- a/dom/events/AsyncEventDispatcher.cpp
+++ b/dom/events/AsyncEventDispatcher.cpp
@@ -39,13 +39,6 @@ AsyncEventDispatcher::Run()
   if (mCanceled) {
     return NS_OK;
   }
-  if (mCheckStillInDoc) {
-    nsCOMPtr<nsINode> node = do_QueryInterface(mTarget);
-    MOZ_ASSERT(node);
-    if (!node->IsInComposedDoc()) {
-      return NS_OK;
-    }
-  }
   mTarget->AsyncEventRunning(this);
   RefPtr<Event> event = mEvent ? mEvent->InternalDOMEvent() : nullptr;
   if (!event) {
@@ -95,15 +88,6 @@ AsyncEventDispatcher::RunDOMEventWhenSafe()
   nsContentUtils::AddScriptRunner(this);
 }
 
-void
-AsyncEventDispatcher::RequireNodeInDocument()
-{
-  nsCOMPtr<nsINode> node = do_QueryInterface(mTarget);
-  MOZ_ASSERT(node);
-
-  mCheckStillInDoc = true;
-}
-
 /******************************************************************************
  * mozilla::LoadBlockingAsyncEventDispatcher
  ******************************************************************************/
diff --git a/dom/events/AsyncEventDispatcher.h b/dom/events/AsyncEventDispatcher.h
index ea17be9977dd..094e764b6cef 100644
--- a/dom/events/AsyncEventDispatcher.h
+++ b/dom/events/AsyncEventDispatcher.h
@@ -64,18 +64,12 @@ public:
   nsresult PostDOMEvent();
   void RunDOMEventWhenSafe();
 
-  // Calling this causes the Run() method to check that
-  // mTarget->IsInComposedDoc(). mTarget must be an nsINode or else we'll
-  // assert.
-  void RequireNodeInDocument();
-
   nsCOMPtr<dom::EventTarget> mTarget;
   nsCOMPtr<nsIDOMEvent> mEvent;
   nsString              mEventType;
   bool                  mBubbles = false;
   bool                  mOnlyChromeDispatch = false;
   bool                  mCanceled = false;
-  bool                  mCheckStillInDoc = false;
 };
 
 class LoadBlockingAsyncEventDispatcher final : public AsyncEventDispatcher
diff --git a/uriloader/prefetch/nsPrefetchService.cpp b/uriloader/prefetch/nsPrefetchService.cpp
index 856976967013..ce30504ecaf7 100644
--- a/uriloader/prefetch/nsPrefetchService.cpp
+++ b/uriloader/prefetch/nsPrefetchService.cpp
@@ -4,13 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsPrefetchService.h"
-
-#include "mozilla/AsyncEventDispatcher.h"
-#include "mozilla/Attributes.h"
-#include "mozilla/CORSMode.h"
-#include "mozilla/dom/HTMLLinkElement.h"
-#include "mozilla/Preferences.h"
-
 #include "nsICacheEntry.h"
 #include "nsIServiceManager.h"
 #include "nsICategoryManager.h"
@@ -32,6 +25,10 @@
 #include "mozilla/Logging.h"
 #include "plstr.h"
 #include "nsIAsyncVerifyRedirectCallback.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/CORSMode.h"
+#include "mozilla/dom/HTMLLinkElement.h"
 #include "nsIDOMNode.h"
 #include "nsINode.h"
 #include "nsIDocument.h"
@@ -497,17 +494,13 @@ nsPrefetchService::DispatchEvent(nsPrefetchNode *node, bool aSuccess)
     for (uint32_t i = 0; i < node->mSources.Length(); i++) {
       nsCOMPtr<nsINode> domNode = do_QueryReferent(node->mSources.ElementAt(i));
       if (domNode && domNode->IsInComposedDoc()) {
-        // We don't dispatch synchronously since |node| might be in a DocGroup
-        // that we're not allowed to touch. (Our network request happens in the
-        // DocGroup of one of the mSources nodes--not necessarily this one).
-        RefPtr<AsyncEventDispatcher> dispatcher =
-          new AsyncEventDispatcher(domNode,
-                                   aSuccess ?
-                                    NS_LITERAL_STRING("load") :
-                                    NS_LITERAL_STRING("error"),
-                                   /* aCanBubble = */ false);
-        dispatcher->RequireNodeInDocument();
-        dispatcher->PostDOMEvent();
+        nsContentUtils::DispatchTrustedEvent(domNode->OwnerDoc(),
+                                             domNode,
+                                             aSuccess ?
+                                              NS_LITERAL_STRING("load") :
+                                              NS_LITERAL_STRING("error"),
+                                             /* aCanBubble = */ false,
+                                             /* aCancelable = */ false);
       }
     }
 }