Merge mozilla-central and mozilla-inbound

browser/base/content/content.js

@@ -42,11 +42,11 @@ const Cu = Components.utils;
 
 // Bug 671101 - directly using webNavigation in this context
 // causes docshells to leak
-__defineGetter__("webNavigation", function() {
+__defineGetter__("webNavigation", function () {
   return docShell.QueryInterface(Ci.nsIWebNavigation);
 });
 
-addMessageListener("WebNavigation:LoadURI", function(message) {
+addMessageListener("WebNavigation:LoadURI", function (message) {
   let flags = message.json.flags || webNavigation.LOAD_FLAGS_NONE;
 
   webNavigation.loadURI(message.json.uri, flags, null, null, null);

toolkit/components/places/History.cpp

@@ -56,6 +56,7 @@
 #include "nsNetUtil.h"
 #include "nsIXPConnect.h"
 #include "mozilla/Util.h"
+#include "nsContentUtils.h"
 
 // Initial size for the cache holding visited status observers.
 #define VISIT_OBSERVERS_INITIAL_CACHE_SIZE 128
@@ -1278,6 +1279,8 @@ History::NotifyVisited(nsIURI* aURI)
 {
   NS_ASSERTION(aURI, "Ruh-roh!  A NULL URI was passed to us!");
 
+  nsAutoScriptBlocker scriptBlocker;
+
   if (XRE_GetProcessType() == GeckoProcessType_Default) {
     mozilla::dom::ContentParent* cpp = 
       mozilla::dom::ContentParent::GetSingleton(PR_FALSE);
@@ -1298,14 +1301,18 @@ History::NotifyVisited(nsIURI* aURI)
     return;
   }
 
-  // Walk through the array, and update each Link node.
-  const ObserverArray& observers = key->array;
-  ObserverArray::index_type len = observers.Length();
-  for (ObserverArray::index_type i = 0; i < len; i++) {
-    Link* link = observers[i];
-    link->SetLinkState(eLinkState_Visited);
-    NS_ASSERTION(len == observers.Length(),
-                 "Calling SetLinkState added or removed an observer!");
+  // Update status of each Link node.
+  {
+    // RemoveEntry will destroy the array, this iterator should not survive it.
+    ObserverArray::ForwardIterator iter(key->array);
+    while (iter.HasMore()) {
+      Link* link = iter.GetNext();
+      link->SetLinkState(eLinkState_Visited);
+      // Verify that the observers hash doesn't mutate while looping through
+      // the links associated with this URI.
+      NS_ABORT_IF_FALSE(key == mObservers.GetEntry(aURI),
+                        "The URIs hash mutated!");
+    }
   }
 
   // All the registered nodes can now be removed for this URI.

toolkit/components/places/History.h

@@ -46,7 +46,7 @@
 #include "nsTHashtable.h"
 #include "nsString.h"
 #include "nsURIHashKey.h"
-#include "nsTArray.h"
+#include "nsTObserverArray.h"
 #include "nsDeque.h"
 #include "nsIObserver.h"
 #include "mozIStorageConnection.h"
@@ -167,7 +167,7 @@ private:
   // Ensures new tasks aren't started on destruction.
   bool mShuttingDown;
 
-  typedef nsTArray<mozilla::dom::Link* > ObserverArray;
+  typedef nsTObserverArray<mozilla::dom::Link* > ObserverArray;
 
   class KeyClass : public nsURIHashKey
   {