Bug 523087 - Check for termination before every tree op in the HTML5 parser. r=bnewman.

--HG--
extra : rebase_source : 8dea5208332e6aefd18416bce4533455c4a3c981

parser/html/nsHtml5Parser.cpp

@@ -415,9 +415,6 @@ nsHtml5Parser::Terminate(void)
   nsCOMPtr<nsIParser> kungFuDeathGrip(this);
   nsRefPtr<nsHtml5StreamParser> streamKungFuDeathGrip(mStreamParser);
   nsRefPtr<nsHtml5TreeOpExecutor> treeOpKungFuDeathGrip(mExecutor);
-  // CancelParsingEvents must be called to avoid leaking the nsParser object
-  // @see bug 108049
-  CancelParsingEvents();
   if (mStreamParser) {
     mStreamParser->Terminate();
   }

parser/html/nsHtml5TreeBuilderCppSupplement.h

@@ -400,11 +400,7 @@ nsHtml5TreeBuilder::elementPushed(PRInt32 aNamespace, nsIAtom* aName, nsIContent
   NS_ASSERTION(aElement, "No element!");
   // Give autoloading links a chance to fire
   if (aNamespace == kNameSpaceID_XHTML) {
-    if (aName == nsHtml5Atoms::body) {
-      nsHtml5TreeOperation* treeOp = mOpQueue.AppendElement();
-      // XXX if null, OOM!
-      treeOp->Init(eTreeOpStartLayout, nsnull);
-    } else if (aName == nsHtml5Atoms::html) {
+    if (aName == nsHtml5Atoms::html) {
       nsHtml5TreeOperation* treeOp = mOpQueue.AppendElement();
       // XXX if null, OOM!
       treeOp->Init(eTreeOpProcessOfflineManifest, aElement);
@@ -499,6 +495,12 @@ nsHtml5TreeBuilder::elementPopped(PRInt32 aNamespace, nsIAtom* aName, nsIContent
     treeOp->Init(eTreeOpProcessMeta, aElement);
     return;
   }
+  if (aName == nsHtml5Atoms::head) {
+    nsHtml5TreeOperation* treeOp = mOpQueue.AppendElement();
+    // XXX if null, OOM!
+    treeOp->Init(eTreeOpStartLayout, nsnull);
+    return;
+  }
   return;
 }
 

parser/html/nsHtml5TreeOpExecutor.cpp

@@ -128,7 +128,6 @@ nsHtml5TreeOpExecutor::DidBuildModel(PRBool aTerminated)
   // This is comes from nsXMLContentSink
   DidBuildModelImpl(aTerminated);
   mDocument->ScriptLoader()->RemoveObserver(this);
-  nsContentSink::StartLayout(PR_FALSE);
   ScrollToRef();
   mDocument->RemoveObserver(this);
   mDocument->EndLoad();
@@ -294,6 +293,10 @@ nsHtml5TreeOpExecutor::Flush()
     const nsHtml5TreeOperation* start = mOpQueue.Elements();
     const nsHtml5TreeOperation* end = start + opQueueLength;
     for (nsHtml5TreeOperation* iter = (nsHtml5TreeOperation*)start; iter < end; ++iter) {
+      if (NS_UNLIKELY(!mParser)) {
+        // The previous tree op caused a call to nsIParser::Terminate();
+        break;
+      }
       iter->Perform(this);
     }
     FlushPendingAppendNotifications();
@@ -316,10 +319,15 @@ nsHtml5TreeOpExecutor::Flush()
 #endif
     }
   }
-  ScheduleTimer();
-  
+
   mFlushing = PR_FALSE;
-  
+
+  if (!mParser) {
+    return;
+  }
+
+  ScheduleTimer();
+
   if (mScriptElement) {
     NS_ASSERTION(!mCallDidBuildModel, "Had a script element and DidBuildModel call");
     RunScript();