mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Merge mozilla-central to autoland. a=merge CLOSED TREE

This commit is contained in:
shindli 2018-07-19 00:49:25 +03:00
Родитель 6dfa209dde 6cdfd81b2e
Коммит cd1abb81b8
154 изменённых файлов: 943 добавлений и 5520 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

1
accessible/atk/XULListboxAccessibleWrap.h
Просмотреть файл

@ -13,7 +13,6 @@ namespace mozilla {
namespace a11y {
typedef class XULListboxAccessible XULListboxAccessibleWrap;
typedef class XULListCellAccessible XULListCellAccessibleWrap;
} // namespace a11y
} // namespace mozilla

4
accessible/base/Role.h
Просмотреть файл

@ -201,8 +201,8 @@ enum Role {
ROW = 28,
/**
* Represents a cell within a table. It is used for html:td,
* xul:tree cell and xul:listcell. Also, see TABLE.
* Represents a cell within a table. It is used for html:td and xul:tree cell.
* Also, see TABLE.
*/
CELL = 29,

25
accessible/base/XULMap.h
Просмотреть файл

@ -11,10 +11,7 @@ XULMAP_TYPE(editor, OuterDocAccessible)
XULMAP_TYPE(findbar, XULToolbarAccessible)
XULMAP_TYPE(groupbox, XULGroupboxAccessible)
XULMAP_TYPE(iframe, OuterDocAccessible)
XULMAP_TYPE(listbox, XULListboxAccessibleWrap)
XULMAP_TYPE(listhead, XULColumAccessible)
XULMAP_TYPE(listheader, XULColumnItemAccessible)
XULMAP_TYPE(listitem, XULListitemAccessible)
XULMAP_TYPE(listheader, XULColumAccessible)
XULMAP_TYPE(menu, XULMenuitemAccessibleWrap)
XULMAP_TYPE(menubar, XULMenubarAccessible)
XULMAP_TYPE(menucaption, XULMenuitemAccessibleWrap)
@ -82,26 +79,6 @@ XULMAP(
}
)
XULMAP(
listcell,
[](Element* aElement, Accessible* aContext) -> Accessible* {
// Only create cells if there's more than one per row.
nsIContent* listItem = aElement->GetParent();
if (!listItem) {
return nullptr;
}
for (nsIContent* child = listItem->GetFirstChild(); child;
child = child->GetNextSibling()) {
if (child->IsXULElement(nsGkAtoms::listcell) && child != aElement) {
return new XULListCellAccessibleWrap(aElement, aContext->Document());
}
}
return nullptr;
}
)
XULMAP(
menupopup,
[](Element* aElement, Accessible* aContext) {

4
accessible/interfaces/nsIAccessibleRole.idl
Просмотреть файл

@ -194,8 +194,8 @@ interface nsIAccessibleRole : nsISupports
const unsigned long ROLE_ROW = 28;
/**
* Represents a cell within a table. It is used for html:td,
* xul:tree cell and xul:listcell. Also, see ROLE_TABLE.
* Represents a cell within a table. It is used for html:td and xul:tree cell.
* Also, see ROLE_TABLE.
*/
const unsigned long ROLE_CELL = 29;

1
accessible/mac/XULListboxAccessibleWrap.h
Просмотреть файл

@ -12,7 +12,6 @@ namespace mozilla {
namespace a11y {
typedef class XULListboxAccessible XULListboxAccessibleWrap;
typedef class XULListCellAccessible XULListCellAccessibleWrap;
} // namespace a11y
} // namespace mozilla

1
accessible/other/XULListboxAccessibleWrap.h
Просмотреть файл

@ -12,7 +12,6 @@ namespace mozilla {
namespace a11y {
typedef class XULListboxAccessible XULListboxAccessibleWrap;
typedef class XULListCellAccessible XULListCellAccessibleWrap;
} // namespace a11y
} // namespace mozilla

18
accessible/windows/msaa/XULListboxAccessibleWrap.cpp
Просмотреть файл

@ -28,21 +28,3 @@ XULListboxAccessibleWrap::Shutdown()
ia2AccessibleTable::mTable = nullptr;
XULListboxAccessible::Shutdown();
}
////////////////////////////////////////////////////////////////////////////////
// XULListCellAccessibleWrap
////////////////////////////////////////////////////////////////////////////////
NS_IMPL_ISUPPORTS_INHERITED0(XULListCellAccessibleWrap,
XULListCellAccessible)
IMPL_IUNKNOWN_INHERITED1(XULListCellAccessibleWrap,
HyperTextAccessibleWrap,
ia2AccessibleTableCell)
void
XULListCellAccessibleWrap::Shutdown()
{
ia2AccessibleTableCell::mTableCell = nullptr;
XULListCellAccessible::Shutdown();
}

22
accessible/windows/msaa/XULListboxAccessibleWrap.h
Просмотреть файл

@ -36,28 +36,6 @@ public:
virtual void Shutdown() override;
};
/**
* IA2 wrapper class for XULListCellAccessible class, implements
* IAccessibleTableCell interface.
*/
class XULListCellAccessibleWrap : public XULListCellAccessible,
public ia2AccessibleTableCell
{
~XULListCellAccessibleWrap() {}
public:
XULListCellAccessibleWrap(nsIContent* aContent, DocAccessible* aDoc) :
XULListCellAccessible(aContent, aDoc), ia2AccessibleTableCell(this) {}
// IUnknown
DECL_IUNKNOWN_INHERITED
// nsISupports
NS_DECL_ISUPPORTS_INHERITED
virtual void Shutdown() override;
};
} // namespace a11y
} // namespace mozilla

179
accessible/xul/XULListboxAccessible.cpp
Просмотреть файл

@ -168,27 +168,7 @@ XULListboxAccessible::NativeRole() const
uint32_t
XULListboxAccessible::ColCount() const
{
nsIContent* headContent = nullptr;
for (nsIContent* childContent = mContent->GetFirstChild(); childContent;
childContent = childContent->GetNextSibling()) {
if (childContent->NodeInfo()->Equals(nsGkAtoms::listcols,
kNameSpaceID_XUL)) {
headContent = childContent;
}
}
if (!headContent)
return 0;
uint32_t columnCount = 0;
for (nsIContent* childContent = headContent->GetFirstChild(); childContent;
childContent = childContent->GetNextSibling()) {
if (childContent->NodeInfo()->Equals(nsGkAtoms::listcol,
kNameSpaceID_XUL)) {
columnCount++;
}
}
return columnCount;
return 0;
}
uint32_t
@ -569,21 +549,11 @@ XULListitemAccessible::Description(nsString& aDesc)
// XULListitemAccessible: Accessible
/**
* If there is a Listcell as a child ( not anonymous ) use it, otherwise
* default to getting the name from GetXULName
*/
* Get the name from GetXULName.
*/
ENameValueFlag
XULListitemAccessible::NativeName(nsString& aName) const
{
nsIContent* childContent = mContent->GetFirstChild();
if (childContent) {
if (childContent->NodeInfo()->Equals(nsGkAtoms::listcell,
kNameSpaceID_XUL)) {
childContent->AsElement()->GetAttr(kNameSpaceID_None, nsGkAtoms::label, aName);
return eNameOK;
}
}
return Accessible::NativeName(aName);
}
@ -659,146 +629,3 @@ XULListitemAccessible::ContainerWidget() const
{
return Parent();
}
////////////////////////////////////////////////////////////////////////////////
// XULListCellAccessible
////////////////////////////////////////////////////////////////////////////////
XULListCellAccessible::
XULListCellAccessible(nsIContent* aContent, DocAccessible* aDoc) :
HyperTextAccessibleWrap(aContent, aDoc)
{
mGenericTypes |= eTableCell;
}
////////////////////////////////////////////////////////////////////////////////
// nsISupports
////////////////////////////////////////////////////////////////////////////////
// XULListCellAccessible: TableCell
TableAccessible*
XULListCellAccessible::Table() const
{
Accessible* thisRow = Parent();
if (!thisRow || thisRow->Role() != roles::ROW)
return nullptr;
Accessible* table = thisRow->Parent();
if (!table || table->Role() != roles::TABLE)
return nullptr;
return table->AsTable();
}
uint32_t
XULListCellAccessible::ColIdx() const
{
Accessible* row = Parent();
if (!row)
return 0;
int32_t indexInRow = IndexInParent();
uint32_t colIdx = 0;
for (int32_t idx = 0; idx < indexInRow; idx++) {
Accessible* cell = row->GetChildAt(idx);
roles::Role role = cell->Role();
if (role == roles::CELL || role == roles::GRID_CELL ||
role == roles::ROWHEADER || role == roles::COLUMNHEADER)
colIdx++;
}
return colIdx;
}
uint32_t
XULListCellAccessible::RowIdx() const
{
Accessible* row = Parent();
if (!row)
return 0;
Accessible* table = row->Parent();
if (!table)
return 0;
int32_t indexInTable = row->IndexInParent();
uint32_t rowIdx = 0;
for (int32_t idx = 0; idx < indexInTable; idx++) {
row = table->GetChildAt(idx);
if (row->Role() == roles::ROW)
rowIdx++;
}
return rowIdx;
}
void
XULListCellAccessible::ColHeaderCells(nsTArray<Accessible*>* aCells)
{
TableAccessible* table = Table();
NS_ASSERTION(table, "cell not in a table!");
if (!table)
return;
// Get column header cell from XUL listhead.
Accessible* list = nullptr;
Accessible* tableAcc = table->AsAccessible();
uint32_t tableChildCount = tableAcc->ChildCount();
for (uint32_t childIdx = 0; childIdx < tableChildCount; childIdx++) {
Accessible* child = tableAcc->GetChildAt(childIdx);
if (child->Role() == roles::LIST) {
list = child;
break;
}
}
if (list) {
Accessible* headerCell = list->GetChildAt(ColIdx());
if (headerCell) {
aCells->AppendElement(headerCell);
return;
}
}
// No column header cell from XUL markup, try to get it from ARIA markup.
TableCellAccessible::ColHeaderCells(aCells);
}
bool
XULListCellAccessible::Selected()
{
TableAccessible* table = Table();
NS_ENSURE_TRUE(table, false); // we expect to be in a listbox (table)
return table->IsRowSelected(RowIdx());
}
////////////////////////////////////////////////////////////////////////////////
// XULListCellAccessible. Accessible implementation
role
XULListCellAccessible::NativeRole() const
{
return roles::CELL;
}
already_AddRefed<nsIPersistentProperties>
XULListCellAccessible::NativeAttributes()
{
nsCOMPtr<nsIPersistentProperties> attributes =
HyperTextAccessibleWrap::NativeAttributes();
// "table-cell-index" attribute
TableAccessible* table = Table();
if (!table) // we expect to be in a listbox (table)
return attributes.forget();
nsAutoString stringIdx;
stringIdx.AppendInt(table->CellIndexAt(RowIdx(), ColIdx()));
nsAccUtils::SetAccAttr(attributes, nsGkAtoms::tableCellIndex, stringIdx);
return attributes.forget();
}

33
accessible/xul/XULListboxAccessible.h
Просмотреть файл

@ -19,7 +19,7 @@ namespace a11y {
/**
* XULColumAccessible are accessible for list and tree columns elements
* (xul:treecols and xul:listcols).
* (xul:treecols and xul:listheader).
*/
class XULColumAccessible : public AccessibleWrap
{
@ -33,7 +33,7 @@ public:
/**
* XULColumnItemAccessible are accessibles for list and tree column elements
* (xul:listcol and xul:treecol).
* (xul:treecol).
*/
class XULColumnItemAccessible : public LeafAccessible
{
@ -140,35 +140,6 @@ private:
bool mIsCheckbox;
};
/**
* Class represents xul:listcell.
*/
class XULListCellAccessible : public HyperTextAccessibleWrap,
public TableCellAccessible
{
public:
XULListCellAccessible(nsIContent* aContent, DocAccessible* aDoc);
// nsISupports
NS_INLINE_DECL_REFCOUNTING_INHERITED(XULListCellAccessible,
HyperTextAccessibleWrap)
// Accessible
virtual TableCellAccessible* AsTableCell() override { return this; }
virtual already_AddRefed<nsIPersistentProperties> NativeAttributes() override;
virtual a11y::role NativeRole() const override;
// TableCellAccessible
virtual TableAccessible* Table() const override;
virtual uint32_t ColIdx() const override;
virtual uint32_t RowIdx() const override;
virtual void ColHeaderCells(nsTArray<Accessible*>* aHeaderCells) override;
virtual bool Selected() override;
protected:
virtual ~XULListCellAccessible() {}
};
} // namespace a11y
} // namespace mozilla

2
browser/base/content/aboutNetError.js
Просмотреть файл

@ -178,7 +178,6 @@ function initPage() {
}
if (showCaptivePortalUI) {
initPageCaptivePortal();
updateContainerPosition();
return;
}
if (gIsCertError) {
@ -295,7 +294,6 @@ function initPage() {
span.textContent = document.location.hostname;
}
}
updateContainerPosition();
}
function updateContainerPosition() {

5
browser/components/preferences/in-content/tests/browser.ini
Просмотреть файл

@ -9,7 +9,6 @@ support-files =
addons/set_newtab.xpi
[browser_applications_selection.js]
skip-if = os == 'linux' || verify # bug 1382057
[browser_advanced_update.js]
skip-if = !updater
[browser_basic_rebuild_fonts_test.js]
@ -36,9 +35,7 @@ skip-if = !updater
support-files =
browser_bug1184989_prevent_scrolling_when_preferences_flipped.xul
[browser_change_app_handler.js]
skip-if = os != "win" || (os == "win" && os_version == "6.1") || (verify && debug)
# This test tests the windows-specific app selection dialog, so can't run on non-Windows.
# Skip the test on Window 7, see the detail at Bug 1381706.
skip-if = os != "win" # Windows-specific handler application selection dialog
[browser_checkspelling.js]
[browser_connection.js]
[browser_connection_bug388287.js]

21
browser/components/preferences/in-content/tests/browser_applications_selection.js
Просмотреть файл

@ -30,10 +30,7 @@ add_task(async function selectInternalOptionForFeed() {
container.selectItem(feedItem);
Assert.ok(feedItem.selected, "Should be able to select our item.");
// Wait for the menu.
let list = await TestUtils.waitForCondition(() =>
win.document.getAnonymousElementByAttribute(feedItem, "class", "actionsMenu"));
info("Got list after item was selected");
let list = feedItem.querySelector(".actionsMenu");
// Find the "Add Live bookmarks option".
let chooseItems = list.getElementsByAttribute("action", Ci.nsIHandlerInfo.handleInternally);
@ -45,9 +42,6 @@ add_task(async function selectInternalOptionForFeed() {
chooseItems[0].dispatchEvent(cmdEvent);
// Check that we display the correct result.
list = await TestUtils.waitForCondition(() =>
win.document.getAnonymousElementByAttribute(feedItem, "class", "actionsMenu"));
info("Got list after item was selected");
Assert.ok(list.selectedItem, "Should have a selected item.");
Assert.equal(list.selectedItem.getAttribute("action"),
Ci.nsIHandlerInfo.handleInternally,
@ -62,17 +56,10 @@ add_task(async function reselectInternalOptionForFeed() {
container.selectItem(anotherItem);
// Wait for the menu so that we don't hit race conditions.
await TestUtils.waitForCondition(() =>
win.document.getAnonymousElementByAttribute(anotherItem, "class", "actionsMenu"));
info("Got list after item was selected");
// Now select the feed item again, and check what it is displaying.
container.selectItem(feedItem);
let list = await TestUtils.waitForCondition(() =>
win.document.getAnonymousElementByAttribute(feedItem, "class", "actionsMenu"));
info("Got list after item was selected");
let list = feedItem.querySelector(".actionsMenu");
Assert.ok(list.selectedItem,
"Should have a selected item");
@ -118,6 +105,10 @@ add_task(async function sortingCheck() {
actionColumn.click();
assertSortByAction("descending");
// Restore the default sort order
typeColumn.click();
assertSortByType("ascending");
function assertSortByAction(order) {
Assert.equal(actionColumn.getAttribute("sortDirection"),
order,

6
browser/components/preferences/in-content/tests/browser_change_app_handler.js
Просмотреть файл

@ -28,8 +28,7 @@ add_task(async function() {
container.selectItem(ourItem);
ok(ourItem.selected, "Should be able to select our item.");
let list = await TestUtils.waitForCondition(() => win.document.getAnonymousElementByAttribute(ourItem, "class", "actionsMenu"));
info("Got list after item was selected");
let list = ourItem.querySelector(".actionsMenu");
let chooseItem = list.firstChild.querySelector(".choose-app-item");
let dialogLoadedPromise = promiseLoadSubDialog("chrome://global/content/appPicker.xul");
@ -51,8 +50,6 @@ add_task(async function() {
ok(mimeInfo.preferredApplicationHandler.equals(selectedApp), "App should be set as preferred.");
// Check that we display this result:
list = await TestUtils.waitForCondition(() => win.document.getAnonymousElementByAttribute(ourItem, "class", "actionsMenu"));
info("Got list after item was selected");
ok(list.selectedItem, "Should have a selected item");
ok(mimeInfo.preferredApplicationHandler.equals(list.selectedItem.handlerApp),
"App should be visible as preferred item.");
@ -84,7 +81,6 @@ add_task(async function() {
ok(!mimeInfo.preferredApplicationHandler, "App should no longer be set as preferred.");
// Check that we display this result:
list = await TestUtils.waitForCondition(() => win.document.getAnonymousElementByAttribute(ourItem, "class", "actionsMenu"));
ok(list.selectedItem, "Should have a selected item");
ok(!list.selectedItem.handlerApp,
"No app should be visible as preferred item.");

1
browser/installer/allowed-dupes.mn
Просмотреть файл

@ -94,7 +94,6 @@ chrome/toolkit/skin/classic/global/dropmarker.css
chrome/toolkit/skin/classic/global/global.css
chrome/toolkit/skin/classic/global/groupbox.css
chrome/toolkit/skin/classic/global/icons/close-win7.png
chrome/toolkit/skin/classic/global/listbox.css
chrome/toolkit/skin/classic/global/menu.css
chrome/toolkit/skin/classic/global/menulist.css
chrome/toolkit/skin/classic/global/numberbox.css

1
browser/themes/shared/aboutNetError-new.css
Просмотреть файл

@ -13,6 +13,7 @@ body.certerror {
border-color: #ffe900;
border-width: 16px;
width: 100%;
justify-content: normal;
}
body.captiveportal .title {

3
dom/base/nsDocument.cpp
Просмотреть файл

@ -255,7 +255,6 @@
#include "mozilla/dom/DocGroup.h"
#include "mozilla/dom/TabGroup.h"
#ifdef MOZ_XUL
#include "mozilla/dom/ListBoxObject.h"
#include "mozilla/dom/MenuBoxObject.h"
#include "mozilla/dom/TreeBoxObject.h"
#include "nsIXULWindow.h"
@ -6361,8 +6360,6 @@ nsIDocument::GetBoxObjectFor(Element* aElement, ErrorResult& aRv)
boxObject = new MenuBoxObject();
} else if (tag == nsGkAtoms::tree) {
boxObject = new TreeBoxObject();
} else if (tag == nsGkAtoms::listbox) {
boxObject = new ListBoxObject();
} else {
boxObject = new BoxObject();
}

150
dom/security/nsCSPContext.cpp
Просмотреть файл

@ -91,6 +91,29 @@ ValidateDirectiveName(const nsAString& aDirective)
}
#endif // DEBUG
static void
BlockedContentSourceToString(nsCSPContext::BlockedContentSource aSource,
nsACString& aString)
{
switch (aSource) {
case nsCSPContext::BlockedContentSource::eUnknown:
aString.Truncate();
break;
case nsCSPContext::BlockedContentSource::eInline:
aString.AssignLiteral("inline");
break;
case nsCSPContext::BlockedContentSource::eEval:
aString.AssignLiteral("eval");
break;
case nsCSPContext::BlockedContentSource::eSelf:
aString.AssignLiteral("self");
break;
}
}
/**
* Creates a key for use in the ShouldLoad cache.
* Looks like: <uri>!<nsIContentPolicy::LOAD_TYPE>
@ -275,6 +298,7 @@ nsCSPContext::permitsInternal(CSPDirective aDir,
AsyncReportViolation(aTriggeringElement,
(aSendContentLocationInViolationReports ?
aContentLocation : nullptr),
BlockedContentSource::eUnknown, /* a BlockedContentSource */
aOriginalURI, /* in case of redirect originalURI is not null */
violatedDirective,
p, /* policy index */
@ -481,12 +505,6 @@ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType,
: NS_LITERAL_STRING(STYLE_HASH_VIOLATION_OBSERVER_TOPIC);
}
nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
if (selfICString) {
selfICString->SetData(nsDependentCString("inline"));
}
nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
// use selfURI as the sourceFile
nsAutoCString sourceFile;
if (mSelfURI) {
@ -494,7 +512,8 @@ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType,
}
AsyncReportViolation(aTriggeringElement,
selfISupports, // aBlockedContentSource
nullptr, // aBlockedURI
BlockedContentSource::eInline, // aBloeckedSource
mSelfURI, // aOriginalURI
aViolatedDirective, // aViolatedDirective
aViolatedPolicyIndex, // aViolatedPolicyIndex
@ -595,7 +614,7 @@ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
*
* Note: This macro uses some parameters from its caller's context:
* p, mPolicies, this, aSourceFile, aScriptSample, aLineNum, aColumnNum,
* selfISupports
* blockedContentSource
*
* @param violationType: the VIOLATION_TYPE_* constant (partial symbol)
* such as INLINE_SCRIPT
@ -622,8 +641,8 @@ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
mPolicies[p]->getDirectiveStringAndReportSampleForContentType( \
nsIContentPolicy::TYPE_ ## contentPolicyType, \
violatedDirective, &reportSample); \
AsyncReportViolation(aTriggeringElement, selfISupports, nullptr, \
violatedDirective, p, \
AsyncReportViolation(aTriggeringElement, nullptr, blockedContentSource, \
nullptr, violatedDirective, p, \
NS_LITERAL_STRING(observerTopic), \
aSourceFile, \
reportSample \
@ -670,20 +689,17 @@ nsCSPContext::LogViolationDetails(uint16_t aViolationType,
for (uint32_t p = 0; p < mPolicies.Length(); p++) {
NS_ASSERTION(mPolicies[p], "null pointer in nsTArray<nsCSPPolicy>");
nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
if (selfICString) {
if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL) {
selfICString->SetData(nsDependentCString("eval"));
} else if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT ||
aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_STYLE) {
selfICString->SetData(nsDependentCString("inline"));
} else {
// All the other types should have a URL, but just in case, let's use
// 'self' here.
selfICString->SetData(nsDependentCString("self"));
}
BlockedContentSource blockedContentSource = BlockedContentSource::eUnknown;
if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL) {
blockedContentSource = BlockedContentSource::eEval;
} else if (aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_SCRIPT ||
aViolationType == nsIContentSecurityPolicy::VIOLATION_TYPE_INLINE_STYLE) {
blockedContentSource = BlockedContentSource::eInline;
} else {
// All the other types should have a URL, but just in case, let's use
// 'self' here.
blockedContentSource = BlockedContentSource::eSelf;
}
nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
switch (aViolationType) {
CASE_CHECK_AND_REPORT(EVAL, SCRIPT, NS_LITERAL_STRING(""),
@ -874,16 +890,7 @@ StripURIForReporting(nsIURI* aURI,
return;
}
// 2) If the origin of uri is not the same as the origin of the protected
// resource, then return the ASCII serialization of uri’s origin.
if (!NS_SecurityCompareURIs(aSelfURI, aURI, false)) {
// cross origin redirects also fall into this category, see:
// http://www.w3.org/TR/CSP/#violation-reports
aURI->GetPrePath(outStrippedURI);
return;
}
// 3) Return uri, with any fragment component removed.
// Return uri, with any fragment component removed.
aURI->GetSpecIgnoringRef(outStrippedURI);
}
@ -917,7 +924,8 @@ nsCSPContext::GatherSecurityPolicyViolationEventData(
// blocked-uri
if (aBlockedURI) {
nsAutoCString reportBlockedURI;
StripURIForReporting(aBlockedURI, mSelfURI, reportBlockedURI);
StripURIForReporting(aOriginalURI ? aOriginalURI : aBlockedURI,
mSelfURI, reportBlockedURI);
aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(reportBlockedURI);
} else {
aViolationEventInit.mBlockedURI = NS_ConvertUTF8toUTF16(aBlockedString);
@ -1252,7 +1260,8 @@ class CSPReportSenderRunnable final : public Runnable
{
public:
CSPReportSenderRunnable(Element* aTriggeringElement,
nsISupports* aBlockedContentSource,
nsIURI* aBlockedURI,
nsCSPContext::BlockedContentSource aBlockedContentSource,
nsIURI* aOriginalURI,
uint32_t aViolatedPolicyIndex,
bool aReportOnlyFlag,
@ -1265,6 +1274,7 @@ class CSPReportSenderRunnable final : public Runnable
nsCSPContext* aCSPContext)
: mozilla::Runnable("CSPReportSenderRunnable")
, mTriggeringElement(aTriggeringElement)
, mBlockedURI(aBlockedURI)
, mBlockedContentSource(aBlockedContentSource)
, mOriginalURI(aOriginalURI)
, mViolatedPolicyIndex(aViolatedPolicyIndex)
@ -1280,13 +1290,22 @@ class CSPReportSenderRunnable final : public Runnable
// the observer subject is an nsISupports: either an nsISupportsCString
// from the arg passed in directly, or if that's empty, it's the blocked
// source.
if (aObserverSubject.IsEmpty() && mBlockedURI) {
mObserverSubject = aBlockedURI;
return;
}
nsAutoCString subject;
if (aObserverSubject.IsEmpty()) {
mObserverSubject = aBlockedContentSource;
BlockedContentSourceToString(aBlockedContentSource, subject);
} else {
nsCOMPtr<nsISupportsCString> supportscstr =
do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID);
NS_ASSERTION(supportscstr, "Couldn't allocate nsISupportsCString");
supportscstr->SetData(NS_ConvertUTF16toUTF8(aObserverSubject));
CopyUTF16toUTF8(aObserverSubject, subject);
}
nsCOMPtr<nsISupportsCString> supportscstr =
do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID);
if (supportscstr) {
supportscstr->SetData(subject);
mObserverSubject = do_QueryInterface(supportscstr);
}
}
@ -1299,17 +1318,12 @@ class CSPReportSenderRunnable final : public Runnable
// 0) prepare violation data
mozilla::dom::SecurityPolicyViolationEventInit init;
// mBlockedContentSource could be a URI or a string.
nsCOMPtr<nsIURI> blockedURI = do_QueryInterface(mBlockedContentSource);
// if mBlockedContentSource is not a URI, it could be a string
nsCOMPtr<nsISupportsCString> blockedICString = do_QueryInterface(mBlockedContentSource);
nsAutoCString blockedDataStr;
if (blockedICString) {
blockedICString->GetData(blockedDataStr);
}
nsAutoCString blockedContentSource;
BlockedContentSourceToString(mBlockedContentSource, blockedContentSource);
rv = mCSPContext->GatherSecurityPolicyViolationEventData(
blockedURI, blockedDataStr, mOriginalURI,
mBlockedURI, blockedContentSource, mOriginalURI,
mViolatedDirective, mViolatedPolicyIndex,
mSourceFile, mScriptSample, mLineNum, mColumnNum,
init);
@ -1317,34 +1331,35 @@ class CSPReportSenderRunnable final : public Runnable
// 1) notify observers
nsCOMPtr<nsIObserverService> observerService = mozilla::services::GetObserverService();
NS_ASSERTION(observerService, "needs observer service");
rv = observerService->NotifyObservers(mObserverSubject,
CSP_VIOLATION_TOPIC,
mViolatedDirective.get());
NS_ENSURE_SUCCESS(rv, rv);
if (mObserverSubject && observerService) {
rv = observerService->NotifyObservers(mObserverSubject,
CSP_VIOLATION_TOPIC,
mViolatedDirective.get());
NS_ENSURE_SUCCESS(rv, rv);
}
// 2) send reports for the policy that was violated
mCSPContext->SendReports(init, mViolatedPolicyIndex);
// 3) log to console (one per policy violation)
if (blockedURI) {
blockedURI->GetSpec(blockedDataStr);
if (blockedDataStr.Length() > nsCSPContext::ScriptSampleMaxLength()) {
if (mBlockedURI) {
mBlockedURI->GetSpec(blockedContentSource);
if (blockedContentSource.Length() > nsCSPContext::ScriptSampleMaxLength()) {
bool isData = false;
rv = blockedURI->SchemeIs("data", &isData);
rv = mBlockedURI->SchemeIs("data", &isData);
if (NS_SUCCEEDED(rv) && isData &&
blockedDataStr.Length() > nsCSPContext::ScriptSampleMaxLength()) {
blockedDataStr.Truncate(nsCSPContext::ScriptSampleMaxLength());
blockedDataStr.Append(NS_ConvertUTF16toUTF8(nsContentUtils::GetLocalizedEllipsis()));
blockedContentSource.Length() > nsCSPContext::ScriptSampleMaxLength()) {
blockedContentSource.Truncate(nsCSPContext::ScriptSampleMaxLength());
blockedContentSource.Append(NS_ConvertUTF16toUTF8(nsContentUtils::GetLocalizedEllipsis()));
}
}
}
if (blockedDataStr.Length() > 0) {
nsString blockedDataChar16 = NS_ConvertUTF8toUTF16(blockedDataStr);
if (blockedContentSource.Length() > 0) {
nsString blockedContentSource16 = NS_ConvertUTF8toUTF16(blockedContentSource);
const char16_t* params[] = { mViolatedDirective.get(),
blockedDataChar16.get() };
blockedContentSource16.get() };
mCSPContext->logToConsole(mReportOnlyFlag ? "CSPROViolationWithURI" :
"CSPViolationWithURI",
params, ArrayLength(params), mSourceFile, mScriptSample,
@ -1359,7 +1374,8 @@ class CSPReportSenderRunnable final : public Runnable
private:
RefPtr<Element> mTriggeringElement;
nsCOMPtr<nsISupports> mBlockedContentSource;
nsCOMPtr<nsIURI> mBlockedURI;
nsCSPContext::BlockedContentSource mBlockedContentSource;
nsCOMPtr<nsIURI> mOriginalURI;
uint32_t mViolatedPolicyIndex;
bool mReportOnlyFlag;
@ -1403,7 +1419,8 @@ class CSPReportSenderRunnable final : public Runnable
*/
nsresult
nsCSPContext::AsyncReportViolation(Element* aTriggeringElement,
nsISupports* aBlockedContentSource,
nsIURI* aBlockedURI,
BlockedContentSource aBlockedContentSource,
nsIURI* aOriginalURI,
const nsAString& aViolatedDirective,
uint32_t aViolatedPolicyIndex,
@ -1417,6 +1434,7 @@ nsCSPContext::AsyncReportViolation(Element* aTriggeringElement,
nsCOMPtr<nsIRunnable> task =
new CSPReportSenderRunnable(aTriggeringElement,
aBlockedURI,
aBlockedContentSource,
aOriginalURI,
aViolatedPolicyIndex,

11
dom/security/nsCSPContext.h
Просмотреть файл

@ -107,8 +107,17 @@ class nsCSPContext : public nsIContentSecurityPolicy
mozilla::dom::Element* aTriggeringElement,
const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit);
enum BlockedContentSource
{
eUnknown,
eInline,
eEval,
eSelf,
};
nsresult AsyncReportViolation(mozilla::dom::Element* aTriggeringElement,
nsISupports* aBlockedContentSource,
nsIURI* aBlockedURI,
BlockedContentSource aBlockedContentSource,
nsIURI* aOriginalURI,
const nsAString& aViolatedDirective,
uint32_t aViolatedPolicyIndex,

2
dom/security/test/csp/test_blocked_uri_in_reports.html
Просмотреть файл

@ -50,7 +50,7 @@ script.addMessageListener('opening-request-completed', function ml(msg) {
var cspReport = reportObj["csp-report"];
// blocked-uri should only be the asciiHost instead of:
// http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js
is(cspReport["blocked-uri"], "http://test1.example.com", "Incorrect blocked-uri");
is(cspReport["blocked-uri"], "http://example.com/tests/dom/security/test/csp/file_path_matching_redirect_server.sjs", "Incorrect blocked-uri");
} catch (e) {
ok(false, "Could not query report (exception: " + e + ")");
}

2
dom/security/test/csp/test_report_for_import.html
Просмотреть файл

@ -57,7 +57,7 @@ function checkResults(reportStr) {
"http://mochi.test:8888/tests/dom/security/test/csp/file_report_for_import_server.sjs?report",
"Incorrect original-policy");
is(cspReport["blocked-uri"],
"http://example.com",
"http://example.com/tests/dom/security/test/csp/file_report_for_import_server.sjs?stylesheet",
"Incorrect blocked-uri");
// we do not always set the following fields

4
dom/security/test/unit/test_csp_reports.js
Просмотреть файл

@ -147,7 +147,7 @@ function run_test() {
}
});
makeTest(2, {"blocked-uri": "http://blocked.test"}, false,
makeTest(2, {"blocked-uri": "http://blocked.test/foo.js"}, false,
function(csp) {
// shouldLoad creates and sends out the report here.
csp.shouldLoad(Ci.nsIContentPolicy.TYPE_SCRIPT,
@ -226,7 +226,7 @@ function run_test() {
});
// test scheme of ftp:
makeTest(8, {"blocked-uri": "ftp://blocked.test"}, false,
makeTest(8, {"blocked-uri": "ftp://blocked.test/profile.png"}, false,
function(csp) {
// shouldLoad creates and sends out the report here.
csp.shouldLoad(Ci.nsIContentPolicy.TYPE_SCRIPT,

18
dom/tests/mochitest/chrome/window_focus.xul
Просмотреть файл

@ -299,7 +299,7 @@ function mouseWillTriggerFocus(element)
element.type == "password")) {
return true;
}
} else if (element.localName == "listbox") {
} else if (element.localName == "richlistbox") {
return true;
}
@ -457,7 +457,7 @@ function startTest()
mouseOnElement(element, getById("t" + idx), true, "mouse on element t" + idx);
var expectedWindow = (element.ownerGlobal == gChildWindow) ? gChildWindow : window;
if (element.localName == "listbox" && expectedWindow == window &&
if (element.localName == "richlistbox" && expectedWindow == window &&
navigator.platform.indexOf("Mac") == 0) {
// after focusing a listbox on Mac, clear the focus before continuing.
setFocusTo(null, window);
@ -1634,9 +1634,9 @@ SimpleTest.waitForFocus(startTest);
<hbox id="innerbox">
<button id="t4" accesskey="h" label="no tabindex"/>
<button id="o1" accesskey="i" label="tabindex = -1" tabindex="-1"/>
<listbox id="t5" label="tabindex = 0" tabindex="0" rows="1">
<listitem/>
</listbox>
<richlistbox id="t5" label="tabindex = 0" tabindex="0" width="50">
<richlistitem height="10"/>
</richlistbox>
<button id="t1" label="tabindex = 2" tabindex="2"/>
</hbox>
<hbox>
@ -1649,9 +1649,9 @@ SimpleTest.waitForFocus(startTest);
<button id="t7" style="-moz-user-focus: normal;" label="no tabindex"/>
<button id="o3" style="-moz-user-focus: normal;" label="tabindex = -1" tabindex="-1"/>
<button id="t8" style="-moz-user-focus: normal;" label="tabindex = 0" tabindex="0"/>
<listbox id="t3" style="-moz-user-focus: normal;" label="tabindex = 2" tabindex="2" rows="1">
<listitem/>
</listbox>
<richlistbox id="t3" style="-moz-user-focus: normal;" label="tabindex = 2" tabindex="2" width="50">
<richlistitem height="10"/>
</richlistbox>
</hbox>
<hbox>
<button accesskey="p" style="display: none;"/> <button accesskey="q" style="visibility: collapse;"/>
@ -1709,7 +1709,7 @@ SimpleTest.waitForFocus(startTest);
<checkbox id="o5"/><checkbox id="o7"/><hbox><checkbox id="o9"/></hbox>
<checkbox id="o13"/><checkbox id="o15"/><checkbox id="o17"/><checkbox id="o19"/><checkbox id="o21"/><checkbox id="o23"/><checkbox id="o25"/>
<checkbox id="n2"/><checkbox id="n4"/>
<listbox id="last" width="20" rows="1"/>
<richlistbox id="last" width="20" height="20"/>
<iframe id="ifa" width="40" height="60" style="-moz-user-focus: ignore;" type="content"
src="data:text/html,&lt;input id=fra size='2'&gt;&lt;input id='fra-b' size='2'&gt;

6
dom/tests/mochitest/general/test_focusrings.xul
Просмотреть файл

@ -161,9 +161,9 @@ SimpleTest.waitForFocus(runTest);
]]>
</script>
<listbox id="l1" class="plain" height="20"/>
<listbox id="l2" class="plain" height="20"/>
<listbox id="l3" class="plain" height="20"/>
<richlistbox id="l1" class="plain" height="20"/>
<richlistbox id="l2" class="plain" height="20"/>
<richlistbox id="l3" class="plain" height="20"/>
<button id="b1" label="Button"/>
<button id="b2" label="Button"/>
<button id="b3" label="Button"/>

22
dom/webidl/ListBoxObject.webidl
Просмотреть файл

@ -1,22 +0,0 @@
/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/.
*/
[NoInterfaceObject]
interface ListBoxObject : BoxObject {
long getRowCount();
long getRowHeight();
long getNumberOfVisibleRows();
long getIndexOfFirstVisibleRow();
void ensureIndexIsVisible(long rowIndex);
void scrollToIndex(long rowIndex);
void scrollByLines(long numLines);
Element? getItemAtIndex(long index);
long getIndexOfItem(Element item);
};

1
dom/webidl/moz.build
Просмотреть файл

@ -633,7 +633,6 @@ WEBIDL_FILES = [
'L10nUtils.webidl',
'LegacyQueryInterface.webidl',
'LinkStyle.webidl',
'ListBoxObject.webidl',
'LocalMediaStream.webidl',
'Location.webidl',
'MediaCapabilities.webidl',

29
dom/xbl/crashtests/404125-1.xhtml
Просмотреть файл

@ -1,29 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="lc">
<content>
<xul:listcell> t <children/></xul:listcell>
</content>
</binding>
</bindings>
<script>
function boom()
{
var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox");
document.getElementById("vv").appendChild(hbox);
}
</script>
</head>
<body onload="boom();">
<div style="-moz-binding: url(#lc);" id="vv"></div>
</body>
</html>

34
dom/xbl/crashtests/415301-1.xul
Просмотреть файл

@ -1,34 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/global.css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="boom();">
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="chil"><content><children/></content></binding>
<binding id="ichil"><content>
<xul:hbox style="-moz-binding: url(#chil)"><children/></xul:hbox>
</content></binding>
</bindings>
<script type="text/javascript">
function boom()
{
document.getElementById("inner").removeChild(document.getElementById("lbb"));
document.getElementById("outer").style.MozBinding = "";
}
</script>
<hbox id="outer" style="-moz-binding: url(#chil)"><hbox id="inner" style="-moz-binding: url(#ichil)"><listboxbody id="lbb" /></hbox></hbox>
</window>

9
dom/xbl/crashtests/463511-1.xhtml
Просмотреть файл

@ -1,9 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
<head>
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="foo"><content><listcell xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listcell></content></binding>
</bindings>
</head>
<body onload="document.documentElement.innerHTML = 'x';"></body>
</html>

3
dom/xbl/crashtests/crashtests.list
Просмотреть файл

@ -14,19 +14,16 @@ load 378521-1.xhtml
load 382376-1.xhtml
load 382376-2.xhtml
load 397596-1.xhtml
load 404125-1.xhtml
load 406900-1.xul
load 406904-1.xhtml
load 406904-2.xhtml
load 415192-1.xul
load 415301-1.xul
load 418133-1.xhtml
load 420233-1.xhtml
load 421997-1.xhtml
load 432813-1.xhtml
load 454820-1.html
load 460665-1.xhtml
load 463511-1.xhtml
load 464863-1.xhtml
load 472260-1.xhtml
load 477878-1.html

112
dom/xul/nsXULElement.cpp
Просмотреть файл

@ -42,7 +42,6 @@
#include "nsPIBoxObject.h"
#include "XULDocument.h"
#include "nsXULPopupListener.h"
#include "ListBoxObject.h"
#include "nsContentUtils.h"
#include "nsContentList.h"
#include "mozilla/InternalMutationEvent.h"
@ -447,7 +446,6 @@ nsXULElement::GetEventListenerManagerForAttr(nsAtom* aAttrName, bool* aDefer)
static bool IsNonList(mozilla::dom::NodeInfo* aNodeInfo)
{
return !aNodeInfo->Equals(nsGkAtoms::tree) &&
!aNodeInfo->Equals(nsGkAtoms::listbox) &&
!aNodeInfo->Equals(nsGkAtoms::richlistbox);
}
@ -794,98 +792,6 @@ nsXULElement::UnbindFromTree(bool aDeep, bool aNullParent)
nsStyledElement::UnbindFromTree(aDeep, aNullParent);
}
void
nsXULElement::RemoveChildNode(nsIContent* aKid, bool aNotify)
{
// On the removal of a <treeitem>, <treechildren>, or <treecell> element,
// the possibility exists that some of the items in the removed subtree
// are selected (and therefore need to be deselected). We need to account for this.
nsCOMPtr<nsIDOMXULMultiSelectControlElement> controlElement;
nsCOMPtr<nsIListBoxObject> listBox;
bool fireSelectionHandler = false;
// -1 = do nothing, -2 = null out current item
// anything else = index to re-set as current
int32_t newCurrentIndex = -1;
if (aKid->NodeInfo()->Equals(nsGkAtoms::listitem, kNameSpaceID_XUL)) {
// This is the nasty case. We have (potentially) a slew of selected items
// and cells going away.
// First, retrieve the tree.
// Check first whether this element IS the tree
controlElement = do_QueryObject(this);
// If it's not, look at our parent
if (!controlElement)
GetParentTree(getter_AddRefs(controlElement));
nsCOMPtr<nsIContent> controlContent(do_QueryInterface(controlElement));
RefPtr<nsXULElement> xulElement = FromNodeOrNull(controlContent);
if (xulElement) {
// Iterate over all of the items and find out if they are contained inside
// the removed subtree.
int32_t length;
controlElement->GetSelectedCount(&length);
for (int32_t i = 0; i < length; i++) {
nsCOMPtr<nsIDOMXULSelectControlItemElement> item;
controlElement->MultiGetSelectedItem(i, getter_AddRefs(item));
nsCOMPtr<nsINode> node = do_QueryInterface(item);
if (node == aKid &&
NS_SUCCEEDED(controlElement->RemoveItemFromSelection(item))) {
length--;
i--;
fireSelectionHandler = true;
}
}
nsCOMPtr<nsIDOMXULSelectControlItemElement> curItem;
controlElement->GetCurrentItem(getter_AddRefs(curItem));
nsCOMPtr<nsIContent> curNode = do_QueryInterface(curItem);
if (curNode && nsContentUtils::ContentIsDescendantOf(curNode, aKid)) {
// Current item going away
nsCOMPtr<nsIBoxObject> box = xulElement->GetBoxObject(IgnoreErrors());
listBox = do_QueryInterface(box);
if (listBox) {
listBox->GetIndexOfItem(aKid->AsElement(), &newCurrentIndex);
}
// If any of this fails, we'll just set the current item to null
if (newCurrentIndex == -1)
newCurrentIndex = -2;
}
}
}
nsStyledElement::RemoveChildNode(aKid, aNotify);
if (newCurrentIndex == -2) {
controlElement->SetCurrentItem(nullptr);
} else if (newCurrentIndex > -1) {
// Make sure the index is still valid
int32_t treeRows;
listBox->GetRowCount(&treeRows);
if (treeRows > 0) {
newCurrentIndex = std::min((treeRows - 1), newCurrentIndex);
RefPtr<Element> newCurrentItem;
listBox->GetItemAtIndex(newCurrentIndex, getter_AddRefs(newCurrentItem));
nsCOMPtr<nsIDOMXULSelectControlItemElement> xulCurItem = do_QueryInterface(newCurrentItem);
if (xulCurItem)
controlElement->SetCurrentItem(xulCurItem);
} else {
controlElement->SetCurrentItem(nullptr);
}
}
nsIDocument* doc;
if (fireSelectionHandler && (doc = GetComposedDoc())) {
nsContentUtils::DispatchTrustedEvent(doc,
static_cast<nsIContent*>(this),
NS_LITERAL_STRING("select"),
CanBubble::eNo,
Cancelable::eYes);
}
}
void
nsXULElement::UnregisterAccessKey(const nsAString& aOldValue)
{
@ -1318,24 +1224,6 @@ nsXULElement::GetBoxObject(ErrorResult& rv)
return OwnerDoc()->GetBoxObjectFor(this, rv);
}
NS_IMETHODIMP
nsXULElement::GetParentTree(nsIDOMXULMultiSelectControlElement** aTreeElement)
{
for (nsIContent* current = GetParent(); current;
current = current->GetParent()) {
if (current->NodeInfo()->Equals(nsGkAtoms::listbox,
kNameSpaceID_XUL)) {
CallQueryInterface(current, aTreeElement);
// XXX returning NS_OK because that's what the code used to do;
// is that the right thing, though?
return NS_OK;
}
}
return NS_OK;
}
void
nsXULElement::Click(CallerType aCallerType)
{

4
dom/xul/nsXULElement.h
Просмотреть файл

@ -366,7 +366,6 @@ public:
nsIContent* aBindingParent,
bool aCompileEventHandlers) override;
virtual void UnbindFromTree(bool aDeep, bool aNullParent) override;
virtual void RemoveChildNode(nsIContent* aKid, bool aNotify) override;
virtual void DestroyContent() override;
#ifdef DEBUG
@ -644,9 +643,6 @@ protected:
// Implementation methods
nsresult EnsureContentsGenerated(void) const;
// Helper routine that crawls a parent chain looking for a tree element.
NS_IMETHOD GetParentTree(nsIDOMXULMultiSelectControlElement** aTreeElement);
nsresult AddPopupListener(nsAtom* aName);
/**

93
gfx/layers/BufferEdgePad.cpp Normal file
Просмотреть файл

@ -0,0 +1,93 @@
#include "BufferEdgePad.h"
#include "mozilla/gfx/Point.h" // for IntSize
#include "mozilla/gfx/Types.h" // for SurfaceFormat
namespace mozilla {
namespace layers {
using namespace gfx;
void
PadDrawTargetOutFromRegion(RefPtr<DrawTarget> aDrawTarget, nsIntRegion &aRegion)
{
struct LockedBits {
uint8_t *data;
IntSize size;
int32_t stride;
SurfaceFormat format;
static int clamp(int x, int min, int max)
{
if (x < min)
x = min;
if (x > max)
x = max;
return x;
}
static void ensure_memcpy(uint8_t *dst, uint8_t *src, size_t n, uint8_t *bitmap, int stride, int height)
{
if (src + n > bitmap + stride*height) {
MOZ_CRASH("GFX: long src memcpy");
}
if (src < bitmap) {
MOZ_CRASH("GFX: short src memcpy");
}
if (dst + n > bitmap + stride*height) {
MOZ_CRASH("GFX: long dst mempcy");
}
if (dst < bitmap) {
MOZ_CRASH("GFX: short dst mempcy");
}
}
static void visitor(void *closure, VisitSide side, int x1, int y1, int x2, int y2) {
LockedBits *lb = static_cast<LockedBits*>(closure);
uint8_t *bitmap = lb->data;
const int bpp = gfx::BytesPerPixel(lb->format);
const int stride = lb->stride;
const int width = lb->size.width;
const int height = lb->size.height;
if (side == VisitSide::TOP) {
if (y1 > 0) {
x1 = clamp(x1, 0, width - 1);
x2 = clamp(x2, 0, width - 1);
ensure_memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp, bitmap, stride, height);
memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp);
}
} else if (side == VisitSide::BOTTOM) {
if (y1 < height) {
x1 = clamp(x1, 0, width - 1);
x2 = clamp(x2, 0, width - 1);
ensure_memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp, bitmap, stride, height);
memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp);
}
} else if (side == VisitSide::LEFT) {
if (x1 > 0) {
while (y1 != y2) {
memcpy(&bitmap[(x1-1)*bpp + y1 * stride], &bitmap[x1*bpp + y1*stride], bpp);
y1++;
}
}
} else if (side == VisitSide::RIGHT) {
if (x1 < width) {
while (y1 != y2) {
memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[(x1-1)*bpp + y1*stride], bpp);
y1++;
}
}
}
}
} lb;
if (aDrawTarget->LockBits(&lb.data, &lb.size, &lb.stride, &lb.format)) {
// we can only pad software targets so if we can't lock the bits don't pad
aRegion.VisitEdges(lb.visitor, &lb);
aDrawTarget->ReleaseBits(lb.data);
}
}
} // namespace layers
} // namespace mozilla

21
gfx/layers/BufferEdgePad.h Normal file
Просмотреть файл

@ -0,0 +1,21 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#ifndef MOZILLA_LAYERS_BUFFER_EDGE_PAD_H
#define MOZILLA_LAYERS_BUFFER_EDGE_PAD_H
#include "mozilla/gfx/2D.h"
#include "nsRegion.h"
namespace mozilla {
namespace layers {
void PadDrawTargetOutFromRegion(RefPtr<gfx::DrawTarget> aDrawTarget, nsIntRegion &aRegion);
} // namespace layers
} // namespace mozilla
#endif // MOZILLA_LAYERS_BUFFER_EDGE_PAD_H

51
gfx/layers/PaintThread.cpp
Просмотреть файл

@ -12,6 +12,7 @@
#include "gfxPlatform.h"
#include "gfxPrefs.h"
#include "GeckoProfiler.h"
#include "mozilla/layers/BufferEdgePad.h"
#include "mozilla/layers/CompositorBridgeChild.h"
#include "mozilla/layers/ShadowLayers.h"
#include "mozilla/layers/SyncObject.h"
@ -101,6 +102,39 @@ CapturedTiledPaintState::Clear::ClearBuffer()
mTarget->SetTransform(oldTransform);
}
void
CapturedTiledPaintState::EdgePad::EdgePadBuffer()
{
PadDrawTargetOutFromRegion(mTarget, mValidRegion);
}
void
CapturedTiledPaintState::PrePaint()
{
for (auto& copy : mCopies) {
copy.CopyBuffer();
}
for (auto& clear : mClears) {
clear.ClearBuffer();
}
}
void
CapturedTiledPaintState::Paint()
{
mTarget->DrawCapturedDT(mCapture, Matrix());
mTarget->Flush();
}
void
CapturedTiledPaintState::PostPaint()
{
if (mEdgePad) {
mEdgePad->EdgePadBuffer();
}
}
StaticAutoPtr<PaintThread> PaintThread::sSingleton;
StaticRefPtr<nsIThread> PaintThread::sThread;
PlatformThreadId PaintThread::sThreadId;
@ -419,20 +453,9 @@ PaintThread::AsyncPaintTiledContents(CompositorBridgeChild* aBridge,
MOZ_ASSERT(IsOnPaintWorkerThread());
MOZ_ASSERT(aState);
for (auto& copy : aState->mCopies) {
copy.CopyBuffer();
}
for (auto& clear : aState->mClears) {
clear.ClearBuffer();
}
DrawTarget* target = aState->mTarget;
DrawTargetCapture* capture = aState->mCapture;
// Draw all the things into the actual dest target.
target->DrawCapturedDT(capture, Matrix());
target->Flush();
aState->PrePaint();
aState->Paint();
aState->PostPaint();
if (gfxPrefs::LayersOMTPReleaseCaptureOnMainThread()) {
// This should ensure the capture drawtarget, which may hold on to UnscaledFont objects,

18
gfx/layers/PaintThread.h
Просмотреть файл

@ -223,6 +223,19 @@ public:
nsIntRegion mDirtyRegion;
};
struct EdgePad {
EdgePad(RefPtr<gfx::DrawTarget> aTarget,
nsIntRegion&& aValidRegion)
: mTarget(aTarget)
, mValidRegion(aValidRegion)
{}
void EdgePadBuffer();
RefPtr<gfx::DrawTarget> mTarget;
nsIntRegion mValidRegion;
};
CapturedTiledPaintState()
{}
CapturedTiledPaintState(gfx::DrawTarget* aTarget,
@ -244,10 +257,15 @@ public:
mClients.clear();
}
void PrePaint();
void Paint();
void PostPaint();
RefPtr<gfx::DrawTarget> mTarget;
RefPtr<gfx::DrawTargetCapture> mCapture;
std::vector<Copy> mCopies;
std::vector<Clear> mClears;
Maybe<EdgePad> mEdgePad;
std::vector<RefPtr<TextureClient>> mClients;

2
gfx/layers/SourceSurfaceSharedData.cpp
Просмотреть файл

@ -10,6 +10,8 @@
#include "mozilla/Types.h" // for decltype
#include "mozilla/layers/SharedSurfacesChild.h"
#include "base/process_util.h"
#ifdef DEBUG
/**
* If defined, this makes SourceSurfaceSharedData::Finalize memory protect the

187
gfx/layers/client/MultiTiledContentClient.cpp
Просмотреть файл

@ -8,6 +8,7 @@
#include "ClientTiledPaintedLayer.h"
#include "mozilla/layers/LayerMetricsWrapper.h"
#include "mozilla/layers/BufferEdgePad.h"
namespace mozilla {
@ -139,86 +140,6 @@ ClientMultiTiledLayerBuffer::PaintThebes(const nsIntRegion& aNewValidRegion,
mCallbackData = nullptr;
}
void PadDrawTargetOutFromRegion(RefPtr<DrawTarget> drawTarget, nsIntRegion &region)
{
struct LockedBits {
uint8_t *data;
IntSize size;
int32_t stride;
SurfaceFormat format;
static int clamp(int x, int min, int max)
{
if (x < min)
x = min;
if (x > max)
x = max;
return x;
}
static void ensure_memcpy(uint8_t *dst, uint8_t *src, size_t n, uint8_t *bitmap, int stride, int height)
{
if (src + n > bitmap + stride*height) {
MOZ_CRASH("GFX: long src memcpy");
}
if (src < bitmap) {
MOZ_CRASH("GFX: short src memcpy");
}
if (dst + n > bitmap + stride*height) {
MOZ_CRASH("GFX: long dst mempcy");
}
if (dst < bitmap) {
MOZ_CRASH("GFX: short dst mempcy");
}
}
static void visitor(void *closure, VisitSide side, int x1, int y1, int x2, int y2) {
LockedBits *lb = static_cast<LockedBits*>(closure);
uint8_t *bitmap = lb->data;
const int bpp = gfx::BytesPerPixel(lb->format);
const int stride = lb->stride;
const int width = lb->size.width;
const int height = lb->size.height;
if (side == VisitSide::TOP) {
if (y1 > 0) {
x1 = clamp(x1, 0, width - 1);
x2 = clamp(x2, 0, width - 1);
ensure_memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp, bitmap, stride, height);
memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp);
}
} else if (side == VisitSide::BOTTOM) {
if (y1 < height) {
x1 = clamp(x1, 0, width - 1);
x2 = clamp(x2, 0, width - 1);
ensure_memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp, bitmap, stride, height);
memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp);
}
} else if (side == VisitSide::LEFT) {
if (x1 > 0) {
while (y1 != y2) {
memcpy(&bitmap[(x1-1)*bpp + y1 * stride], &bitmap[x1*bpp + y1*stride], bpp);
y1++;
}
}
} else if (side == VisitSide::RIGHT) {
if (x1 < width) {
while (y1 != y2) {
memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[(x1-1)*bpp + y1*stride], bpp);
y1++;
}
}
}
}
} lb;
if (drawTarget->LockBits(&lb.data, &lb.size, &lb.stride, &lb.format)) {
// we can only pad software targets so if we can't lock the bits don't pad
region.VisitEdges(lb.visitor, &lb);
drawTarget->ReleaseBits(lb.data);
}
}
void ClientMultiTiledLayerBuffer::Update(const nsIntRegion& newValidRegion,
const nsIntRegion& aPaintRegion,
const nsIntRegion& aDirtyRegion,
@ -284,6 +205,13 @@ void ClientMultiTiledLayerBuffer::Update(const nsIntRegion& newValidRegion,
}
if (!mPaintTiles.empty()) {
// Perform buffer copies and clears if we don't have the paint thread
if (!(aFlags & TilePaintFlags::Async)) {
for (const auto& state : mPaintStates) {
state->PrePaint();
}
}
// Create a tiled draw target
gfx::TileSet tileset;
for (size_t i = 0; i < mPaintTiles.size(); ++i) {
@ -308,16 +236,18 @@ void ClientMultiTiledLayerBuffer::Update(const nsIntRegion& newValidRegion,
DrawRegionClip::DRAW, nsIntRegion(), mCallbackData);
ctx = nullptr;
// Dispatch to the paint thread or do any work left over
if (aFlags & TilePaintFlags::Async) {
for (const auto& state : mPaintStates) {
PaintThread::Get()->PaintTiledContents(state);
}
mManager->SetQueuedAsyncPaints();
MOZ_ASSERT(mPaintStates.size() > 0);
mPaintStates.clear();
} else {
MOZ_ASSERT(mPaintStates.size() == 0);
for (const auto& state : mPaintStates) {
state->PostPaint();
}
}
mPaintStates.clear();
// Reset
mPaintTiles.clear();
@ -325,38 +255,8 @@ void ClientMultiTiledLayerBuffer::Update(const nsIntRegion& newValidRegion,
std::numeric_limits<int32_t>::max());
}
bool edgePaddingEnabled = gfxPrefs::TileEdgePaddingEnabled();
for (uint32_t i = 0; i < mRetainedTiles.Length(); ++i) {
TileClient& tile = mRetainedTiles[i];
// Only worry about padding when not doing low-res because it simplifies
// the math and the artifacts won't be noticable
// Edge padding prevents sampling artifacts when compositing.
if (edgePaddingEnabled && mResolution == 1 &&
tile.mFrontBuffer && tile.mFrontBuffer->IsLocked()) {
const TileCoordIntPoint tileCoord = newTiles.TileCoord(i);
IntPoint tileOffset = GetTileOffset(tileCoord);
// Strictly speakig we want the unscaled rect here, but it doesn't matter
// because we only run this code when the resolution is equal to 1.
IntRect tileRect = IntRect(tileOffset.x, tileOffset.y,
GetTileSize().width, GetTileSize().height);
nsIntRegion tileDrawRegion = IntRect(tileOffset, scaledTileSize);
tileDrawRegion.AndWith(paintRegion);
nsIntRegion tileValidRegion = mValidRegion;
tileValidRegion.OrWith(tileDrawRegion);
// We only need to pad out if the tile has area that's not valid
if (!tileValidRegion.Contains(tileRect)) {
tileValidRegion = tileValidRegion.Intersect(tileRect);
// translate the region into tile space and pad
tileValidRegion.MoveBy(-IntPoint(tileOffset.x, tileOffset.y));
RefPtr<DrawTarget> drawTarget = tile.mFrontBuffer->BorrowDrawTarget();
PadDrawTargetOutFromRegion(drawTarget, tileValidRegion);
}
}
UnlockTile(tile);
}
}
@ -461,51 +361,64 @@ ClientMultiTiledLayerBuffer::ValidateTile(TileClient& aTile,
drawTarget = dt;
}
// Create the paint operation that will be either dispatched to the paint
// thread, or executed synchronously
RefPtr<CapturedTiledPaintState> paintState = new CapturedTiledPaintState();
paintState->mCopies = std::move(asyncPaintCopies);
// We need to clear the dirty region of the tile before painting
// if we are painting non-opaque content
Maybe<CapturedTiledPaintState::Clear> clear = Nothing();
if (mode != SurfaceMode::SURFACE_OPAQUE) {
clear = Some(CapturedTiledPaintState::Clear{
auto clear = CapturedTiledPaintState::Clear{
dt,
dtOnWhite,
tileDirtyRegion
});
};
paintState->mClears.push_back(clear);
}
// Only worry about padding when not doing low-res because it simplifies
// the math and the artifacts won't be noticable
// Edge padding prevents sampling artifacts when compositing.
if (gfxPrefs::TileEdgePaddingEnabled() && mResolution == 1) {
IntRect tileRect = IntRect(0, 0,
GetScaledTileSize().width,
GetScaledTileSize().height);
// We only need to pad out if the tile has area that's not valid
if (!tileVisibleRegion.Contains(tileRect)) {
tileVisibleRegion = tileVisibleRegion.Intersect(tileRect);
paintState->mEdgePad = Some(CapturedTiledPaintState::EdgePad{
drawTarget,
std::move(tileVisibleRegion),
});
}
}
paintState->mClients = std::move(asyncPaintClients);
paintState->mClients.push_back(backBuffer);
if (backBufferOnWhite) {
paintState->mClients.push_back(backBufferOnWhite);
}
// Queue or execute the paint operation
gfx::Tile paintTile;
paintTile.mTileOrigin = gfx::IntPoint(aTileOrigin.x, aTileOrigin.y);
if (aFlags & TilePaintFlags::Async) {
RefPtr<CapturedTiledPaintState> asyncPaint = new CapturedTiledPaintState();
RefPtr<DrawTargetCapture> captureDT =
Factory::CreateCaptureDrawTarget(drawTarget->GetBackendType(),
drawTarget->GetSize(),
drawTarget->GetFormat());
paintTile.mDrawTarget = captureDT;
asyncPaint->mTarget = drawTarget;
asyncPaint->mCapture = captureDT;
asyncPaint->mCopies = std::move(asyncPaintCopies);
if (clear) {
asyncPaint->mClears.push_back(*clear);
}
asyncPaint->mClients = std::move(asyncPaintClients);
asyncPaint->mClients.push_back(backBuffer);
if (backBufferOnWhite) {
asyncPaint->mClients.push_back(backBufferOnWhite);
}
mPaintStates.push_back(asyncPaint);
paintState->mTarget = drawTarget;
paintState->mCapture = captureDT;
} else {
paintTile.mDrawTarget = drawTarget;
if (clear) {
clear->ClearBuffer();
}
}
mPaintStates.push_back(paintState);
mPaintTiles.push_back(paintTile);
mTilingOrigin.x = std::min(mTilingOrigin.x, paintTile.mTileOrigin.x);

2
gfx/layers/moz.build
Просмотреть файл

@ -125,6 +125,7 @@ EXPORTS.mozilla.layers += [
'basic/MacIOSurfaceTextureHostBasic.h',
'basic/TextureHostBasic.h',
'BSPTree.h',
'BufferEdgePad.h',
'BufferTexture.h',
'CanvasRenderer.h',
'client/CanvasClient.h',
@ -350,6 +351,7 @@ UNIFIED_SOURCES += [
'basic/BasicPaintedLayer.cpp',
'basic/TextureHostBasic.cpp',
'BSPTree.cpp',
'BufferEdgePad.cpp',
'BufferTexture.cpp',
'BufferUnrotate.cpp',
'CanvasRenderer.cpp',

3
gfx/thebes/gfxPlatform.cpp
Просмотреть файл

@ -2728,9 +2728,6 @@ gfxPlatform::InitOMTPConfig()
if (InSafeMode()) {
omtp.ForceDisable(FeatureStatus::Blocked, "OMTP blocked by safe-mode",
NS_LITERAL_CSTRING("FEATURE_FAILURE_COMP_SAFEMODE"));
} else if (gfxPrefs::TileEdgePaddingEnabled()) {
omtp.ForceDisable(FeatureStatus::Blocked, "OMTP does not yet support tiling with edge padding",
NS_LITERAL_CSTRING("FEATURE_FAILURE_OMTP_TILING"));
}
if (omtp.IsEnabled()) {

8
js/src/ds/LifoAlloc.cpp
Просмотреть файл

@ -208,6 +208,14 @@ LifoAlloc::newChunkWithCapacity(size_t n)
bool protect = false;
#ifdef LIFO_CHUNK_PROTECT
protect = protect_;
// In a few cases where we keep adding memory protection, we might OOM while
// doing a mprotect / VirtualProtect due to the consumption of space in the
// page table reserved by the system. This error appears as an OOM on Linux,
// as an Invalid parameters on Windows and as a crash on OS/X. This code caps
// the amount of memory protected in order to limit occurences of this issue.
const size_t MaxPeakSize = 32 * 1024 * 1024;
if (protect && MaxPeakSize <= this->peakSize_)
protect = false;
#endif
// Create a new BumpChunk, and allocate space for it.

495
js/src/jit-test/tests/basic/consume-interpreter-stack-bug1473289.js Normal file
Просмотреть файл

@ -0,0 +1,495 @@
// |jit-test| allow-overrecursed
(function f(x) {
f(x - 1);
Array.prototype.unshift.call(a1, s2, a1, t2, a0, p2, t2);
var r2;
var r3;
var r4;
var r5;
var r6;
var r7;
var r8;
var r9;
var r10;
var r11;
var r12;
var r13;
var r14;
var r15;
var r16;
var r17;
var r18;
var r19;
var r20;
var r21;
var r22;
var r23;
var r24;
var r25;
var r26;
var r27;
var r28;
var r29;
var r30;
var r31;
var r32;
var r33;
var r34;
var r35;
var r36;
var r37;
var r38;
var r39;
var r40;
var r41;
var r42;
var r43;
var r44;
var r45;
var r46;
var r47;
var r48;
var r49;
var r50;
var r51;
var r52;
var r53;
var r54;
var r55;
var r56;
var r57;
var r58;
var r59;
var r60;
var r61;
var r62;
var r63;
var r64;
var r65;
var r66;
var r67;
var r68;
var r69;
var r70;
var r71;
var r72;
var r73;
var r74;
var r75;
var r76;
var r77;
var r78;
var r79;
var r80;
var r81;
var r82;
var r83;
var r84;
var r85;
var r86;
var r87;
var r88;
var r89;
var r90;
var r91;
var r92;
var r93;
var r149;
var r150;
var r151;
var r152;
var r153;
var r154;
var r155;
var r156;
var r157;
var r158;
var r159;
var r160;
var r161;
var r162;
var r163;
var r164;
var r165;
var r166;
var r167;
var r168;
var r169;
var r170;
var r171;
var r172;
var r173;
var r174;
var r175;
var r176;
var r177;
var r178;
var r179;
var r180;
var r181;
var r182;
var r183;
var r184;
var r185;
var r186;
var r187;
var r188;
var r189;
var r190;
var r191;
var r192;
var r193;
var r194;
var r195;
var r196;
var r197;
var r198;
var r199;
var r200;
var r201;
var r202;
var r203;
var r204;
var r205;
var r206;
var r207;
var r208;
var r209;
var r210;
var r211;
var r212;
var r213;
var r214;
var r215;
var r216;
var r217;
var r218;
var r219;
var r220;
var r221;
var r222;
var r223;
var r224;
var r225;
var r226;
var r227;
var r228;
var r229;
var r230;
var r231;
var r232;
var r233;
var r234;
var r235;
var r236;
var r237;
var r238;
var r239;
var r240;
var r241;
var r242;
var r243;
var r244;
var r245;
var r246;
var r247;
var r248;
var r249;
var r250;
var r251;
var r252;
var r253;
var r254;
var r255;
var r256;
var r257;
var r258;
var r259;
var r260;
var r261;
var r262;
var r263;
var r264;
var r265;
var r266;
var r267;
var r268;
var r269;
var r270;
var r271;
var r272;
var r273;
var r274;
var r275;
var r276;
var r277;
var r278;
var r279;
var r280;
var r281;
var r282;
var r283;
var r284;
var r285;
var r286;
var r287;
var r288;
var r289;
var r290;
var r291;
var r292;
var r293;
var r294;
var r295;
var r296;
var r297;
var r298;
var r299;
var r300;
var r301;
var r302;
var r303;
var r304;
var r305;
var r306;
var r307;
var r308;
var r309;
var r310;
var r311;
var r312;
var r313;
var r314;
var r315;
var r316;
var r317;
var r318;
var r319;
var r320;
var r321;
var r322;
var r323;
var r324;
var r325;
var r326;
var r327;
var r328;
var r329;
var r330;
var r331;
var r332;
var r333;
var r334;
var r335;
var r336;
var r337;
var r338;
var r339;
var r340;
var r341;
var r342;
var r343;
var r344;
var r345;
var r346;
var r347;
var r348;
var r349;
var r350;
var r351;
var r352;
var r353;
var r354;
var r355;
var r356;
var r357;
var r358;
var r359;
var r360;
var r361;
var r362;
var r363;
var r364;
var r365;
var r366;
var r367;
var r368;
var r369;
var r370;
var r371;
var r372;
var r373;
var r374;
var r375;
var r376;
var r377;
var r378;
var r379;
var r380;
var r381;
var r382;
var r383;
var r384;
var r385;
var r386;
var r387;
var r388;
var r389;
var r390;
var r391;
var r392;
var r393;
var r394;
var r395;
var r396;
var r397;
var r398;
var r399;
var r400;
var r401;
var r402;
var r403;
var r404;
var r405;
var r406;
var r407;
var r408;
var r409;
var r410;
var r411;
var r412;
var r413;
var r414;
var r415;
var r416;
var r417;
var r418;
var r419;
var r420;
var r421;
var r422;
var r423;
var r424;
var r425;
var r426;
var r427;
var r428;
var r429;
var r430;
var r431;
var r432;
var r433;
var r434;
var r435;
var r436;
var r437;
var r438;
var r439;
var r440;
var r441;
var r442;
var r443;
var r444;
var r445;
var r446;
var r447;
var r448;
var r449;
var r450;
var r451;
var r452;
var r453;
var r454;
var r455;
var r456;
var r457;
var r458;
var r459;
var r460;
var r461;
var r462;
var r463;
var r464;
var r465;
var r466;
var r467;
var r468;
var r469;
var r470;
var r471;
var r472;
var r473;
var r474;
var r475;
var r476;
var r477;
var r478;
var r479;
var r480;
var r481;
var r482;
var r483;
var r484;
var r485;
var r486;
var r487;
var r488;
var r489;
var r490;
var r491;
var r492;
var r493;
var r494;
var r495;
var r496;
var r497;
var r498;
var r499;
var r500;
var r501;
var r502;
var r503;
var r504;
var r505;
var r506;
var r507;
var r508;
var r509;
var r510;
var r511;
var r512;
var r513;
var r514;
var r515;
var r516;
var r517;
var r518;
var r519;
var r520;
var r521;
var r522;
var r523;
var r524;
var r525;
var r526;
var r527;
var r528;
var r529;
var r530;
var r531;
var r532;
var r533;
var r534;
var r535;
var r536;
var r537;
var r538;
var r539;
var r540;
var r541;
var r542;
var r543;
var r544;
var r545;
})(32769);

36
js/src/jit-test/tests/basic/expr-decompiler-bug1475953.js Normal file
Просмотреть файл

@ -0,0 +1,36 @@
Object.defineProperty(this, "fuzzutils", { value:{} });
setModuleResolveHook(function(module, specifier) {});
try { evaluate(`
var f = 396684;
var src = "return f(" +Array(10*1000).join("0,")+"Math.atan2());";
var result = new Function(src)();
`);
} catch (exc) {}
try {
evalInWorker(`
function lfEvalInCache(lfCode, lfIncremental = false, lfRunOnce = false) {
ctx = Object.create(ctx, {});
}
try { evaluate(\`
var f = 396684;
var src = "return f(" +Array(10*1000).join("0,")+"Math.atan2());";
var result = new Function(src)();
\`); } catch(exc) {}
`);
evalInWorker(`
Object.defineProperty(this, "fuzzutils", { value:{} });
try { evaluate(\`
var f = 396684;
var src = "return f(" +Array(10*1000).join("0,")+"Math.atan2());";
var result = new Function(src)();
\`); } catch(exc) {}
`);
} catch (exc) {}
try { evalInWorker(`
try { evaluate(\`
var f = 396684;
var src = "return f(" +Array(10*1000).join("0,")+"Math.atan2());";
var result = new Function(src)();
\`); } catch(exc) {}
`);
} catch (exc) {}

28
layout/base/crashtests/354771-1.xul
Просмотреть файл

@ -1,28 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<listbox flex="1" style="float: right">
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="foo"/>
<listitem label="b" style="float: left;"/>
<listitem label="c" style="position: absolute"/>
</listbox>
</window>

29
layout/base/crashtests/373919.xhtml
Просмотреть файл

@ -1,29 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<object id="mw_ij" xmlns="http://www.w3.org/1999/xhtml" style="display: none;"/>
<textnode xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<dir xmlns="http://www.w3.org/1999/xhtml" style="overflow: scroll;position: fixed;"/>
</textnode>
<wizardpage id="mw_ab" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<label id="mw_kl">
<toolbox style="float: right;"/>
</label>
</wizardpage>
<listbox id="mw_cd" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/>
<script xmlns="http://www.w3.org/1999/xhtml">
function doe() {
document.getElementById('mw_ab').insertBefore(document.getElementById('mw_cd'), document.getElementById('mw_ab').childNodes[0]);
document.documentElement.offsetHeight;
document.getElementById('mw_ij').appendChild(document.getElementById('mw_kl'));
document.documentElement.offsetHeight;
}
setTimeout(doe, 100);
setTimeout(function() {window.location=window.location;}, 500);
</script>
</html>

29
layout/base/crashtests/376223-1.xhtml
Просмотреть файл

@ -1,29 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
<script>
function boom()
{
var listbox = document.getElementById("listbox");
var td = document.getElementById("td");
var listitem = document.createElementNS(XUL_NS, "listitem");
listbox.appendChild(listitem);
listbox.appendChild(td);
}
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
</script>
</head>
<body onload="boom();">
<table><tbody><tr><td id="td">X</td></tr></tbody></table>
<xul:listbox id="listbox"/>
</body>
</html>

13
layout/base/crashtests/383102-1.xhtml
Просмотреть файл

@ -1,13 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" >
<body>
<xul:hbox>
<xul:hbox>
<xul:listboxbody><xul:hbox/><span><div></div></span></xul:listboxbody>
</xul:hbox>
<xul:toolbarbutton/>
</xul:hbox>
</body>
</html>

29
layout/base/crashtests/383806-1.xhtml
Просмотреть файл

@ -1,29 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
<script>
function boom()
{
var listbox = document.getElementById("listbox");
var td = document.getElementById("td");
var listitem = document.createElementNS(XUL_NS, "listitem");
listbox.appendChild(listitem);
listbox.appendChild(td);
}
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
</script>
</head>
<body onload="boom();">
<table><tbody><tr><td id="td">X</td></tr></tbody></table>
<xul:listbox id="listbox"/>
</body>
</html>

21
layout/base/crashtests/400185-1.xul
Просмотреть файл

@ -1,21 +0,0 @@
<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(doe, 30);" class="reftest-wait">
<popupgroup id="a"/>
<listcols>
<nativescrollbar id="c">
<treecols/>
</nativescrollbar>
</listcols>
<script>
function doe() {
document.documentElement.id = "true";
document.documentElement.removeChild(document.getElementById('a'));
var ne = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'popupgroup');
document.documentElement.appendChild(ne);
document.getElementById('c').appendChild(document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'treecols'));
document.documentElement.removeChild(ne);
document.documentElement.removeAttribute("class");
}
</script>
</window>

26
layout/base/crashtests/414175-1.xul
Просмотреть файл

@ -1,26 +0,0 @@
<xul xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
<script type="text/javascript">
function boom()
{
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
var oldListbox = document.getElementById("oldListbox");
var listitem = document.getElementById("listitem");
var newListbox = document.createElementNS(XUL_NS, "listbox");
var newHbox = document.createElementNS(XUL_NS, "hbox");
oldListbox.appendChild(newListbox);
listitem.appendChild(newHbox);
newListbox.style.display = "inline";
oldListbox.style.display = "block";
newHbox.style.display = "inline";
}
</script>
<listbox id="oldListbox"><listitem id="listitem" /></listbox>
</xul>

2
layout/base/crashtests/428113.xhtml
Просмотреть файл

@ -1,2 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<listbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="float: right;"><listitem/><listitem/><listitem/><listitem/><listitem/><listitem label="foo"/><listitem style="position: absolute;"/></listbox></html>

22
layout/base/crashtests/514104-1.xul
Просмотреть файл

@ -1,22 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
<!-- there must be no extra elements in the document -->
<window onload="
document.documentElement.removeChild(document.getElementById('b'));
document.getElementById('l').removeChild(document.getElementById('h'));
document.documentElement.appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'span'));"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<bindings xmlns="http://www.mozilla.org/xbl" id="b">
<binding id="foo">
<content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listitem></content>
</binding>
</bindings>
<listbox id="l" style="-moz-binding: url(&quot;#foo&quot;);"><hbox id="h"/></listbox>
<listitem/>
</window>

9
layout/base/crashtests/crashtests.list
Просмотреть файл

@ -116,7 +116,6 @@ load 350128-1.xhtml
load 350267-1.html
load 354133-1.html
load 354766-1.xhtml
load 354771-1.xul
load 355989-1.xhtml
load 355993-1.xhtml
load 356325-1.xul
@ -145,11 +144,9 @@ load 372237-1.html
load 372475-1.xhtml
load 372550-1.html
load 373628-1.html
load 373919.xhtml
load 374193-1.xhtml
load 374297-1.html
load 374297-2.html
load 376223-1.xhtml
load 378325-1.html
load 378682.html
load 379105-1.xhtml
@ -161,9 +158,7 @@ load 379920-2.svg
load 379975.html
load 380096-1.html
load 382204-1.html # bug 1323680
load 383102-1.xhtml
load 383129-1.html
load 383806-1.xhtml
load 384344-1.html
load 384392-1.xhtml
load 384392-2.svg
@ -197,7 +192,6 @@ load 399940-1.xhtml
load 399946-1.xhtml
load 399951-1.html
load 399994-1.html
load 400185-1.xul
load 400445-1.xhtml
load 400904-1.xhtml
load 401589-1.xul
@ -228,7 +222,6 @@ load 411870-1.html
load 412651-1.html
load 413587-1.svg
load 414058-1.html
load 414175-1.xul
load 415503.xhtml
load 416107.xhtml # bug 1323652
HTTP load 419985.html
@ -241,7 +234,6 @@ load 421432.html
load 422276.html
asserts(0-1) load 423107-1.xhtml # bug 866955
load 425981-1.html
load 428113.xhtml
load 428138-1.html
load 428448-1.html
load 429088-1.html
@ -327,7 +319,6 @@ load 500467-1.html
load 501878-1.html
load 503936-1.html
load 507119.html
load 514104-1.xul
load 522374-1.html
load 522374-2.html
load 526378-1.xul

204
layout/base/nsCSSFrameConstructor.cpp
Просмотреть файл

@ -228,9 +228,6 @@ static FrameCtorDebugFlags gFlags[] = {
#include "nsPopupSetFrame.h"
#include "nsTreeColFrame.h"
#include "nsIBoxObject.h"
#include "nsPIListBoxObject.h"
#include "nsListBoxBodyFrame.h"
#include "nsListItemFrame.h"
#include "nsXULLabelFrame.h"
//------------------------------------------------------------------
@ -336,33 +333,6 @@ static int32_t FFWC_recursions=0;
static int32_t FFWC_nextInFlows=0;
#endif
#ifdef MOZ_XUL
static bool
IsXULListBox(nsIContent* aContainer)
{
return aContainer->IsXULElement(nsGkAtoms::listbox);
}
static
nsListBoxBodyFrame*
MaybeGetListBoxBodyFrame(nsIContent* aChild)
{
if (aChild->IsXULElement(nsGkAtoms::listitem) && aChild->GetParent() &&
IsXULListBox(aChild->GetParent())) {
RefPtr<nsXULElement> xulElement =
nsXULElement::FromNode(aChild->GetParent());
nsCOMPtr<nsIBoxObject> boxObject = xulElement->GetBoxObject(IgnoreErrors());
nsCOMPtr<nsPIListBoxObject> listBoxObject = do_QueryInterface(boxObject);
if (listBoxObject) {
return listBoxObject->GetListBoxBody(false);
}
}
return nullptr;
}
#endif // MOZ_XUL
// Returns true if aFrame is an anonymous flex/grid item.
static inline bool
IsAnonymousFlexOrGridItem(const nsIFrame* aFrame)
@ -4345,9 +4315,6 @@ nsCSSFrameConstructor::FindXULTagData(Element* aElement,
SIMPLE_XUL_CREATE(browser, NS_NewSubDocumentFrame),
SIMPLE_XUL_CREATE(progressmeter, NS_NewProgressMeterFrame),
SIMPLE_XUL_CREATE(splitter, NS_NewSplitterFrame),
SIMPLE_TAG_CHAIN(listboxbody,
nsCSSFrameConstructor::FindXULListBoxBodyData),
SIMPLE_TAG_CHAIN(listitem, nsCSSFrameConstructor::FindXULListItemData),
#endif /* MOZ_XUL */
SIMPLE_XUL_CREATE(slider, NS_NewSliderFrame),
SIMPLE_XUL_CREATE(scrollbar, NS_NewScrollbarFrame),
@ -4437,35 +4404,6 @@ nsCSSFrameConstructor::FindXULMenubarData(Element* aElement,
}
#endif /* XP_MACOSX */
/* static */
const nsCSSFrameConstructor::FrameConstructionData*
nsCSSFrameConstructor::FindXULListBoxBodyData(Element* aElement,
ComputedStyle* aComputedStyle)
{
if (aComputedStyle->StyleDisplay()->mDisplay !=
StyleDisplay::MozGridGroup) {
return nullptr;
}
static const FrameConstructionData sListBoxBodyData =
SCROLLABLE_XUL_FCDATA(NS_NewListBoxBodyFrame);
return &sListBoxBodyData;
}
/* static */
const nsCSSFrameConstructor::FrameConstructionData*
nsCSSFrameConstructor::FindXULListItemData(Element* aElement,
ComputedStyle* aComputedStyle)
{
if (aComputedStyle->StyleDisplay()->mDisplay != StyleDisplay::MozGridLine) {
return nullptr;
}
static const FrameConstructionData sListItemData =
SCROLLABLE_XUL_FCDATA(NS_NewListItemFrame);
return &sListItemData;
}
#endif /* MOZ_XUL */
/* static */
@ -5517,13 +5455,9 @@ nsCSSFrameConstructor::ShouldCreateItemsForChild(nsFrameConstructorState& aState
if (aContent->GetPrimaryFrame() &&
aContent->GetPrimaryFrame()->GetContent() == aContent &&
!aState.mCreatingExtraFrames) {
// This condition is known to be reachable for listitems, assert fatally
// elsewhere.
MOZ_ASSERT(MaybeGetListBoxBodyFrame(aContent),
MOZ_ASSERT(false,
"asked to create frame construction item for a node that "
"already has a frame");
NS_ERROR("asked to create frame construction item for a node that already "
"has a frame");
return false;
}
@ -6906,8 +6840,7 @@ nsCSSFrameConstructor::IssueSingleInsertNofications(nsIContent* aStartChild,
for (nsIContent* child = aStartChild;
child != aEndChild;
child = child->GetNextSibling()) {
// listboxes suck.
MOZ_ASSERT(MaybeGetListBoxBodyFrame(child) || !child->GetPrimaryFrame());
MOZ_ASSERT(!child->GetPrimaryFrame());
// Call ContentRangeInserted with this node.
ContentRangeInserted(child, child->GetNextSibling(),
@ -7357,44 +7290,6 @@ nsCSSFrameConstructor::ContentAppended(nsIContent* aFirstNewContent,
#endif
}
#ifdef MOZ_XUL
enum content_operation
{
CONTENT_INSERTED,
CONTENT_REMOVED
};
// Helper function to lookup the listbox body frame and send a notification
// for insertion or removal of content
static bool
NotifyListBoxBody(nsPresContext* aPresContext,
nsIContent* aChild,
// Only used for the removed notification
nsIContent* aOldNextSibling,
nsIFrame* aChildFrame,
content_operation aOperation)
{
nsListBoxBodyFrame* listBoxBodyFrame = MaybeGetListBoxBodyFrame(aChild);
if (listBoxBodyFrame) {
if (aOperation == CONTENT_REMOVED) {
// Except if we have an aChildFrame and its parent is not the right
// thing, then we don't do this. Pseudo frames are so much fun....
if (!aChildFrame || aChildFrame->GetParent() == listBoxBodyFrame) {
listBoxBodyFrame->OnContentRemoved(aPresContext, aChild->GetParent(),
aChildFrame, aOldNextSibling);
return true;
}
} else {
listBoxBodyFrame->OnContentInserted(aChild);
return true;
}
}
return false;
}
#endif // MOZ_XUL
void
nsCSSFrameConstructor::ContentInserted(nsIContent* aChild,
nsILayoutHistoryState* aFrameState,
@ -7473,25 +7368,6 @@ nsCSSFrameConstructor::ContentRangeInserted(nsIContent* aStartChild,
NS_ASSERTION(isSingleInsert || aEndChild,
"range should not include all nodes after aStartChild");
#ifdef MOZ_XUL
if (aStartChild->GetParent() && IsXULListBox(aStartChild->GetParent())) {
if (isSingleInsert) {
// The insert case in NotifyListBoxBody doesn't use "old next sibling".
if (NotifyListBoxBody(mPresShell->GetPresContext(),
aStartChild, nullptr, nullptr, CONTENT_INSERTED)) {
return;
}
} else {
// We don't handle a range insert to a listbox parent, issue single
// ContertInserted calls for each node inserted.
LAYOUT_PHASE_TEMP_EXIT();
IssueSingleInsertNofications(aStartChild, aEndChild, InsertionKind::Sync);
LAYOUT_PHASE_TEMP_REENTER();
return;
}
}
#endif // MOZ_XUL
// If we have a null parent, then this must be the document element being
// inserted, or some other child of the document in the DOM (might be a PI,
// say).
@ -7960,13 +7836,6 @@ nsCSSFrameConstructor::ContentRemoved(nsIContent* aChild,
childFrame = nullptr;
}
#ifdef MOZ_XUL
if (NotifyListBoxBody(presContext, aChild, aOldNextSibling,
childFrame, CONTENT_REMOVED)) {
return false;
}
#endif // MOZ_XUL
// If we're removing the root, then make sure to remove things starting at
// the viewport's child instead of the primary frame (which might even be
// null if the root had an XBL binding or display:none, even though the
@ -11137,75 +11006,6 @@ nsCSSFrameConstructor::RecoverLetterFrames(nsContainerFrame* aBlockFrame)
//----------------------------------------------------------------------
// listbox Widget Routines
void
nsCSSFrameConstructor::CreateListBoxContent(nsContainerFrame* aParentFrame,
nsIFrame* aPrevFrame,
nsIContent* aChild,
nsIFrame** aNewFrame,
bool aIsAppend)
{
#ifdef MOZ_XUL
// Construct a new frame
if (aParentFrame) {
nsFrameItems frameItems;
nsFrameConstructorState state(mPresShell,
GetAbsoluteContainingBlock(aParentFrame, FIXED_POS),
GetAbsoluteContainingBlock(aParentFrame, ABS_POS),
GetFloatContainingBlock(aParentFrame),
do_AddRef(mTempFrameTreeState));
if (aChild->IsElement() && !aChild->AsElement()->HasServoData()) {
mPresShell->StyleSet()->StyleNewSubtree(aChild->AsElement());
}
RefPtr<ComputedStyle> computedStyle = ResolveComputedStyle(aChild);
// Pre-check for display "none" - only if we find that, do we create
// any frame at all
const nsStyleDisplay* display = computedStyle->StyleDisplay();
if (StyleDisplay::None == display->mDisplay) {
*aNewFrame = nullptr;
return;
}
AutoFrameConstructionItemList items(this);
AddFrameConstructionItemsInternal(state, aChild, aParentFrame,
true, computedStyle,
ITEM_ALLOW_XBL_BASE, nullptr, items);
ConstructFramesFromItemList(state, items, aParentFrame,
/* aParentIsWrapperAnonBox = */ false,
frameItems);
nsIFrame* newFrame = frameItems.FirstChild();
*aNewFrame = newFrame;
if (newFrame) {
// Notify the parent frame
if (aIsAppend)
((nsListBoxBodyFrame*)aParentFrame)->ListBoxAppendFrames(frameItems);
else
((nsListBoxBodyFrame*)aParentFrame)->ListBoxInsertFrames(aPrevFrame, frameItems);
}
#ifdef ACCESSIBILITY
if (newFrame) {
nsAccessibilityService* accService = nsIPresShell::AccService();
if (accService) {
accService->ContentRangeInserted(mPresShell,
aChild,
aChild->GetNextSibling());
}
}
#endif
}
#endif
}
//----------------------------------------
void
nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState& aState,
nsIContent* aContent,

10
layout/base/nsCSSFrameConstructor.h
Просмотреть файл

@ -349,12 +349,6 @@ public:
*/
nsContainerFrame* GetContentInsertionFrameFor(nsIContent* aContent);
void CreateListBoxContent(nsContainerFrame* aParentFrame,
nsIFrame* aPrevFrame,
nsIContent* aChild,
nsIFrame** aResult,
bool aIsAppend);
// GetInitialContainingBlock() is deprecated in favor of GetRootElementFrame();
// nsIFrame* GetInitialContainingBlock() { return mRootElementFrame; }
// This returns the outermost frame for the root element
@ -1565,10 +1559,6 @@ private:
static const FrameConstructionData*
FindXULMenubarData(Element* aElement, ComputedStyle* aComputedStyle);
#endif /* XP_MACOSX */
static const FrameConstructionData*
FindXULListBoxBodyData(Element* aElement, ComputedStyle* aComputedStyle);
static const FrameConstructionData*
FindXULListItemData(Element* aElement, ComputedStyle* aComputedStyle);
#endif /* MOZ_XUL */
// Function to find FrameConstructionData for aContent using one of the XUL

4
layout/build/nsLayoutCID.h
Просмотреть файл

@ -19,10 +19,6 @@
#define NS_BOXOBJECT_CID \
{ 0xd750a964, 0x2d14, 0x484c, { 0xb3, 0xaa, 0x8e, 0xd7, 0x82, 0x3b, 0x5c, 0x7b } }
// {C2710D40-6F4D-4b7f-9778-76AE5166648C}
#define NS_LISTBOXOBJECT_CID \
{ 0xc2710d40, 0x6f4d, 0x4b7f, { 0x97, 0x78, 0x76, 0xae, 0x51, 0x66, 0x64, 0x8c } }
// {AA40253B-4C42-4056-8132-37BCD07862FD}
#define NS_MENUBOXOBJECT_CID \
{ 0xaa40253b, 0x4c42, 0x4056, { 0x81, 0x32, 0x37, 0xbc, 0xd0, 0x78, 0x62, 0xfd } }

5
layout/build/nsLayoutModule.cpp
Просмотреть файл

@ -300,7 +300,6 @@ nsresult NS_NewLayoutDebugger(nsILayoutDebugger** aResult);
nsresult NS_NewBoxObject(nsIBoxObject** aResult);
#ifdef MOZ_XUL
nsresult NS_NewListBoxObject(nsIBoxObject** aResult);
nsresult NS_NewMenuBoxObject(nsIBoxObject** aResult);
nsresult NS_NewTreeBoxObject(nsIBoxObject** aResult);
#endif
@ -361,7 +360,6 @@ MAKE_CTOR(CreateNewFrameTraversal, nsIFrameTraversal, NS_CreateFrameTr
MAKE_CTOR(CreateNewBoxObject, nsIBoxObject, NS_NewBoxObject)
#ifdef MOZ_XUL
MAKE_CTOR(CreateNewListBoxObject, nsIBoxObject, NS_NewListBoxObject)
MAKE_CTOR(CreateNewMenuBoxObject, nsIBoxObject, NS_NewMenuBoxObject)
MAKE_CTOR(CreateNewTreeBoxObject, nsIBoxObject, NS_NewTreeBoxObject)
#endif // MOZ_XUL
@ -503,7 +501,6 @@ NS_DEFINE_NAMED_CID(NS_LAYOUT_DEBUGGER_CID);
NS_DEFINE_NAMED_CID(NS_FRAMETRAVERSAL_CID);
NS_DEFINE_NAMED_CID(NS_BOXOBJECT_CID);
#ifdef MOZ_XUL
NS_DEFINE_NAMED_CID(NS_LISTBOXOBJECT_CID);
NS_DEFINE_NAMED_CID(NS_MENUBOXOBJECT_CID);
NS_DEFINE_NAMED_CID(NS_TREEBOXOBJECT_CID);
#endif // MOZ_XUL
@ -744,7 +741,6 @@ static const mozilla::Module::CIDEntry kLayoutCIDs[] = {
{ &kNS_FRAMETRAVERSAL_CID, false, nullptr, CreateNewFrameTraversal },
{ &kNS_BOXOBJECT_CID, false, nullptr, CreateNewBoxObject },
#ifdef MOZ_XUL
{ &kNS_LISTBOXOBJECT_CID, false, nullptr, CreateNewListBoxObject },
{ &kNS_MENUBOXOBJECT_CID, false, nullptr, CreateNewMenuBoxObject },
{ &kNS_TREEBOXOBJECT_CID, false, nullptr, CreateNewTreeBoxObject },
#endif // MOZ_XUL
@ -851,7 +847,6 @@ static const mozilla::Module::ContractIDEntry kLayoutContracts[] = {
XPCONNECT_CONTRACTS
{ "@mozilla.org/layout/xul-boxobject;1", &kNS_BOXOBJECT_CID },
#ifdef MOZ_XUL
{ "@mozilla.org/layout/xul-boxobject-listbox;1", &kNS_LISTBOXOBJECT_CID },
{ "@mozilla.org/layout/xul-boxobject-menu;1", &kNS_MENUBOXOBJECT_CID },
{ "@mozilla.org/layout/xul-boxobject-tree;1", &kNS_TREEBOXOBJECT_CID },
#endif // MOZ_XUL

10
layout/generic/crashtests/363848-1.xhtml
Просмотреть файл

@ -1,10 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<body>
<xul:listbox />
</body>
</html>

14
layout/generic/crashtests/472957.xhtml
Просмотреть файл

@ -1,14 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="b">
<content><xul:hbox><children/></xul:hbox></content>
</binding>
</bindings>
</head>
<body><xul:listboxbody height="168178912813" style="-moz-binding: url(#b);"><xul:iframe/></xul:listboxbody></body>
</html>

49
layout/generic/crashtests/494300-1.xul
Просмотреть файл

@ -1,49 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();" class="reftest-wait">
<script type="text/javascript">
// <![CDATA[
var HTML_NS = "http://www.w3.org/1999/xhtml";
var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
function boom()
{
var listbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listbox");
var listitem = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
listbox.appendChild(listitem);
document.documentElement.appendChild(listbox);
var hbox = document.createElementNS(XUL_NS, "hbox");
listbox.appendChild(hbox);
var mphantom = document.createElementNS(MATHML_NS, 'mphantom');
listbox.appendChild(mphantom);
var wax = document.createElementNS(MATHML_NS, 'wax');
hbox.appendChild(wax);
var msub = document.createElementNS(MATHML_NS, 'msub');
wax.appendChild(msub);
var merror = document.createElementNS(MATHML_NS, 'merror');
wax.appendChild(merror);
var span = document.createElementNS(HTML_NS, 'span');
mphantom.appendChild(span);
var vbox = document.createElementNS(XUL_NS, 'vbox');
span.appendChild(vbox);
setTimeout(boom2, 0);
function boom2()
{
var munderover = document.createElementNS(MATHML_NS, 'munderover');
msub.appendChild(munderover);
var mtext = document.createElementNS(MATHML_NS, 'mtext');
span.appendChild(mtext);
document.documentElement.removeAttribute("class");
}
}
// ]]>
</script>
</window>

27
layout/generic/crashtests/547338.xul
Просмотреть файл

@ -1,27 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<script type="text/javascript">
<![CDATA[
function boom()
{
document.getElementById("list").ensureIndexIsVisible(4);
document.getElementById("i4").style.fontSize = "10000%";
}
window.addEventListener("load", boom, false);
]]>
</script>
<listbox id="list" rows="3">
<listitem/>
<listitem/>
<listitem/>
<listitem id="i4" label="Item 4"/><listitem/>
</listbox>
</window>

4
layout/generic/crashtests/crashtests.list
Просмотреть файл

@ -62,7 +62,6 @@ load 360599.html
load 363448.html
load 363722-1.html
load 363722-2.html
load 363848-1.xhtml
load 364220.html
load 364407-1.html
load 364686-1.xhtml
@ -342,7 +341,6 @@ load 472617-1.xhtml
load 472774-1.html
load 472776-1.html
load 472950-1.html
load 472957.xhtml
load 473278-1.xhtml
load 473894-1.html
load 476241-1.html
@ -364,7 +362,6 @@ load 493118-1.html
load 493649.html
load 494283-1.xhtml
load 494283-2.html
load 494300-1.xul
load 494332-1.html
load 495875-1.html
load 495875-2.html
@ -411,7 +408,6 @@ load 541714-1.html
load 541714-2.html
load 542136-1.html
load 545571-1.html
load 547338.xul
load 547843-1.xhtml
load 551635-1.html
load 553504-1.xhtml

2
layout/generic/nsFrameIdList.h
Просмотреть файл

@ -46,9 +46,7 @@ FRAME_ID(nsImageFrame, Image, Leaf)
FRAME_ID(nsInlineFrame, Inline, NotLeaf)
FRAME_ID(nsLeafBoxFrame, LeafBox, Leaf)
FRAME_ID(nsLegendFrame, Legend, NotLeaf)
FRAME_ID(nsListBoxBodyFrame, Box, NotLeaf)
FRAME_ID(nsListControlFrame, ListControl, NotLeaf)
FRAME_ID(nsListItemFrame, Box, NotLeaf)
FRAME_ID(nsMathMLFrame, None, NotLeaf)
FRAME_ID(nsMathMLmactionFrame, None, NotLeaf)
FRAME_ID(nsMathMLmathBlockFrame, Block, NotLeaf)

12
layout/reftests/bugs/486848-1-ref.xul
Просмотреть файл

@ -1,12 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<listbox id="listbox">
<listitem id="a">a</listitem>
<listitem>b</listitem>
<listitem id="c">c</listitem>
</listbox>
</window>

25
layout/reftests/bugs/486848-1.xul
Просмотреть файл

@ -1,25 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="boom();">
<script type="text/javascript">
function boom()
{
var c = document.getElementById("c");
var n = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
n.textContent = "b";
c.parentNode.insertBefore(n, c);
}
</script>
<listbox id="listbox">
<listitem id="a">a</listitem>
<listitem id="c">c</listitem>
</listbox>
</window>

27
layout/reftests/bugs/498228-1-ref.xul
Просмотреть файл

@ -1,27 +0,0 @@
<?xml version="1.0"?>
<window id="list-testcase" title="Testcase"
xmlns:html="http://www.w3.org/1999/xhtml"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
class="reftest-wait">
<script>
function dotest() {
var list = document.getElementById('list');
list.ensureIndexIsVisible(4);
setTimeout("document.documentElement.className = ''", 0);
}
window.addEventListener("load", dotest, false);
</script>
<listbox id="list" rows="3" seltype="single">
<listitem label="Item 1"/>
<listitem label="Item 2"/>
<listitem label="Item 3"/>
<listitem label="Item 4"/>
<listitem label="Item 5" selected="true"/>
</listbox>
</window>

31
layout/reftests/bugs/498228-1.xul
Просмотреть файл

@ -1,31 +0,0 @@
<?xml version="1.0"?>
<window id="list-testcase" title="Testcase"
xmlns:html="http://www.w3.org/1999/xhtml"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
class="reftest-wait">
<script>
function fill() {
var list = document.getElementById('list');
for (var i = 1; i != 6; i++) {
list.appendItem("Item " + i, "");
}
}
function dotest() {
fill();
var list = document.getElementById('list');
list.ensureIndexIsVisible(4);
list.selectItem(list.getItemAtIndex(4));
setTimeout("document.documentElement.className = ''", 0);
}
window.addEventListener("load", dotest, false);
</script>
<listbox id="list" rows="3" seltype="single">
</listbox>
</window>

2
layout/reftests/bugs/reftest.list
Просмотреть файл

@ -1342,7 +1342,6 @@ fuzzy-if(skiaContent,1,5) == 482659-1d.html 482659-1-ref.html
== 486052-2f.html 486052-2-ref.html
== 486052-2g.html 486052-2-ref.html
== 486065-1.html 486065-1-ref.html
== 486848-1.xul 486848-1-ref.xul
== 487539-1.html about:blank
== 488390-1.html 488390-1-ref.html
== 488649-1.html 488649-1-ref.html
@ -1385,7 +1384,6 @@ random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 495385-3.html 495385-3-r
random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 495385-4.html 495385-4-ref.html # Bug 1392106
== 496032-1.html 496032-1-ref.html
== 496840-1.html 496840-1-ref.html
fuzzy-if(skiaContent,1,17000) == 498228-1.xul 498228-1-ref.xul
== 501037.html 501037-ref.html
== 501257-1a.html 501257-1-ref.html
== 501257-1b.html 501257-1-ref.html

247
layout/xul/ListBoxObject.cpp
Просмотреть файл

@ -1,247 +0,0 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "mozilla/dom/ListBoxObject.h"
#include "nsCOMPtr.h"
#include "nsIFrame.h"
#include "nsGkAtoms.h"
#include "nsIScrollableFrame.h"
#include "nsListBoxBodyFrame.h"
#include "ChildIterator.h"
#include "mozilla/dom/Element.h"
#include "mozilla/dom/ListBoxObjectBinding.h"
namespace mozilla {
namespace dom {
NS_IMPL_ISUPPORTS_INHERITED(ListBoxObject, BoxObject, nsIListBoxObject,
nsPIListBoxObject)
ListBoxObject::ListBoxObject()
: mListBoxBody(nullptr)
{
}
ListBoxObject::~ListBoxObject()
{
}
JSObject* ListBoxObject::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
{
return ListBoxObject_Binding::Wrap(aCx, this, aGivenProto);
}
// nsIListBoxObject
NS_IMETHODIMP
ListBoxObject::GetRowCount(int32_t *aResult)
{
*aResult = GetRowCount();
return NS_OK;
}
NS_IMETHODIMP
ListBoxObject::GetItemAtIndex(int32_t index, Element **_retval)
{
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
return body->GetItemAtIndex(index, _retval);
}
return NS_OK;
}
NS_IMETHODIMP
ListBoxObject::GetIndexOfItem(Element* aElement, int32_t *aResult)
{
*aResult = 0;
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
return body->GetIndexOfItem(aElement, aResult);
}
return NS_OK;
}
// ListBoxObject
int32_t
ListBoxObject::GetRowCount()
{
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
return body->GetRowCount();
}
return 0;
}
int32_t
ListBoxObject::GetRowHeight()
{
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
return body->GetRowHeightPixels();
}
return 0;
}
int32_t
ListBoxObject::GetNumberOfVisibleRows()
{
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
return body->GetNumberOfVisibleRows();
}
return 0;
}
int32_t
ListBoxObject::GetIndexOfFirstVisibleRow()
{
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
return body->GetIndexOfFirstVisibleRow();
}
return 0;
}
void
ListBoxObject::EnsureIndexIsVisible(int32_t aRowIndex)
{
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
body->EnsureIndexIsVisible(aRowIndex);
}
}
void
ListBoxObject::ScrollToIndex(int32_t aRowIndex)
{
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
body->ScrollToIndex(aRowIndex);
}
}
void
ListBoxObject::ScrollByLines(int32_t aNumLines)
{
nsListBoxBodyFrame* body = GetListBoxBody(true);
if (body) {
body->ScrollByLines(aNumLines);
}
}
already_AddRefed<Element>
ListBoxObject::GetItemAtIndex(int32_t index)
{
RefPtr<Element> el;
GetItemAtIndex(index, getter_AddRefs(el));
return el.forget();
}
int32_t
ListBoxObject::GetIndexOfItem(Element& aElement)
{
int32_t ret;
GetIndexOfItem(&aElement, &ret);
return ret;
}
//////////////////////
static nsIContent*
FindBodyContent(nsIContent* aParent)
{
if (aParent->IsXULElement(nsGkAtoms::listboxbody)) {
return aParent;
}
mozilla::dom::FlattenedChildIterator iter(aParent);
for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
nsIContent* result = FindBodyContent(child);
if (result) {
return result;
}
}
return nullptr;
}
nsListBoxBodyFrame*
ListBoxObject::GetListBoxBody(bool aFlush)
{
if (mListBoxBody) {
return mListBoxBody;
}
nsIPresShell* shell = GetPresShell(false);
if (!shell) {
return nullptr;
}
nsIFrame* frame = aFlush ?
GetFrame(false) /* does FlushType::Frames */ :
mContent->GetPrimaryFrame();
if (!frame) {
return nullptr;
}
// Iterate over our content model children looking for the body.
nsCOMPtr<nsIContent> content = FindBodyContent(frame->GetContent());
if (!content) {
return nullptr;
}
// this frame will be a nsGFXScrollFrame
frame = content->GetPrimaryFrame();
if (!frame) {
return nullptr;
}
nsIScrollableFrame* scrollFrame = do_QueryFrame(frame);
if (!scrollFrame) {
return nullptr;
}
// this frame will be the one we want
nsIFrame* yeahBaby = scrollFrame->GetScrolledFrame();
if (!yeahBaby) {
return nullptr;
}
// It's a frame. Refcounts are irrelevant.
nsListBoxBodyFrame* listBoxBody = do_QueryFrame(yeahBaby);
NS_ENSURE_TRUE(listBoxBody &&
listBoxBody->SetBoxObject(this),
nullptr);
mListBoxBody = listBoxBody;
return mListBoxBody;
}
void
ListBoxObject::Clear()
{
ClearCachedValues();
BoxObject::Clear();
}
void
ListBoxObject::ClearCachedValues()
{
mListBoxBody = nullptr;
}
} // namespace dom
} // namespace mozilla
// Creation Routine ///////////////////////////////////////////////////////////////////////
nsresult
NS_NewListBoxObject(nsIBoxObject** aResult)
{
NS_ADDREF(*aResult = new mozilla::dom::ListBoxObject());
return NS_OK;
}

55
layout/xul/ListBoxObject.h
Просмотреть файл

@ -1,55 +0,0 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#ifndef mozilla_dom_ListBoxObject_h
#define mozilla_dom_ListBoxObject_h
#include "mozilla/dom/BoxObject.h"
#include "nsPIListBoxObject.h"
namespace mozilla {
namespace dom {
class ListBoxObject final : public BoxObject,
public nsPIListBoxObject
{
public:
NS_DECL_ISUPPORTS_INHERITED
NS_DECL_NSILISTBOXOBJECT
ListBoxObject();
virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
// nsPIListBoxObject
virtual nsListBoxBodyFrame* GetListBoxBody(bool aFlush) override;
// nsPIBoxObject
virtual void Clear() override;
virtual void ClearCachedValues() override;
// ListBoxObject.webidl
int32_t GetRowCount();
int32_t GetRowHeight();
int32_t GetNumberOfVisibleRows();
int32_t GetIndexOfFirstVisibleRow();
void EnsureIndexIsVisible(int32_t rowIndex);
void ScrollToIndex(int32_t rowIndex);
void ScrollByLines(int32_t numLines);
already_AddRefed<Element> GetItemAtIndex(int32_t index);
int32_t GetIndexOfItem(Element& item);
protected:
nsListBoxBodyFrame *mListBoxBody;
private:
~ListBoxObject();
};
} // namespace dom
} // namespace mozilla
#endif // mozilla_dom_ListBoxObject_h

9
layout/xul/crashtests/265161-1.xul
Просмотреть файл

@ -1,9 +0,0 @@
<?xml version="1.0"?>
<window
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
xmlns:html="http://www.w3.org/1999/xhtml">
<html:div>
<listitem>
</listitem>
</html:div>
</window>

17
layout/xul/crashtests/326834-1-inner.xul
Просмотреть файл

@ -1,17 +0,0 @@
<window title="Testcase bug 326834 - Crash with evil xul testcase, using listbox/listitem and display: table-cell"
xmlns:html="http://www.w3.org/1999/xhtml"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<listbox>
<listitem label="This page should not crash Mozilla"/>
</listbox>
<html:script>
function doe() {
var el=document.getElementsByTagName('*');
document.getElementsByTagName('listbox')[0].style.display = 'table-cell';
document.getElementsByTagName('listitem')[0].style.display = 'table-cell';
window.getComputedStyle(document.getElementsByTagName('listitem')[0], '').getPropertyValue("height");
document.getElementsByTagName('listitem')[0].style.display = '';
}
setTimeout(doe,500);
</html:script>
</window>

9
layout/xul/crashtests/326834-1.html
Просмотреть файл

@ -1,9 +0,0 @@
<html class="reftest-wait">
<head>
<script>
setTimeout('document.documentElement.className = ""', 1000);
</script>
<body>
<iframe src="326834-1-inner.xul"></iframe>
</body>
</html>

9
layout/xul/crashtests/360642-1.xul
Просмотреть файл

@ -1,9 +0,0 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
class="reftest-wait"
onload="setTimeout(function() { var foo = document.getElementById('foo'); foo.parentNode.removeChild(foo); document.documentElement.removeAttribute('class'); }, 30);">
<listboxbody>
<hbox id="foo"/>
</listboxbody>
</window>

5
layout/xul/crashtests/383236-1.xul
Просмотреть файл

@ -1,5 +0,0 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<listbox><listhead>x</listhead></listbox>
</window>

8
layout/xul/crashtests/384491-1.xhtml
Просмотреть файл

@ -1,8 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<body>
<xul:listboxbody style="overflow: hidden" />
</body>
</html>

19
layout/xul/crashtests/394120-1.xhtml
Просмотреть файл

@ -1,19 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
<script>
function boom()
{
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
var xultext = document.createElementNS(XUL_NS, "text");
var hbox = document.getElementById("hbox")
hbox.appendChild(xultext);
}
</script>
</head>
<body onload="boom();">
<xul:listboxbody><xul:hbox id="hbox" /></xul:listboxbody>
</body>
</html>

21
layout/xul/crashtests/397293.xhtml
Просмотреть файл

@ -1,21 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
style="opacity: 0.2;">
<head>
<script>
function x()
{
document.documentElement.style.counterReset = "chicken";
document.body.offsetHeight;
}
</script>
</head>
<body onload="setTimeout(x, 0);">Foo</body>
<xul:listbox/>
</html>

1
layout/xul/crashtests/397304-1.html
Просмотреть файл

@ -1 +0,0 @@
<html><body><listboxbody style="display: -moz-grid-group;"></listboxbody></body></html>

17
layout/xul/crashtests/398326-1.xhtml
Просмотреть файл

@ -1,17 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
function boom()
{
var listbox = document.createElementNS(XUL_NS, 'listbox');
document.body.appendChild(listbox);
var listitem = document.createElementNS(XUL_NS, 'listitem');
listbox.appendChild(listitem);
}
</script>
</head>
<body onload="boom();">
</body>
</html>

16
layout/xul/crashtests/400779-1.xhtml
Просмотреть файл

@ -1,16 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
<script>
function boom()
{
var menulist = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "menulist");
document.getElementById("h").appendChild(menulist);
}
</script>
</head>
<body onload="boom();">
<xul:listboxbody><xul:hbox id="h"/></xul:listboxbody>
</body>
</html>

28
layout/xul/crashtests/415394-1.xhtml
Просмотреть файл

@ -1,28 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
class="reftest-wait">
<head>
<script type="text/javascript">
function boom()
{
document.execCommand("justifycenter", false, null);
var listboxbody = document.getElementById("lbb");
listboxbody.height = 9;
setTimeout(boom2, 0);
function boom2()
{
var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
listboxbody.appendChild(td);
document.documentElement.removeAttribute("class");
}
}
</script>
</head>
<body onload="setTimeout(boom, 0);" contenteditable="true"><xul:listboxbody id="lbb"><xul:hbox/><span><col style="width: 100px;" /></span></xul:listboxbody></body>
</html>

6
layout/xul/crashtests/420424-1.xul
Просмотреть файл

@ -1,6 +0,0 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="document.getElementById('a').ensureElementIsVisible(null);">
<listbox id="a"/>
</window>

7
layout/xul/crashtests/431738.xhtml
Просмотреть файл

@ -1,7 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<body>
<div>
<span style="font-size: 0pt;"><xul:listboxbody><span style="border: 1px solid red;"/></xul:listboxbody></span>
</div>
</body>
</html>

31
layout/xul/crashtests/432058-1.xul
Просмотреть файл

@ -1,31 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
<script type="text/javascript">
// <![CDATA[
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
function boom()
{
var lb = document.getElementById("lb");
var firstli = document.getElementById("firstli");
lb.appendChild(document.createElementNS(XUL_NS, "hbox"));
lb.appendChild(document.createElementNS(XUL_NS, "listitem"));
firstli.style.display = "none";
// Flush layout.
document.getBoxObjectFor(document.documentElement).height;
lb.removeChild(firstli);
}
// ]]>
</script>
<listbox id="lb"><listitem id="firstli"/></listbox>
</window>

31
layout/xul/crashtests/432068-1.xul
Просмотреть файл

@ -1,31 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
<hbox style="display: none;">
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="x">
<content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/></content>
</binding>
</bindings>
</hbox>
<script type="text/javascript">
function boom()
{
document.getElementById("b").style.MozBinding = "url('#x')";
// Flush layout.
document.documentElement.boxObject.height;
document.getElementById("listbox").removeChild(document.getElementById("c"));
}
</script>
<listbox id="listbox"><listitem/><listitem id="b"/><listitem id="c"/></listbox>
</window>

24
layout/xul/crashtests/432068-2.xul
Просмотреть файл

@ -1,24 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
<script type="text/javascript">
function boom()
{
var l = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
l.style.display = "none";
var c = document.getElementById("c");
c.parentNode.insertBefore(l, c);
document.getElementById("listbox").removeChild(document.getElementById("c"));
}
</script>
<listbox id="listbox"><listitem/><listitem id="c"/></listbox>
</window>

5
layout/xul/crashtests/433296-1.xul
Просмотреть файл

@ -1,5 +0,0 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<hbox><listboxbody><listheader/><hbox><iframe/></hbox></listboxbody><tabpanels><tabpanels/></tabpanels></hbox>
</window>

23
layout/xul/crashtests/433429.xul
Просмотреть файл

@ -1,23 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
<script type="text/javascript">
function boom()
{
var listbox = document.getElementById("listbox");
listbox.removeChild(listbox.childNodes[1]);
document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Chbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%2F%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
document.documentElement.boxObject.height;
listbox.removeChild(listbox.childNodes[0]);
}
</script>
<listbox id="listbox" style="-moz-binding: url(data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Clistbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%3E%3Cchildren%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%2F%3E%3C%2Flistbox%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A);"><listitem/><listitem/></listbox>
</window>

24
layout/xul/crashtests/464149-1.xul
Просмотреть файл

@ -1,24 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window onload="boom();" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="m"><content><xul:textbox type="text"><children/></xul:textbox></content></binding>
</bindings>
<script type="text/javascript">
<![CDATA[
function boom()
{
document.getElementById("b").style.MozBinding = 'url("data:text/xml,' + encodeURIComponent("<bindings xmlns='http://www.mozilla.org/xbl'><binding id='foo'><content><hbox xmlns='http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul'><children xmlns='http://www.mozilla.org/xbl'/></hbox></content></binding></bindings>\n") + '")';
}
]]>
</script>
<listbox style="float: right;"><listitem/><listitem id="b"/><listitem><hbox style="-moz-binding: url(#m);"/></listitem></listbox>
</window>

6
layout/xul/crashtests/467481-1.xul
Просмотреть файл

@ -1,6 +0,0 @@
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="document.getElementById('a').setAttribute('ordinal', 30);">
<listbox>
<listitem id="a"/>
<listitem><iframe/></listitem>
</listbox>
</window>

19
layout/xul/crashtests/488210-1.xhtml
Просмотреть файл

@ -1,19 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascript">
function boom()
{
var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
var listbox = document.createElementNS(XUL_NS, 'listbox');
document.body.appendChild(listbox);
listbox.appendChild(document.createElementNS(XUL_NS, 'listitem'));
listbox.appendChild(document.createElementNS(XUL_NS, 'listboxbody'));
listbox.appendChild(document.createElementNS(XUL_NS, 'hbox'));
}
</script>
</head>
<body onload="boom();"></body>
</html>

239
layout/xul/crashtests/495728-1.xul
Просмотреть файл

@ -1,239 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
<window id="list-testcase" title="Testcase"
xmlns:html="http://www.w3.org/1999/xhtml"
xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
class="reftest-wait">
<script>
function scrollup() {
var list = document.getElementById('list');
var firstindex = list.getIndexOfItem(document.getElementById('first'));
list.ensureIndexIsVisible(firstindex);
setTimeout("document.documentElement.removeAttribute('class')",1);
}
function scrolldown() {
var list = document.getElementById('list');
var lastindex = list.getIndexOfItem(document.getElementById('last'));
list.ensureIndexIsVisible(lastindex);
setTimeout("scrollup()",1);
}
window.addEventListener("load", scrolldown, false);
</script>
<listbox id="list">
<listitem label="Item x" id="first"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x"/>
<listitem label="Item x" id="last"/>
</listbox>
</window>

6
layout/xul/crashtests/508927-1.xul
Просмотреть файл

@ -1,6 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><xul:listrows xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><xul:listboxbody/><children xmlns="http://www.mozilla.org/xbl"/></xul:listrows></content></binding></bindings>
<hbox style="-moz-binding: url(#foo);"><listitem/><listitem/></hbox>
</window>

6
layout/xul/crashtests/508927-2.xul
Просмотреть файл

@ -1,6 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><xul:listrows xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><xul:listboxbody/><children xmlns="http://www.mozilla.org/xbl"/></xul:listrows></content></binding></bindings>
<hbox style="-moz-binding: url(#foo);"><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/></hbox>
</window>

14
layout/xul/crashtests/514300-1.xul
Просмотреть файл

@ -1,14 +0,0 @@
<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="document.getElementById('listbox').removeChild(document.getElementById('span'));">
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="foo">
<content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listitem></content>
</binding>
</bindings>
<listbox id="listbox" style="-moz-binding: url(#foo)"><span xmlns="http://www.w3.org/1999/xhtml" id="span"/></listbox>
</window>

4
layout/xul/crashtests/536931-1.xhtml
Просмотреть файл

@ -1,4 +0,0 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<listbox id="listbox" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><tab/></listbox>
<script>window.addEventListener("load", function() { document.documentElement.appendChild(document.getElementById("listbox")); }, false);</script>
</html>

26
layout/xul/crashtests/crashtests.list
Просмотреть файл

@ -5,7 +5,6 @@ load 151826-1.xul
load 168724-1.xul
load 189814-1.xul
load 237787-1.xul
load 265161-1.xul
load 289410-1.xul
load 290743.html
load 291702-1.xul
@ -16,7 +15,6 @@ load 311457-1.html
load 321056-1.xhtml
load 322786-1.xul
load 325377.xul
load 326834-1.html
load 326879-1.xul
load 327776-1.xul
load 328135-1.xul
@ -28,7 +26,6 @@ load 344228-1.xul
load 346083-1.xul
load 346281-1.xul
load 350460.xul
load 360642-1.xul
load 365151.xul
load 366112-1.xul
load 366203-1.xul
@ -42,52 +39,29 @@ load 378961.html
load 381862.html
load 382746-1.xul
load 382899-1.xul
load 383236-1.xul
load 384037-1.xhtml
load 384105-1.html
load 384373.html
load 384491-1.xhtml
load 384871-1.html
load 386642.xul
load 387033-1.xhtml
load 387080-1.xul
load 391974-1.html
load 394120-1.xhtml
load 397293.xhtml # bug 1323652
load 397304-1.html
load 398326-1.xhtml
load 399013.xul
load 400779-1.xhtml
load 402912-1.xhtml
load 404192.xhtml
load 407152.xul
load 408904-1.xul
load 412479-1.xhtml
load 415394-1.xhtml
load 417509.xul
load 420424-1.xul
load 430356-1.xhtml
load 431738.xhtml
load 432058-1.xul
load 432068-1.xul
load 432068-2.xul
load 433296-1.xul
load 433429.xul
load 452185.html
load 464149-1.xul
asserts(0-1) load 464407-1.xhtml # Bugs 450974, 1267054, 718883
load 467080.xul
load 467481-1.xul
load 470063-1.html
load 470272.html
load 472189.xul
load 475133.html
load 488210-1.xhtml
load 495728-1.xul
load 508927-1.xul
load 508927-2.xul
load 514300-1.xul
load 536931-1.xhtml
load 538308-1.xul
load 557174-1.xml
load 564705-1.xul

4
layout/xul/grid/crashtests/306911-crash.xul
Просмотреть файл

@ -1,4 +0,0 @@
<?xml version="1.0"?> <?xml-stylesheet href="chrome://global/skin/" type="text/css"?> <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> <listbox id="thelist" flex="1"> <listitem label="Item1" value="item1">
<listitem label="Item2" value="item2"/>
</listitem> </listbox>
</window>

7
layout/xul/grid/crashtests/321073-1.xul
Просмотреть файл

@ -1,7 +0,0 @@
<?xml version="1.0"?>
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<listcols>
<grid/>
<listitem/>
</listcols>
</window>

Некоторые файлы не были показаны из-за слишком большого количества измененных файлов Показать больше