Bug 631421: Teach nsImageDocument to say the magic password to nsImageLoadingContent::RemoveObserver. r=jst a=b

2011-02-20 09:40:45 -05:00 · 2011-02-20 09:40:45 -05:00 · d320742fb3
--- a/content/html/document/crashtests/631421.html
+++ b/content/html/document/crashtests/631421.html
@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+"use strict";
+
+var f2;
+
+function newIframe()
+{
+  var f = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  f.setAttributeNS(null, "src", "631421.png");
+  document.body.appendChild(f);
+  return f;
+}
+
+function b1()
+{
+  void newIframe();
+  f2 = newIframe();
+  setTimeout(b2, 0);
+}
+
+function b2()
+{
+  document.body.removeChild(f2);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="b1();"></body>
+</html>
--- a/content/html/document/crashtests/631421.png
+++ b/content/html/document/crashtests/631421.png
--- a/content/html/document/crashtests/crashtests.list
+++ b/content/html/document/crashtests/crashtests.list
@ -12,3 +12,4 @@ load 494225.html
 load 495543.svg
 load 564461.xhtml
 load 601422.html
+load 631421.html
--- a/content/html/document/src/nsImageDocument.cpp
+++ b/content/html/document/src/nsImageDocument.cpp
@ -340,6 +340,11 @@ nsImageDocument::Destroy()
    if (mObservingImageLoader) {
      nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mImageContent);
      if (imageLoader) {
+        // Push a null JSContext on the stack so that code that
+        // nsImageLoadingContent doesn't think it's being called by JS.  See
+        // Bug 631241
+        nsCxPusher pusher;
+        pusher.PushNull();
        imageLoader->RemoveObserver(this);
      }
    }