Don't install fields during binding teardown. Bug 400705, r+sr=sicking, a=beltzner

This commit is contained in:
bzbarsky@mit.edu 2007-10-24 15:13:00 -07:00
Родитель e667ba7532
Коммит 1c1cd87806
4 изменённых файлов: 67 добавлений и 4 удалений

Просмотреть файл

@ -100,8 +100,11 @@ enum {
NODE_IS_INSERTION_PARENT = 0x00001000U,
// Keep track of whether this node is in the middle of binding teardown
NODE_IS_IN_BINDING_TEARDOWN = 0x00002000U,
// Four bits for the script-type ID
NODE_SCRIPT_TYPE_OFFSET = 13,
NODE_SCRIPT_TYPE_OFFSET = 14,
NODE_SCRIPT_TYPE_SIZE = 4,

Просмотреть файл

@ -186,6 +186,11 @@ XBLResolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
return JS_FALSE;
}
if (content->HasFlag(NODE_IS_IN_BINDING_TEARDOWN)) {
// Don't evaluate fields now!
return JS_TRUE;
}
// This mirrors code in nsXBLProtoImpl::InstallImplementation
nsIDocument* doc = content->GetOwnerDoc();
if (!doc) {
@ -1045,7 +1050,7 @@ nsXBLBinding::ChangeDocument(nsIDocument* aOldDocument, nsIDocument* aNewDocumen
if (mPrototypeBinding->HasImplementation()) {
nsIScriptGlobalObject *global = aOldDocument->GetScopeObject();
if (global) {
nsIScriptContext *context = global->GetContext();
nsCOMPtr<nsIScriptContext> context = global->GetContext();
if (context) {
JSContext *cx = (JSContext *)context->GetNativeContext();
@ -1062,8 +1067,6 @@ nsXBLBinding::ChangeDocument(nsIDocument* aOldDocument, nsIDocument* aNewDocumen
if (NS_FAILED(rv))
return;
mPrototypeBinding->UndefineFields(cx, scriptObject);
// XXX Stay in sync! What if a layered binding has an
// <interface>?!
// XXXbz what does that comment mean, really? It seems to date
@ -1115,6 +1118,13 @@ nsXBLBinding::ChangeDocument(nsIDocument* aOldDocument, nsIDocument* aNewDocumen
break;
}
// Do this after unhooking the proto to avoid extra walking along
// the proto chain as the JS engine tries to resolve the properties
// we're removing.
mBoundElement->SetFlags(NODE_IS_IN_BINDING_TEARDOWN);
mPrototypeBinding->UndefineFields(cx, scriptObject);
mBoundElement->UnsetFlags(NODE_IS_IN_BINDING_TEARDOWN);
// Don't remove the reference from the document to the
// wrapper here since it'll be removed by the element
// itself when that's taken out of the document.

Просмотреть файл

@ -55,6 +55,7 @@ _TEST_FILES = \
test_bug378866.xhtml \
test_bug397934.xhtml \
test_bug398135.xhtml \
test_bug400705.xhtml \
bug310107-resource.xhtml \
$(NULL)

Просмотреть файл

@ -0,0 +1,49 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=400705
-->
<head>
<title>Test for Bug 400705</title>
<script type="text/javascript" src="/MochiKit/packed.js"></script>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="test">
<implementation>
<field name="a">window.countera++</field>
<field name="b">window.counterb++</field>
</implementation>
</binding>
</bindings>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=400705">Mozilla Bug 400705</a>
<p id="display" style="-moz-binding: url(#test)"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script class="testbody" type="text/javascript">
<![CDATA[
/** Test for Bug 400705 **/
SimpleTest.waitForExplicitFinish();
addLoadEvent(function() {
window.countera = 0;
window.counterb = 0;
var d = $("display");
// Control to make sure fields are lazy and all
d.a;
is(window.countera, 1, "Should have evaluated field");
d.parentNode.removeChild(d);
is(window.counterb, 0, "Should not evaluate field on binding teardown");
SimpleTest.finish();
});
]]>
</script>
</pre>
</body>
</html>