Bug 436965, r+sr=sicking

content/base/src/nsDocument.cpp

@@ -5115,6 +5115,18 @@ nsDocument::FlushSkinBindings()
   BindingManager()->FlushSkinBindings();
 }
 
+class nsFrameLoaderRunner : public nsRunnable
+{
+public:
+  nsFrameLoaderRunner(nsDocument* aDoc) : mDoc(aDoc) {}
+  NS_IMETHOD Run() {
+    mDoc->InitializeFinalizeFrameLoaders();
+    return NS_OK;
+  }
+private:
+  nsRefPtr<nsDocument> mDoc;
+};
+
 nsresult
 nsDocument::InitializeFrameLoader(nsFrameLoader* aLoader)
 {
@@ -5125,11 +5137,12 @@ nsDocument::InitializeFrameLoader(nsFrameLoader* aLoader)
                "document is being deleted");
     return NS_ERROR_FAILURE;
   }
-  if (mUpdateNestLevel == 0 && !mDelayFrameLoaderInitialization) {
+
-    nsRefPtr<nsFrameLoader> loader = aLoader;
-    return loader->ReallyStartLoading();
-  } else {
   mInitializableFrameLoaders.AppendElement(aLoader);
+  if (!mFrameLoaderRunner) {
+    mFrameLoaderRunner = new nsFrameLoaderRunner(this);
+    NS_ENSURE_TRUE(mFrameLoaderRunner, NS_ERROR_OUT_OF_MEMORY);
+    nsContentUtils::AddScriptRunner(mFrameLoaderRunner);
   }
   return NS_OK;
 }
@@ -5141,11 +5154,12 @@ nsDocument::FinalizeFrameLoader(nsFrameLoader* aLoader)
   if (mInDestructor) {
     return NS_ERROR_FAILURE;
   }
-  if (mUpdateNestLevel == 0) {
+
-    nsRefPtr<nsFrameLoader> loader = aLoader;
-    loader->Finalize();
-  } else {
   mFinalizableFrameLoaders.AppendElement(aLoader);
+  if (!mFrameLoaderRunner) {
+    mFrameLoaderRunner = new nsFrameLoaderRunner(this);
+    NS_ENSURE_TRUE(mFrameLoaderRunner, NS_ERROR_OUT_OF_MEMORY);
+    nsContentUtils::AddScriptRunner(mFrameLoaderRunner);
   }
   return NS_OK;
 }
@@ -5153,8 +5167,11 @@ nsDocument::FinalizeFrameLoader(nsFrameLoader* aLoader)
 void
 nsDocument::InitializeFinalizeFrameLoaders()
 {
-  NS_ASSERTION(mUpdateNestLevel == 0 && !mDelayFrameLoaderInitialization,
+  mFrameLoaderRunner = nsnull;
-               "Wrong time to call InitializeFinalizeFrameLoaders!");
+  if (mDelayFrameLoaderInitialization || mUpdateNestLevel != 0) {
+    return;
+  }
+
   // Don't use a temporary array for mInitializableFrameLoaders, because
   // loading a frame may cause some other frameloader to be removed from the
   // array. But be careful to keep the loader alive when starting the load!

content/base/src/nsDocument.h

@@ -997,6 +997,7 @@ public:
 
   nsresult CloneDocHelper(nsDocument* clone) const;
 
+  void InitializeFinalizeFrameLoaders();
 protected:
 
   void RegisterNamedItems(nsIContent *aContent);
@@ -1016,8 +1017,6 @@ protected:
 
   void DispatchContentLoadedEvents();
 
-  void InitializeFinalizeFrameLoaders();
-
   void RetrieveRelevantHeaders(nsIChannel *aChannel);
 
   static PRBool TryChannelCharset(nsIChannel *aChannel,
@@ -1262,6 +1261,7 @@ private:
 
   nsTArray<nsRefPtr<nsFrameLoader> > mInitializableFrameLoaders;
   nsTArray<nsRefPtr<nsFrameLoader> > mFinalizableFrameLoaders;
+  nsCOMPtr<nsIRunnable> mFrameLoaderRunner;
 
   nsRevocableEventPtr<nsRunnableMethod<nsDocument> > mPendingTitleChangeEvent;
 

content/html/content/src/nsGenericHTMLElement.cpp

@@ -2865,6 +2865,8 @@ nsGenericHTMLFrameElement::BindToTree(nsIDocument* aDocument,
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (aDocument) {
+    NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
+                 "Missing a script blocker!");
     // We're in a document now.  Kick off the frame load.
     LoadSrc();
   }

content/xul/content/src/nsXULElement.cpp

@@ -849,6 +849,8 @@ nsXULElement::BindToTree(nsIDocument* aDocument,
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (aDocument) {
+      NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(),
+                   "Missing a script blocker!");
       // We're in a document now.  Kick off the frame load.
       LoadSrc();
   }

layout/base/nsCSSFrameConstructor.cpp

@@ -13453,6 +13453,8 @@ void
 nsCSSFrameConstructor::ProcessPendingRestyles()
 {
   NS_PRECONDITION(mDocument, "No document?  Pshaw!\n");
+  NS_PRECONDITION(!nsContentUtils::IsSafeToRunScript(),
+                  "Missing a script blocker!");
 
   PRUint32 count = mPendingRestyles.Count();
 
@@ -13596,6 +13598,8 @@ nsCSSFrameConstructor::LazyGenerateChildrenEvent::Run()
     menuPopupFrame->SetGeneratedChildren();
 #endif
 
+   {
+      nsAutoScriptBlocker scriptBlocker;
       nsCSSFrameConstructor* fc = mPresShell->FrameConstructor();
       fc->BeginUpdate();
 
@@ -13611,6 +13615,7 @@ nsCSSFrameConstructor::LazyGenerateChildrenEvent::Run()
       frame->SetInitialChildList(nsnull, childItems.childList);
 
       fc->EndUpdate();
+    }
 
     if (mCallback)
       mCallback(mContent, frame, mArg);

layout/base/nsPresShell.cpp

@@ -2396,7 +2396,10 @@ PresShell::InitialReflow(nscoord aWidth, nscoord aHeight)
 
     // Now flush out pending restyles before we actually reflow, in
     // case XBL constructors changed styles somewhere.
+    {
+      nsAutoScriptBlocker scriptBlocker;
       mFrameConstructor->ProcessPendingRestyles();
+    }
 
     // And that might have run _more_ XBL constructors
     NS_ENSURE_STATE(!mHaveShutDown);
@@ -2499,7 +2502,10 @@ PresShell::ResizeReflow(nscoord aWidth, nscoord aHeight)
     nsCOMPtr<nsIPresShell> kungFuDeathGrip(this);
 
     // Make sure style is up to date
+    {
+      nsAutoScriptBlocker scriptBlocker;
       mFrameConstructor->ProcessPendingRestyles();
+    }
 
     if (!mIsDestroying) {
       // XXX Do a full invalidate at the beginning so that invalidates along
@@ -4496,6 +4502,7 @@ PresShell::DoFlushPendingNotifications(mozFlushType aType,
       // reflow).
       mPresContext->FlushUserFontSet();
 
+      nsAutoScriptBlocker scriptBlocker;
       mFrameConstructor->ProcessPendingRestyles();
     }
 
@@ -4513,6 +4520,7 @@ PresShell::DoFlushPendingNotifications(mozFlushType aType,
     // up the new rules and we'll end up with frames whose style doesn't match
     // the frame type.
     if (!mIsDestroying) {
+      nsAutoScriptBlocker scriptBlocker;
       mFrameConstructor->ProcessPendingRestyles();
     }