Bug 423355: Don't dispatch mutation events for native anon content. Patch by smaug. r/sr=sicking

content/base/src/nsContentUtils.cpp

@@ -3191,15 +3191,22 @@ nsContentUtils::HasMutationListeners(nsINode* aNode,
     return PR_FALSE;
   }
 
-  doc->MayDispatchMutationEvent(aTargetForSubtreeModified);
-
   // global object will be null for documents that don't have windows.
   nsCOMPtr<nsPIDOMWindow> window;
   window = do_QueryInterface(doc->GetScriptGlobalObject());
+  // This relies on nsEventListenerManager::AddEventListener, which sets
+  // all mutation bits when there is a listener for DOMSubtreeModified event.
   if (window && !window->HasMutationListeners(aType)) {
     return PR_FALSE;
   }
 
+  if (aNode->IsNodeOfType(nsINode::eCONTENT) &&
+      static_cast<nsIContent*>(aNode)->IsInNativeAnonymousSubtree()) {
+    return PR_FALSE;
+  }
+
+  doc->MayDispatchMutationEvent(aTargetForSubtreeModified);
+
   // If we have a window, we can check it for mutation listeners now.
   nsCOMPtr<nsPIDOMEventTarget> piTarget(do_QueryInterface(window));
   if (piTarget) {

content/base/src/nsDocument.cpp

@@ -5825,13 +5825,11 @@ nsDocument::MutationEventDispatched(nsINode* aTarget)
     nsCOMArray<nsINode> realTargets;
     for (PRInt32 i = 0; i < count; ++i) {
       nsINode* possibleTarget = mSubtreeModifiedTargets[i];
-      nsCOMPtr<nsIContent> content = do_QueryInterface(possibleTarget);
-      if (content && content->IsInNativeAnonymousSubtree()) {
-        if (realTargets.IndexOf(possibleTarget) == -1) {
-          realTargets.AppendObject(possibleTarget);
-        }
-        continue;
-      }
+      NS_ASSERTION(!possibleTarget ||
+                   !possibleTarget->IsNodeOfType(nsINode::eCONTENT) ||
+                   !static_cast<nsIContent*>(possibleTarget)->
+                     IsInNativeAnonymousSubtree(),
+                   "Mutation event targeted to native anonymous content!?!");
 
       nsINode* commonAncestor = nsnull;
       PRInt32 realTargetCount = realTargets.Count();

content/base/src/nsGenericElement.cpp

@@ -2289,13 +2289,11 @@ nsGenericElement::doPreHandleEvent(nsIContent* aContent,
 
   nsCOMPtr<nsIContent> parent = aContent->GetParent();
   if (isAnonForEvents) {
-    // Don't propagate mutation events which are dispatched somewhere inside
-    // native anonymous content.
-    if (aVisitor.mEvent->eventStructType == NS_MUTATION_EVENT) {
-      aVisitor.mParentTarget = nsnull;
-      return NS_OK;
-    }
-
+    // If a DOM event is explicitly dispatched using node.dispatchEvent(), then
+    // all the events are allowed even in the native anonymous content..
+    NS_ASSERTION(aVisitor.mEvent->eventStructType != NS_MUTATION_EVENT ||
+                 aVisitor.mDOMEvent,
+                 "Mutation event dispatched in native anonymous content!?!");
     aVisitor.mEventTargetAtParent = parent;
   } else if (parent) {
     nsCOMPtr<nsIContent> content(do_QueryInterface(aVisitor.mEvent->target));

content/events/src/nsEventListenerManager.cpp

@@ -519,7 +519,7 @@ nsEventListenerManager::AddEventListener(nsIDOMEventListener *aListener,
       NS_ASSERTION(window->IsInnerWindow(),
                    "Setting mutation listener bits on outer window?");
       // If aType is NS_MUTATION_SUBTREEMODIFIED, we need to listen all
-      // mutations.
+      // mutations. nsContentUtils::HasMutationListeners relies on this.
       window->SetMutationListeners((aType == NS_MUTATION_SUBTREEMODIFIED) ?
                                    kAllMutationBits :
                                    MutationBitForEventType(aType));