Bug 425551: Improve script blocker code and use it to prevent async DOM events from keeping link elements alive past CC. Patch by bent. r/sr=sicking

content/base/public/nsIDocument.h

@@ -1061,45 +1061,6 @@ private:
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIDocument, NS_IDOCUMENT_IID)
 
-/**
- * Helper class to automatically handle batching of document updates.  This
- * class will call BeginUpdate on construction and EndUpdate on destruction on
- * the given document with the given update type.  The document could be null,
- * in which case no updates will be called.  The constructor also takes a
- * boolean that can be set to false to prevent notifications.
- */
-class mozAutoDocUpdate
-{
-public:
-  mozAutoDocUpdate(nsIDocument* aDocument, nsUpdateType aUpdateType,
-                   PRBool aNotify) :
-    mDocument(aNotify ? aDocument : nsnull),
-    mUpdateType(aUpdateType)
-  {
-    if (mDocument) {
-      mDocument->BeginUpdate(mUpdateType);
-    }
-  }
-
-  ~mozAutoDocUpdate()
-  {
-    if (mDocument) {
-      mDocument->EndUpdate(mUpdateType);
-    }
-  }
-
-private:
-  nsCOMPtr<nsIDocument> mDocument;
-  nsUpdateType mUpdateType;
-};
-
-#define MOZ_AUTO_DOC_UPDATE_PASTE2(tok,line) tok##line
-#define MOZ_AUTO_DOC_UPDATE_PASTE(tok,line) \
-  MOZ_AUTO_DOC_UPDATE_PASTE2(tok,line)
-#define MOZ_AUTO_DOC_UPDATE(doc,type,notify) \
-  mozAutoDocUpdate MOZ_AUTO_DOC_UPDATE_PASTE(_autoDocUpdater_, __LINE__) \
-  (doc,type,notify)
-
 /**
  * mozAutoSubtreeModified batches DOM mutations so that a DOMSubtreeModified
  * event is dispatched, if necessary, when the outermost mozAutoSubtreeModified

content/base/src/Makefile.in

@@ -102,6 +102,7 @@ EXPORTS		= \
 		nsStubImageDecoderObserver.h \
 		nsStubMutationObserver.h \
 		nsTextFragment.h \
+		mozAutoDocUpdate.h \
 		$(NULL)
 
 CPPSRCS		= \

content/base/src/nsAttrAndChildArray.cpp

@@ -642,6 +642,7 @@ nsAttrAndChildArray::Clear()
     ATTRS(mImpl)[i].~InternalAttr();
   }
 
+  nsAutoScriptBlocker scriptBlocker;
   PRUint32 end = slotCount * ATTRSIZE + ChildCount();
   for (i = slotCount * ATTRSIZE; i < end; ++i) {
     nsIContent* child = static_cast<nsIContent*>(mImpl->mBuffer[i]);

content/base/src/nsContentSink.cpp

@@ -93,6 +93,7 @@
 #include "nsThreadUtils.h"
 #include "nsPresShellIterator.h"
 #include "nsPIDOMWindow.h"
+#include "mozAutoDocUpdate.h"
 
 PRLogModuleInfo* gContentSinkLogModuleInfo;
 

content/base/src/nsContentUtils.cpp

@@ -162,6 +162,8 @@ static NS_DEFINE_CID(kXTFServiceCID, NS_XTFSERVICE_CID);
 #include "nsIScriptError.h"
 #include "nsIConsoleService.h"
 
+#include "mozAutoDocUpdate.h"
+
 const char kLoadAsData[] = "loadAsData";
 
 static const char kJSStackContractID[] = "@mozilla.org/js/xpc/ContextStack;1";

content/base/src/nsDocument.cpp

@@ -160,6 +160,8 @@ static NS_DEFINE_CID(kDOMEventGroupCID, NS_DOMEVENTGROUP_CID);
 
 #include "nsFrameLoader.h"
 
+#include "mozAutoDocUpdate.h"
+
 #ifdef MOZ_LOGGING
 // so we can get logging even in release builds
 #define FORCE_PR_LOG 1
@@ -831,6 +833,8 @@ nsDocument::~nsDocument()
   // links one by one
   DestroyLinkMap();
 
+  nsAutoScriptBlocker scriptBlocker;
+
   PRInt32 indx; // must be signed
   PRUint32 count = mChildren.ChildCount();
   for (indx = PRInt32(count) - 1; indx >= 0; --indx) {
@@ -1085,6 +1089,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
   // from the doc.
   tmp->DestroyLinkMap();
 
+  nsAutoScriptBlocker scriptBlocker;
+
   // Unlink the mChildren nsAttrAndChildArray.
   for (PRInt32 indx = PRInt32(tmp->mChildren.ChildCount()) - 1; 
        indx >= 0; --indx) {

content/base/src/nsGenericDOMDataNode.cpp

@@ -62,6 +62,7 @@
 #include "nsNodeUtils.h"
 #include "nsBindingManager.h"
 #include "nsCCUncollectableMarker.h"
+#include "mozAutoDocUpdate.h"
 
 #include "pldhash.h"
 #include "prprf.h"

content/base/src/nsGenericElement.cpp

@@ -138,6 +138,8 @@
 #include "nsCycleCollectionParticipant.h"
 #include "nsCCUncollectableMarker.h"
 
+#include "mozAutoDocUpdate.h"
+
 #ifdef MOZ_SVG
 PRBool NS_SVG_TestFeature(const nsAString &fstr);
 #endif /* MOZ_SVG */
@@ -2043,7 +2045,8 @@ nsGenericElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
   NS_PRECONDITION(!IsNativeAnonymous() || aBindingParent == this,
                   "Native anonymous content must have itself as its "
                   "own binding parent");
-  
+  NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(), "Need a script blocker!");
+
   if (!aBindingParent && aParent) {
     aBindingParent = aParent->GetBindingParent();
   }
@@ -2175,6 +2178,7 @@ nsGenericElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
   NS_PRECONDITION(aDeep || (!GetCurrentDoc() && !GetBindingParent()),
                   "Shallow unbind won't clear document and binding parent on "
                   "kids!");
+  NS_ASSERTION(!nsContentUtils::IsSafeToRunScript(), "Need a script blocker!");
   // Make sure to unbind this node before doing the kids
   nsIDocument *document =
     HasFlag(NODE_FORCE_XBL_BINDINGS) ? GetOwnerDoc() : GetCurrentDoc();
@@ -3456,13 +3460,17 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGenericElement)
 
   // Unlink child content (and unbind our subtree).
   {
-    PRUint32 i;
-    PRUint32 kids = tmp->mAttrsAndChildren.ChildCount();
-    for (i = kids; i > 0; i--) {
-      // We could probably do a non-deep unbind here when IsInDoc is false
-      // for better performance.
-      tmp->mAttrsAndChildren.ChildAt(i-1)->UnbindFromTree();
-      tmp->mAttrsAndChildren.RemoveChildAt(i-1);    
+    PRUint32 childCount = tmp->mAttrsAndChildren.ChildCount();
+    if (childCount) {
+      // Don't allow script to run while we're unbinding everything.
+      nsAutoScriptBlocker scriptBlocker;
+      while (childCount-- > 0) {
+        // Once we have XPCOMGC we shouldn't need to call UnbindFromTree.
+        // We could probably do a non-deep unbind here when IsInDoc is false
+        // for better performance.
+        tmp->mAttrsAndChildren.ChildAt(childCount)->UnbindFromTree();
+        tmp->mAttrsAndChildren.RemoveChildAt(childCount);
+      }
     }
   }  
 

content/base/src/nsImageLoadingContent.cpp

@@ -77,6 +77,8 @@
 #include "nsEventDispatcher.h"
 #include "nsDOMClassInfo.h"
 
+#include "mozAutoDocUpdate.h"
+
 #ifdef DEBUG_chb
 static void PrintReqURL(imgIRequest* req) {
   if (!req) {

content/base/src/nsObjectLoadingContent.cpp

@@ -83,6 +83,7 @@
 #include "nsFrameLoader.h"
 
 #include "nsObjectLoadingContent.h"
+#include "mozAutoDocUpdate.h"
 
 static NS_DEFINE_CID(kCPluginManagerCID, NS_PLUGINMANAGER_CID);
 

content/events/public/nsPLDOMEvent.h

@@ -66,6 +66,7 @@ public:
 
   NS_IMETHOD Run();
   nsresult PostDOMEvent();
+  nsresult RunDOMEventWhenSafe();
 
   nsCOMPtr<nsIDOMNode>  mEventNode;
   nsCOMPtr<nsIDOMEvent> mEvent;

content/events/src/nsPLDOMEvent.cpp

@@ -41,6 +41,7 @@
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentEvent.h"
 #include "nsIDOMEventTarget.h"
+#include "nsContentUtils.h"
 
 NS_IMETHODIMP nsPLDOMEvent::Run()
 {
@@ -76,3 +77,8 @@ nsresult nsPLDOMEvent::PostDOMEvent()
 {
   return NS_DispatchToCurrentThread(this);
 }
+
+nsresult nsPLDOMEvent::RunDOMEventWhenSafe()
+{
+  return nsContentUtils::AddScriptRunner(this) ? NS_OK : NS_ERROR_FAILURE;
+}

content/html/content/src/nsGenericHTMLElement.cpp

@@ -110,6 +110,7 @@
 #include "nsEventDispatcher.h"
 #include "nsLayoutUtils.h"
 #include "nsContentCreatorFunctions.h"
+#include "mozAutoDocUpdate.h"
 
 class nsINodeInfo;
 class nsIDOMNodeList;

content/html/content/src/nsHTMLFormElement.cpp

@@ -87,6 +87,8 @@
 #include "nsUnicharUtils.h"
 #include "nsEventDispatcher.h"
 
+#include "mozAutoDocUpdate.h"
+
 static const int NS_FORM_CONTROL_LIST_HASHTABLE_SIZE = 16;
 
 class nsFormControlList;

content/html/content/src/nsHTMLHeadingElement.cpp

@@ -42,6 +42,7 @@
 #include "nsPresContext.h"
 #include "nsMappedAttributes.h"
 #include "nsRuleData.h"
+#include "mozAutoDocUpdate.h"
 
 class nsHTMLHeadingElement : public nsGenericHTMLElement,
                              public nsIDOMHTMLHeadingElement

content/html/content/src/nsHTMLInputElement.cpp

@@ -111,6 +111,8 @@
 #include "nsImageLoadingContent.h"
 #include "nsIDOMWindowInternal.h"
 
+#include "mozAutoDocUpdate.h"
+
 // XXX align=left, hspace, vspace, border? other nav4 attrs
 
 static NS_DEFINE_CID(kXULControllersCID,  NS_XULCONTROLLERS_CID);

content/html/content/src/nsHTMLLinkElement.cpp

@@ -209,10 +209,6 @@ nsHTMLLinkElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
 
   UpdateStyleSheetInternal(nsnull);
 
-  // XXXbz we really shouldn't fire the event until after we've finished with
-  // the outermost BindToTree...  In particular, this can effectively cause us
-  // to reenter this code, or for some part of the document to become unbound
-  // inside the event!
   CreateAndDispatchEvent(aDocument, NS_LITERAL_STRING("DOMLinkAdded"));
 
   return rv;  
@@ -243,10 +239,8 @@ nsHTMLLinkElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
     mLinkState = eLinkState_Unknown;
   }
 
-  // XXXbz we really shouldn't fire the event until after we've finished with
-  // the outermost UnbindFromTree...  In particular, this can effectively cause
-  // us to reenter this code, or to be bound to a different tree inside the
-  // event!
+  // Once we have XPCOMGC we shouldn't need to call UnbindFromTree during Unlink
+  // and so this messy event dispatch can go away.
   CreateAndDispatchEvent(oldDoc, NS_LITERAL_STRING("DOMLinkRemoved"));
   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
   UpdateStyleSheetInternal(oldDoc);
@@ -276,7 +270,7 @@ nsHTMLLinkElement::CreateAndDispatchEvent(nsIDocument* aDoc,
 
   nsRefPtr<nsPLDOMEvent> event = new nsPLDOMEvent(this, aEventName);
   if (event) {
-    event->PostDOMEvent();
+    event->RunDOMEventWhenSafe();
   }
 }
 

content/html/content/src/nsHTMLOptionElement.cpp

@@ -69,6 +69,7 @@
 #include "nsIDocument.h"
 #include "nsIDOMDocument.h"
 #include "nsContentCreatorFunctions.h"
+#include "mozAutoDocUpdate.h"
 
 /**
  * Implementation of <option>

content/html/content/src/nsHTMLTextAreaElement.cpp

@@ -75,6 +75,7 @@
 #include "nsLayoutErrors.h"
 #include "nsStubMutationObserver.h"
 #include "nsDOMError.h"
+#include "mozAutoDocUpdate.h"
 
 static NS_DEFINE_CID(kXULControllersCID,  NS_XULCONTROLLERS_CID);
 

content/html/document/src/nsHTMLContentSink.cpp

@@ -121,6 +121,7 @@
 #include "nsIElementObserver.h"
 #include "nsNodeInfoManager.h"
 #include "nsContentCreatorFunctions.h"
+#include "mozAutoDocUpdate.h"
 
 #ifdef NS_DEBUG
 static PRLogModuleInfo* gSinkLogModuleInfo;

content/html/document/src/nsHTMLDocument.cpp

@@ -140,6 +140,7 @@
 #include "nsIEditorStyleSheets.h"
 #include "nsIInlineSpellChecker.h"
 #include "nsRange.h"
+#include "mozAutoDocUpdate.h"
 
 #define NS_MAX_DOCUMENT_WRITE_DEPTH 20
 

content/mathml/content/src/nsMathMLElement.cpp

@@ -51,6 +51,7 @@
 #include "nsIPresShell.h"
 #include "nsPresContext.h"
 #include "nsDOMClassInfoID.h"
+#include "mozAutoDocUpdate.h"
 
 //----------------------------------------------------------------------
 // nsISupports methods:

content/svg/content/src/nsSVGUseElement.cpp

@@ -65,6 +65,7 @@ NS_IMPL_NS_NEW_SVG_ELEMENT(Use)
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsSVGUseElement)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsSVGUseElement,
                                                 nsSVGUseElementBase)
+  nsAutoScriptBlocker scriptBlocker;
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOriginal)
   tmp->DestroyAnonymousContent();
   tmp->RemoveListener();

content/xbl/src/nsXBLBinding.cpp

@@ -345,6 +345,8 @@ nsXBLBinding::InstallAnonymousContent(nsIContent* aAnonParent, nsIContent* aElem
   nsIDocument* doc = aElement->GetCurrentDoc();
   PRBool allowScripts = AllowScripts();
 
+  nsAutoScriptBlocker scriptBlocker;
+
   PRUint32 childCount = aAnonParent->GetChildCount();
   for (PRUint32 i = 0; i < childCount; i++) {
     nsIContent *child = aAnonParent->GetChildAt(i);
@@ -1139,6 +1141,7 @@ nsXBLBinding::ChangeDocument(nsIDocument* aOldDocument, nsIDocument* aNewDocumen
       nsCOMPtr<nsIXULDocument> xuldoc(do_QueryInterface(aOldDocument));
 #endif
 
+      nsAutoScriptBlocker scriptBlocker;
       anonymous->UnbindFromTree(); // Kill it.
 
 #ifdef MOZ_XUL

content/xbl/src/nsXBLInsertionPoint.cpp

@@ -37,6 +37,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXBLInsertionPoint.h"
+#include "nsContentUtils.h"
 
 nsXBLInsertionPoint::nsXBLInsertionPoint(nsIContent* aParentElement,
                                          PRUint32 aIndex,
@@ -125,6 +126,8 @@ nsXBLInsertionPoint::UnbindDefaultContent()
   // Hold a strong ref while doing this, just in case
   nsCOMPtr<nsIContent> defContent = mDefaultContent;
 
+  nsAutoScriptBlocker scriptBlocker;
+
   // Unbind the _kids_ of the default content, not just the default content
   // itself, since they are bound to some other parent.  Basically we want to
   // undo the mess that InstallAnonymousContent created.

content/xbl/src/nsXBLPrototypeBinding.cpp

@@ -141,6 +141,7 @@ class nsXBLInsertionPointEntry {
 public:
   ~nsXBLInsertionPointEntry() {
     if (mDefaultContent) {
+      nsAutoScriptBlocker scriptBlocker;
       // mDefaultContent is a sort of anonymous content within the XBL
       // document, and we own and manage it.  Unhook it here, since we're going
       // away.
@@ -248,6 +249,7 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(nsXBLInsertionPointEntry)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NATIVE(nsXBLInsertionPointEntry)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mInsertionParent)
   if (tmp->mDefaultContent) {
+    nsAutoScriptBlocker scriptBlocker;
     // mDefaultContent is a sort of anonymous content within the XBL
     // document, and we own and manage it.  Unhook it here, since we're going
     // away.
@@ -1285,6 +1287,7 @@ nsXBLPrototypeBinding::ConstructInsertionTable(nsIContent* aContent)
     // in situations where no content ends up being placed at the insertion point.
     PRUint32 defaultCount = child->GetChildCount();
     if (defaultCount > 0) {
+      nsAutoScriptBlocker scriptBlocker;
       // Annotate the insertion point with our default content.
       xblIns->SetDefaultContent(child);
 

content/xml/document/src/nsXMLContentSink.cpp

@@ -96,6 +96,7 @@
 #include "nsNodeUtils.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsEventDispatcher.h"
+#include "mozAutoDocUpdate.h"
 
 #ifdef MOZ_SVG
 #include "nsGUIEvent.h"

content/xtf/src/nsXTFElementWrapper.cpp

@@ -62,6 +62,7 @@
 #include "nsIProgrammingLanguage.h"
 #include "nsIXPConnect.h"
 #include "nsXTFWeakTearoff.h"
+#include "mozAutoDocUpdate.h"
 
 nsXTFElementWrapper::nsXTFElementWrapper(nsINodeInfo* aNodeInfo,
                                          nsIXTFElement* aXTFElement)

content/xul/content/src/nsXULElement.cpp

@@ -151,6 +151,7 @@
 #include "nsXBLBinding.h"
 #include "nsEventDispatcher.h"
 #include "nsPresShellIterator.h"
+#include "mozAutoDocUpdate.h"
 
 /**
  * Three bits are used for XUL Element's lazy state.

content/xul/templates/src/nsXULContentBuilder.cpp

@@ -66,6 +66,7 @@
 #include "nsContentUtils.h"
 #include "nsAttrName.h"
 #include "nsNodeUtils.h"
+#include "mozAutoDocUpdate.h"
 
 #include "jsapi.h"
 #include "pldhash.h"

editor/libeditor/html/nsHTMLAnonymousUtils.cpp

@@ -59,6 +59,7 @@
 #include "nsIDOMCSSStyleDeclaration.h"
 #include "nsIMutationObserver.h"
 #include "nsUnicharUtils.h"
+#include "nsContentUtils.h"
 
 // retrieve an integer stored into a CSS computed float value
 static PRInt32 GetCSSFloatValue(nsIDOMCSSStyleDeclaration * aDecl,
@@ -182,12 +183,16 @@ nsHTMLEditor::CreateAnonymousElement(const nsAString & aTag, nsIDOMNode *  aPare
     if (NS_FAILED(res)) return res;
   }
 
-  // establish parenthood of the element
-  newContent->SetNativeAnonymous();
-  res = newContent->BindToTree(doc, parentContent, newContent, PR_TRUE);
-  if (NS_FAILED(res)) {
-    newContent->UnbindFromTree();
-    return res;
+  {
+    nsAutoScriptBlocker scriptBlocker;
+
+    // establish parenthood of the element
+    newContent->SetNativeAnonymous();
+    res = newContent->BindToTree(doc, parentContent, newContent, PR_TRUE);
+    if (NS_FAILED(res)) {
+      newContent->UnbindFromTree();
+      return res;
+    }
   }
 
   nsElementDeletionObserver* observer =
@@ -237,6 +242,7 @@ nsHTMLEditor::DeleteRefToAnonymousNode(nsIDOMElement* aElement,
   if (aElement) {
     nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
     if (content) {
+      nsAutoScriptBlocker scriptBlocker;
       // Need to check whether aShell has been destroyed (but not yet deleted).
       // In that case presContext->GetPresShell() returns nsnull.
       // See bug 338129.

layout/base/nsCSSFrameConstructor.cpp

@@ -13452,6 +13452,8 @@ nsCSSFrameConstructor::ProcessPendingRestyles()
   // already processing, sending us into an infinite loop.
   mPendingRestyles.Clear();
 
+  nsAutoScriptBlocker scriptBlocker;
+
   // Make sure to not rebuild quote or counter lists while we're
   // processing restyles
   BeginUpdate();

layout/base/nsPresShell.cpp

@@ -1704,6 +1704,8 @@ PresShell::Destroy()
   CancelAllPendingReflows();
   CancelPostedReflowCallbacks();
 
+  nsAutoScriptBlocker scriptBlocker;
+
   // Destroy the frame manager. This will destroy the frame hierarchy
   mFrameConstructor->WillDestroyFrameTree();
   FrameManager()->Destroy();
@@ -4605,6 +4607,7 @@ PresShell::DoFlushPendingNotifications(mozFlushType aType,
     // be good.
     
     if (aType >= Flush_Layout && !mIsDestroying) {
+      nsAutoScriptBlocker scriptBlocker;
       mFrameConstructor->RecalcQuotesAndCounters();
       ProcessReflowCommands(aInterruptibleReflow);
     }

layout/generic/nsFrameSetFrame.cpp

@@ -75,6 +75,7 @@
 #include "nsIContent.h"
 #include "nsDisplayList.h"
 #include "nsNodeUtils.h"
+#include "mozAutoDocUpdate.h"
 
 // masks for mEdgeVisibility
 #define LEFT_VIS   0x0001

layout/style/nsCSSStyleRule.cpp

@@ -76,6 +76,7 @@
 
 #include "nsContentUtils.h"
 #include "nsContentErrors.h"
+#include "mozAutoDocUpdate.h"
 
 #define NS_IF_CLONE(member_)                                                  \
   PR_BEGIN_MACRO                                                              \

layout/style/nsCSSStyleSheet.cpp

@@ -74,6 +74,7 @@
 #include "nsContentUtils.h"
 #include "nsIJSContextStack.h"
 #include "nsIScriptSecurityManager.h"
+#include "mozAutoDocUpdate.h"
 
 // -------------------------------
 // Style Rule List for the DOM