Fix bug 348809. r+sr=dbaron

content/html/content/src/nsGenericHTMLElement.cpp

@@ -2920,6 +2920,9 @@ nsGenericHTMLFormElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     }
 
     if (mForm && aName == nsGkAtoms::type) {
+      nsIDocument* doc = GetDocument();
+      MOZ_AUTO_DOC_UPDATE(doc, UPDATE_CONTENT_STATE, aNotify);
+      
       nsAutoString tmp;
 
       GetAttr(kNameSpaceID_None, nsGkAtoms::name, tmp);
@@ -2935,6 +2938,12 @@ nsGenericHTMLFormElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
       }
 
       mForm->AddElement(this, aNotify);
+
+      // Note: no need to notify on CanBeDisabled(), since type attr
+      // changes can't affect that.
+      if (doc && aNotify) {
+        doc->ContentStatesChanged(this, nsnull, NS_EVENT_STATE_DEFAULT);
+      }
     }
 
     // And notify on content state changes, if any
@@ -2999,6 +3008,9 @@ nsGenericHTMLFormElement::FindAndSetForm()
 PRInt32
 nsGenericHTMLFormElement::IntrinsicState() const
 {
+  // If you add attribute-dependent states here, you need to add them them to
+  // AfterSetAttr too.  And add them to AfterSetAttr for all subclasses that
+  // implement IntrinsicState() and are affected by that attribute.
   PRInt32 state = nsGenericHTMLElement::IntrinsicState();
 
   if (CanBeDisabled()) {

content/html/content/src/nsHTMLFormElement.cpp

@@ -1259,16 +1259,16 @@ nsHTMLFormElement::AddElement(nsIFormControl* aChild,
       mDefaultSubmitElement = aChild;
     }
 
-    // Notify that the states of the new default submit and the previous
-    // default submit element have changed if the element which is the 
-    // default submit element has changed.
+    // Notify that the state of the previous default submit element has changed
+    // if the element which is the default submit element has changed.  The new
+    // default submit element is responsible for its own ContentStatesChanged
+    // call.
     if (aNotify && oldControl != mDefaultSubmitElement) {
       nsIDocument* document = GetCurrentDoc();
       if (document) {
         MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
         nsCOMPtr<nsIContent> oldElement(do_QueryInterface(oldControl));
-        nsCOMPtr<nsIContent> newElement(do_QueryInterface(mDefaultSubmitElement));
-        document->ContentStatesChanged(oldElement, newElement,
+        document->ContentStatesChanged(oldElement, nsnull,
                                        NS_EVENT_STATE_DEFAULT);
       }
     }
@@ -1329,16 +1329,18 @@ nsHTMLFormElement::ResetDefaultSubmitElement(PRBool aNotify,
   mDefaultSubmitElement = FindDefaultSubmit(aPrevDefaultInElements,
                                             aPrevDefaultIndex);
 
-  // Inform about change.
+  // Inform about change.  Note that we dont' notify on the old default submit
+  // (which is being removed) because it's either being removed from the DOM or
+  // changing attributes in a way that makes it responsible for sending its own
+  // notifications.
   if (aNotify && (oldDefaultSubmit || mDefaultSubmitElement)) {
     NS_ASSERTION(mDefaultSubmitElement != oldDefaultSubmit,
                  "Notifying but elements haven't changed.");
     nsIDocument* document = GetCurrentDoc();
     if (document) {
       MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
-      nsCOMPtr<nsIContent> oldElement(do_QueryInterface(oldDefaultSubmit));
       nsCOMPtr<nsIContent> newElement(do_QueryInterface(mDefaultSubmitElement));
-      document->ContentStatesChanged(oldElement, newElement,
+      document->ContentStatesChanged(newElement, nsnull,
                                      NS_EVENT_STATE_DEFAULT);
     }
   }

content/html/content/src/nsHTMLInputElement.cpp

@@ -538,6 +538,11 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
     }
 
     if (aName == nsGkAtoms::type) {
+      // Changing type means notifying on state changes.  Just start a batch
+      // now.
+      nsIDocument* document = GetCurrentDoc();
+      MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, aNotify);
+      
       if (!aValue) {
         // We're now a text input.  Note that we have to handle this manually,
         // since removing an attribute (which is what happened, since aValue is
@@ -572,6 +577,21 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
           LoadImage(src, PR_FALSE, aNotify);
         }
       }
+
+      if (aNotify && document) {
+        // Changing type affects the applicability of some states.  Just notify
+        // on them all now, just in case.  Note that we can't rely on the
+        // notifications LoadImage or CancelImageRequests might have sent,
+        // because those didn't include all the possibly-changed states in the
+        // mask.
+        document->ContentStatesChanged(this, nsnull,
+                                       NS_EVENT_STATE_CHECKED |
+                                       NS_EVENT_STATE_DEFAULT |
+                                       NS_EVENT_STATE_BROKEN |
+                                       NS_EVENT_STATE_USERDISABLED |
+                                       NS_EVENT_STATE_SUPPRESSED |
+                                       NS_EVENT_STATE_LOADING);
+      }
     }
   }
 
@@ -2556,6 +2576,9 @@ nsHTMLInputElement::DoneCreatingElement()
 PRInt32
 nsHTMLInputElement::IntrinsicState() const
 {
+  // If you add states here, and they're type-dependent, you need to add them
+  // to the type case in AfterSetAttr.
+  
   PRInt32 state = nsGenericHTMLFormElement::IntrinsicState();
   if (mType == NS_FORM_INPUT_CHECKBOX || mType == NS_FORM_INPUT_RADIO) {
     // Check current checked state (:checked)

layout/reftests/bugs/348809-1-ref.html

@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+</style>
+</head>
+<body>
+<span>There should be no red</span>
+</body>
+</html>

layout/reftests/bugs/348809-1a.html

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:checked + span { color: red }
+input { display: none }
+</style>
+</head>
+<body>
+<input checked="checked" id="foo"><span>There should be no red</span>
+</body>
+</html>

layout/reftests/bugs/348809-1b.html

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:checked + span { color: green }
+input { display: none }
+</style>
+</head>
+<body>
+<input type="checkbox" checked="checked" id="foo"><span>There should be no red</span>
+</body>
+</html>

layout/reftests/bugs/348809-1c.html

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:checked + span { color: red }
+input { display: none }
+</style>
+</head>
+<body>
+<input type="checkbox" checked="checked" id="foo"><span>There should be no red</span>
+<script>
+  var foo = document.body.offsetWidth;
+  document.getElementById("foo").removeAttribute("type");
+</script>
+</body>
+</html>

layout/reftests/bugs/348809-1d.html

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:checked + span { color: green }
+input { display: none }
+</style>
+</head>
+<body>
+<input checked="checked" id="foo"><span>There should be no red</span>
+<script>
+  var foo = document.body.offsetWidth;
+  document.getElementById("foo").setAttribute("type", "checkbox");
+</script>
+</body>
+</html>

layout/reftests/bugs/348809-1e.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default:checked + span { color: red }
+input { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <input type="submit">
+  <input type="radio" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+</form>
+<script>
+  var foo = document.body.offsetWidth;
+  document.getElementById("foo").setAttribute("type", "submit");
+</script>
+</body>
+</html>

layout/reftests/bugs/348809-1f.html

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default:checked + span { color: red }
+input { display: none }
+</style>
+</head>
+<body>
+<input type="checkbox" checked="checked" id="foo"><span>There should be no red</span>
+ <script>
+  var foo = document.body.offsetWidth;
+  onload='document.getElementById("foo").removeAttribute("checked");'
+</script>
+</body>
+</html>

layout/reftests/bugs/348809-2-ref.html

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <span>There should be no red.</span>
+</div>
+<div>
+  <span>There should be no red.</span>
+</div>
+</form>
+</body>
+</html>

layout/reftests/bugs/348809-2a.html

@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:default + span { color: green }
+span.reverse { color: green }
+:default + span.reverse { color: red }
+input { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <input type="submit" checked="checked" id="foo"><span>There should be no red.</span>
+</div>
+<div>
+  <input type="submit"><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>

layout/reftests/bugs/348809-2b.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:default + span { color: green }
+span.reverse { color: green }
+:default + span.reverse { color: red }
+button { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <button type="submit" checked="checked" id="foo"></button>
+  <span>There should be no red.</span>
+</div>
+<div>
+  <button type="submit"></button><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>

layout/reftests/bugs/348809-2c.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:default + span { color: green }
+span.reverse { color: green }
+:default + span.reverse { color: red }
+input { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <input type="checkbox" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+<div>
+  <input checked="checked"><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>

layout/reftests/bugs/348809-2d.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: red }
+:default + span { color: green }
+span.reverse { color: green }
+:default + span.reverse { color: red }
+input { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <input type="radio" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+<div>
+  <input checked="checked"><span class="reverse">There should be no red.</span>
+</div>
+</form>
+</body>
+</html>

layout/reftests/bugs/348809-2e.html

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default + span { color: red }
+span.reverse { color: red }
+:default + span.reverse { color: green }
+input { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <input type="submit" checked="checked" id="foo"><span>There should be no red.</span>
+</div>
+<div>
+  <input type="submit"><span class="reverse">There should be no red.</span>
+</div>
+</form>
+<script>
+  var foo = document.body.offsetWidth;
+  document.getElementById("foo").removeAttribute("type");
+</script>
+</body>
+</html>

layout/reftests/bugs/348809-2f.html

@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default + span { color: red }
+span.reverse { color: red }
+:default + span.reverse { color: green }
+button { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <button type="submit" checked="checked" id="foo"></button>
+  <span>There should be no red.</span>
+</div>
+<div>
+  <button type="submit"></button><span class="reverse">There should be no red.</span>
+</div>
+</form>
+<script>
+  var foo = document.body.offsetWidth;
+  onload='document.getElementById("foo").setAttribute("type", "button");'
+</script>
+</body>
+</html>

layout/reftests/bugs/348809-2g.html

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default + span { color: red }
+span.reverse { color: red }
+:default + span.reverse { color: green }
+input { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <input type="checkbox" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+<div>
+  <input checked="checked" id="bar">
+  <span class="reverse">There should be no red.</span>
+</div>
+</form>
+<script>
+  var foo = document.body.offsetWidth;
+  document.getElementById("foo").removeAttribute("type");
+  document.getElementById("bar").setAttribute("type", "checkbox");'
+</script>
+</body>
+</html>

layout/reftests/bugs/348809-2h.html

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+span { color: green }
+:default + span { color: red }
+span.reverse { color: red }
+:default + span.reverse { color: green }
+input { display: none }
+</style>
+</head>
+<body>
+<form>
+<div>
+  <input type="radio" checked="checked" id="foo">
+  <span>There should be no red.</span>
+</div>
+<div>
+  <input checked="checked" id="bar">
+  <span class="reverse">There should be no red.</span>
+</div>
+</form>
+<script>
+  var foo = document.body.offsetWidth;
+  document.getElementById("foo").removeAttribute("type");
+  document.getElementById("bar").setAttribute("type", "radio");
+</script>
+</body>
+</html>

layout/reftests/reftest.list

@@ -135,6 +135,20 @@ fails == bugs/368020-4.html bugs/368020-4-ref.html # bug 368085
 == bugs/144004-1.html bugs/144004-1-ref.html
 == bugs/144004-2.html bugs/144004-2-ref.html
 != bugs/144004-3.html bugs/144004-3-ref.html
+== bugs/348801-1a.html bugs/348801-1-ref.html
+== bugs/348801-1b.html bugs/348801-1-ref.html
+== bugs/348801-1c.html bugs/348801-1-ref.html
+== bugs/348801-1d.html bugs/348801-1-ref.html
+== bugs/348801-1e.html bugs/348801-1-ref.html
+== bugs/348801-1f.html bugs/348801-1-ref.html
+== bugs/348801-2a.html bugs/348801-2-ref.html
+== bugs/348801-2b.html bugs/348801-2-ref.html
+== bugs/348801-2c.html bugs/348801-2-ref.html
+== bugs/348801-2d.html bugs/348801-2-ref.html
+== bugs/348801-2e.html bugs/348801-2-ref.html
+== bugs/348801-2f.html bugs/348801-2-ref.html
+== bugs/348801-2g.html bugs/348801-2-ref.html
+== bugs/348801-2h.html bugs/348801-2-ref.html
 
 # object/
 == object/no-attrs.html object/no-attrs-ref.html