Bug 502673 - Crash @ nsEditor::NotifyDocumentListeners with multiple state listeners, if listener removes itself during notification. r=timeless

2009-07-08 19:38:13 +01:00 · 2009-07-08 19:38:13 +01:00 · ad17bcea55
--- a/editor/libeditor/base/nsEditor.cpp
+++ b/editor/libeditor/base/nsEditor.cpp
@ -2770,14 +2770,16 @@ nsEditor::NotifyDocumentListeners(TDocumentListenerNotification aNotificationTyp
  if (!numListeners)
    return NS_OK;    // maybe there just aren't any.
 
+  nsCOMArray<nsIDocumentStateListener> listeners(mDocStateListeners);
  nsresult rv = NS_OK;
  PRInt32 i;
+
  switch (aNotificationType)
  {
    case eDocumentCreated:
      for (i = 0; i < numListeners;i++)
      {
-        rv = mDocStateListeners[i]->NotifyDocumentCreated();
+        rv = listeners[i]->NotifyDocumentCreated();
        if (NS_FAILED(rv))
          break;
      }
@ -2786,7 +2788,7 @@ nsEditor::NotifyDocumentListeners(TDocumentListenerNotification aNotificationTyp
    case eDocumentToBeDestroyed:
      for (i = 0; i < numListeners;i++)
      {
-        rv = mDocStateListeners[i]->NotifyDocumentWillBeDestroyed();
+        rv = listeners[i]->NotifyDocumentWillBeDestroyed();
        if (NS_FAILED(rv))
          break;
      }
@ -2805,7 +2807,7 @@ nsEditor::NotifyDocumentListeners(TDocumentListenerNotification aNotificationTyp
        
        for (i = 0; i < numListeners;i++)
        {
-          rv = mDocStateListeners[i]->NotifyDocumentStateChanged(mDocDirtyState);
+          rv = listeners[i]->NotifyDocumentStateChanged(mDocDirtyState);
          if (NS_FAILED(rv))
            break;
        }
--- a/editor/libeditor/base/tests/Makefile.in
+++ b/editor/libeditor/base/tests/Makefile.in
@ -45,6 +45,7 @@ include $(DEPTH)/config/autoconf.mk
 include $(topsrcdir)/config/rules.mk

 _TEST_FILES = \
+		test_bug502673.html \
 		test_selection_move_commands.xul \
 		$(NULL)

--- a/editor/libeditor/base/tests/test_bug502673.html
+++ b/editor/libeditor/base/tests/test_bug502673.html
@ -0,0 +1,150 @@
+<!DOCTYPE HTML>
+<!-- ***** BEGIN LICENSE BLOCK *****
+   - Version: MPL 1.1/GPL 2.0/LGPL 2.1
+   -
+   - The contents of this file are subject to the Mozilla Public License Version
+   - 1.1 (the "License"); you may not use this file except in compliance with
+   - the License. You may obtain a copy of the License at
+   - http://www.mozilla.org/MPL/
+   -
+   - Software distributed under the License is distributed on an "AS IS" basis,
+   - WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+   - for the specific language governing rights and limitations under the
+   - License.
+   -
+   - The Original Code is Editor Test code
+   -
+   - The Initial Developer of the Original Code is
+   - Graeme McCutcheon <graememcc_firefox@graeme-online.co.uk>.
+   - Portions created by the Initial Developer are Copyright (C) 2009
+   - the Initial Developer. All Rights Reserved.
+   -
+   - Contributor(s):
+   -
+   -
+   - Alternatively, the contents of this file may be used under the terms of
+   - either the GNU General Public License Version 2 or later (the "GPL"), or
+   - the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+   - in which case the provisions of the GPL or the LGPL are applicable instead
+   - of those above. If you wish to allow use of your version of this file only
+   - under the terms of either the GPL or the LGPL, and not to allow others to
+   - use your version of this file under the terms of the MPL, indicate your
+   - decision by deleting the provisions above and replace them with the notice
+   - and other provisions required by the GPL or the LGPL. If you do not delete
+   - the provisions above, a recipient may use your version of this file under
+   - the terms of any one of the MPL, the GPL or the LGPL.
+   -
+   - ***** END LICENSE BLOCK ***** -->
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=502673
+-->
+
+<head>
+  <title>Test for Bug 502673</head>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>  
+</head>
+
+<body onload="doTest();">
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=502673">Mozilla Bug 502673</a>
+  <p id="display"></p>
+  <div id="content" style="display: none">
+  </div>
+
+  <pre id="test">
+    <script type="application/javascript">
+
+      /** Test for Bug 502673 **/
+    
+      SimpleTest.waitForExplicitFinish();
+
+      function listener() {
+      }
+
+      listener.prototype =
+      {
+        NotifyDocumentWillBeDestroyed: function () {
+          netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+         
+          if (this.input instanceof
+                Components.interfaces.nsIDOMNSEditableElement) {
+            var editor = this.input.editor;
+            editor.removeDocumentStateListener(this);
+          }
+        },
+
+        NotifyDocumentCreated: function () {
+        },
+
+        NotifyDocumentStateChanged: function (aNowDirty) {
+          netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+
+          if (this.input instanceof
+                Components.interfaces.nsIDOMNSEditableElement) {
+            var editor = this.input.editor;
+            editor.removeDocumentStateListener(this);
+          }
+        },
+
+        QueryInterface: function(iid) {
+          netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+          if (iid.equals(Components.interfaces.nsIDocumentStateListener) ||
+              iid.equals(Components.interfaces.nsISupports))
+            return this;
+          throw Components.results.NS_ERROR_NO_INTERFACE;
+        },
+      };
+
+      function doTest() {
+        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
+        var input = document.getElementById("ip");
+        if (input instanceof Components.interfaces.nsIDOMNSEditableElement) {
+          // Add multiple listeners to the same editor
+          var editor = input.editor;
+          var listener1 = new listener();
+          listener1.input = input;
+          var listener2 = new listener();
+          listener2.input = input;
+          var listener3 = new listener();
+          listener3.input = input;
+          editor.addDocumentStateListener(listener1);
+          editor.addDocumentStateListener(listener2);
+          editor.addDocumentStateListener(listener3);
+
+          // Test 1. Fire NotifyDocumentStateChanged notifications where the
+          // listeners remove themselves
+          input.value = "mozilla";
+          editor.undo(1);
+
+          // Report success if we get here - clearly we didn't crash
+          ok(true, "Multiple listeners removed themselves after " +
+                   "NotifyDocumentStateChanged notifications - didn't crash");
+
+         // Add the listeners again for the next test
+         editor.addDocumentStateListener(listener1);
+         editor.addDocumentStateListener(listener2);
+         editor.addDocumentStateListener(listener3);
+
+        }
+        
+        // Test 2. Fire NotifyDocumentWillBeDestroyed notifications where the
+        // listeners remove themselves (though in the real world, listeners
+        // shouldn't do this as nsEditor::PreDestroy removes them as
+        // listeners anyway)
+        document.body.removeChild(input);
+        ok(true, "Multiple listeners removed themselves after " +
+                 "NotifyDocumentWillBeDestroyed notifications - didn't crash");
+
+       // TODO: Test for NotifyDocumentCreated
+
+       SimpleTest.finish();
+      }
+   </script>
+  </pre>
+
+  <input type="text" id="ip" />
+</body>
+</html>